OT: Apple security patches

apit34356 wrote on 3/14/2007, 7:53 PM
Quick overview--
"Apple has released a security update to its Mac OS X operating systems to plug multiple security holes. Bugs in third-party components have also been addressed by the security update.

The availability of Mac OS X 10.4.9 and Security Update 2007-003 on Tuesday follows a month in which the security of the OS was put under the spotlight by the Month of Apple Bugs project, which took place in January and November's Month of Kernel Bugs.

Protection against most of these unpatched bugs was previously available only through unofficial updates or various workarounds.

The flaws covered security bugs in both Apple Mac OS X and Mac OS X Server versions 10.3.x and 10.4.x and carried a variety of risks, the most serious of which might have allowed hackers to inject hostile code onto vulnerable systems. Bypassing security restrictions or launching denial of service attacks was also possible as a result of the flaws, which affect both Intel-based and PowerPC-based Apple systems.

Various bugs in the way Mac OS X mounted disc images, memory corruption risks associated with opening maliciously constructed images, kernel bugs, a brace of flaws in the AppleTalk networking protocol, and a vulnerability involving printing, are among the highlights of the patch batch.

Many of the security fixes address vulnerabilities in products from other vendors that ship with Apple OS X or OS X Server, including bugs in Adobe Flash and OpenSSH.

The security updates can be either downloaded and installed via Software Update preferences, or directly from Apple Downloads as explained in a security advisory from Apple here. A summary of the update has been published by security clearing house US CERT at http://www.us-cert.gov/cas/techalerts/TA07-072A.html."

Comments

Coursedesign wrote on 3/14/2007, 8:21 PM
**** STOP PRESS ****

**** WORLDWIDE NEWS BULLETIN ****

**** SECURITY HOLES FOUND IN OS X ****

**** PRESIDENT BUSH TO SPEAK FROM THE WHITE HOUSE LAWN IN 10 MINUTES ****

Anybody find it remarkable that this rare announcement is made? Probably not if it had been Windows XP, where even though it is very stable after five years of continuous bug fixing, there are still security holes found every single day on average.
apit34356 wrote on 3/14/2007, 8:43 PM
I remove my response because it contained no "Sony references"...............
farss wrote on 3/15/2007, 12:19 AM
And now this, which is kind of relevant as Sony made the batteries. Perhaps the last place for a laptop is on a lap :)

Bob.
John_Cline wrote on 4/30/2007, 7:32 AM
This is interesting....

"April 27, 2007 (Computerworld) Dino Dai Zovi, the New York-based security researcher who took home $10,000 in a highly-publicized MacBook Pro hijack on April 20, has been at the center of a week's worth of controversy about the security of Apple Inc.'s operating system."

It looks like Quicktime has a security hole which affects both Macs and Windows machines. He also says that Vista's security is tighter than Apples. (second paragraph from the bottom.)

$10K hack challenge winner says Vista's code more secure than Mac's
rmack350 wrote on 4/30/2007, 7:45 AM
Sitting here reading this on an Ubuntu Linux system, and reflecting that I get updates and patches every couple of days. It just seems to me that you can't judge a system by the frequency of patches.

Also, every time I want to do anything at the system level, I'm asked for a password, just like Vista, just like the Mac if I remember correctly.

Rob Mack
pjrey wrote on 4/30/2007, 8:26 AM
i know in vista you can change it so it can run like it did in XP regarding the password annoyance... vista is set to run as a normal user, not admin.... and everytime you want want to install, or change system prefs.. it will ask for the admin password... and then aftert the task is complete, go back to normal user... you can chnage this so you can log into vista as admin, and you stay admin the whole time... you are NOT ask for passwords for installing/changing system prefs... most people are not aware you can do this... (im not talking about disabling User Account Control, this would defeat the whole purpose..) instead you can:


1- Click Start, and type “secpol.msc” in the search area and click Enter.
2- You may receive a prompt from UAC, approve/login and proceed.
3- In the left list, choose “Local Policies”, then “Security Options”
4- Set “Accounts: Administrator account status” to Enabled.
5- Set “User Account Control: Admin Approval Mode for the Built-in Administrator account” to Disabled.
6- Now log-off, and you’ll see a new account named “Administrator” will be available, click on it to login.

now when you log in, you enter your password once.. and will never be bothered again for the password....
pj
TheHappyFriar wrote on 4/30/2007, 10:26 AM
He also says that Vista's security is tighter than Apples

Little do computer users know that you can have a 100% secure system if you just unplug the net cable. :) Especially since nobody swapps floppy's anymore!
rmack350 wrote on 4/30/2007, 11:08 AM
This is what users will like, but of course this defeats the purpose because if you run a compromised program as Administrator then the hack/bug/virus also gets to run as administrator and can cause more damage.

When I've played with Vista, all it does is freeze access to everything but a confirmation dialog, and all you have to do is click "OK". This is less than Ubuntu requires. I haven't yet seen Vista ask for a password but I'm not using it constantly. All I've really done is run through the process of turning off all things "Aero". You can get it to look pretty much just like Win2k but with the nice addition of the breadcrumb-style address bar. Anyway, the UAC I've seen is less trouble than Ubuntu and I don't mind it since I agree with the practice.

Rob Mack
Coursedesign wrote on 4/30/2007, 11:44 AM
It looks like the organizers of the Microsoft-sponsored CanSecWest event were so desperate to find some security flaw in OS X, that after the deadline passed with nobody succeeding, they changed the rules first once, then twice. Not until they decided to give the hackers the admin password also, were they able to get through.

Unlike Windows XP, OS X users don't normally run as admin. Big things need an even higher "root" level access, and the root account isn't even enabled by default.

Users of all Windows versions up until and including Windows XP in practice need to run at admin level, because 99.9999% of all applications are written with that assumption. 0.00001% of applications can run at Power User level, which unfortunately is in practice about the same as admin level

Vista finally did it right (other than making UAC too annoying, OS X does this much better), and now we just have to wait a few years for applications to be written properly...

Dino's statement that "Vista's security is tighter than Apple's," sounds very immature. I'd say it is way too early for anyone to tell.

I'd say there are so few Vista machines out there, they're just not an attractive target for hackers... As soon as there are more of them out there, they'll be pounded into the ground...

:O) :O) :O)