search

Wowfunhappy / Fix-Apple-Mail-CVE-2020-9922

3 stars 1 forks source link

Plugin is disabled on Sierra 10.12.6 #3

Closed JF1701 closed 1 week ago

JF1701 commented 1 week ago

On Sierra it says:

Incompatible Plug-ins Disabled

Mail has disabled the following plug-ins:

MailSecFix

Contact the makers of these plug-ins for versions that are compatible with Mail 10.3.

Wowfunhappy commented 1 week ago

Hi! What is the output of defaults read /Applications/Mail.app/Contents/Info.plist PluginCompatibilityUUID?

In the mail plugin bundle's info.plist, you'll see a long set of strings in the same format. If you add the output of the above command to this list, the plugin should work.

JF1701 commented 1 week ago

The PluginCompatibilityUUID string for 10.12.6 is the same as 10.12.4 (16E195)

So it's already in the plugin Info.plist

Wowfunhappy commented 1 week ago

That's annoying, it should work then. A shame it does not.

Unfortunately, because I use 10.9 Mavericks I don't intend to spend time on this. If you do manage to find a fix (or what's wrong), please let me know.

JF1701 commented 1 week ago

If available, I could try the SIMBL version you previously made.

Wowfunhappy commented 1 week ago

Ah, I forgot about that! Sadly, I don't seem to have a compiled copy anymore, you'd need to build it from source. (And of course, you'd have to disable System Integrity Protection to use SIMBL.)

JF1701 commented 1 week ago

Ah, not great then, about disabling SIP. Anyway, thanks for the help. I will try on 10.11 El Capitan next.

JF1701 commented 1 week ago

I think it needs to be Supported10.12PluginCompatibilityUUIDs for Sierra. Don't get warning anymore. Still have to test if it works.

JF1701 commented 1 week ago

Yes, in the plugin Info.plist SupportedPluginCompatibilityUUIDs needs to be changed to Supported10.12PluginCompatibilityUUIDs for Sierra. El Capitan doesn't need any change.

When I mail myself a folder in Sierra Mail it arrives as a zip file, so hopefully this fixes the vulnerability. Thanks!

Wowfunhappy commented 1 week ago

You're welcome, thanks for sharing!

When I mail myself a folder in Sierra Mail it arrives as a zip file

Yep, this is how I tested it too, as I don't believe there are any public proofs-of-concept of the exploit.