Snow Leopard install downgrades Flash
Apple has built a potentially dangerous downgrade into Mac OS X Snow Leopard, according to a security expert.
When Apple's updated operating system is installed, it downgrades Adobe Systems' Flash to an earlier, less secure version. Sophos security expert Graham Cluley said Wednesday in a company blog post that Apple installs version 10.0.23.1, which has not been upgraded to protect users against the latest threats.
"Mac users who have been diligent enough to keep their security up-to-date do not deserve to be silently downgraded," Cluley said in the blog. "We know that hackers keep finding security holes in Adobe's code--and that's deeply concerning because it is so widely used by many internet users, whether on Mac or PC."
Cluley said users need to upgrade Flash Player for Mac immediately to the most current version, 10.0.32.18. Failing to do so could open up users to vulnerabilities that have targeted Flash over the past several months.
"This should be done as a matter of priority," Cluley said. "Adobe is the 'new Microsoft' when it comes to security vulnerabilities, with hackers targeting their software looking for vulnerabilities to exploit."
Adobe has been in the spotlight since last month's release of Snow Leopard, as it works with users on compatability questions regarding its Creative Suite products.
(Via AppleInsider)
Jim Dalrymple has followed Apple and the Mac industry for the last 15 years, first as part of MacCentral and then in various positions at Macworld. A guitar player for 20 years, Jim also writes about the professional audio market, examining the best ways to write and record songs on a Macintosh with Logic Pro and Pro Tools. Jim is a member of the CNET Blog Network and is not an employee of CNET. 
http://news.cnet.com/8301-1009_3-10154662-83.html
The Macintosh and base Linux kernel operating systems have dominated the top spots for vulnerabilities by operating system over the past three years
http://news.cnet.com/8301-13579_3-10187192-37.html
The average selling price of a Mac desktop in the U.S. over the last six months was $1,503, while the average selling price of a Mac notebook was $1,493. Windows customers paid an average of $545 for their desktops over the last six months, while they paid $637 for their notebooks.
http://news.cnet.com/8301-1009_3-10199652-83.html?tag=mncol;posts
Safari hole exploited in seconds at security conference
http://i.gizmodo.com/256768/mac-os-x-less-secure-than-vista
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9072959
http://www.zdnet.com.au/news/security/soa/Mac-OS-X-hacked-under-30-minutes/0,130061744,139241748,00.htm
http://blogs.zdnet.com/security/?p=2941
http://www.wired.com/gadgetlab/2009/09/security-snow-leopard
jobsisamonkey
Anyone claims OS to be 100% malware free, is lying. I also read this. tp://www.wired.com/gadgetlab/2009/09/security-snow-leopard
I have a MAC and very happy about it, but I will definately going to get Windows 7 on Oct 22, using it since RC and it is overall a great experience.
Computers are computers. ...and invariably most modern OS are so close to each other it doesn't matter.
The only issues left are trolls and openess / awareness of security.
jobsisamonkey
Nice thinking @bananaphonerules I agree with you but my CRAPPle friend doesn't think the same way so it's my turn now ;) "
@BingItOn--You couldn't be any more biased if your username was "ILoveMicrosoft". You serve absolutely no purpose on these threads and most people here really don't care what you have to say and you are not going to change anyone's mind when you have such a bias. I know it won't matter to you because you'll just keep on trolling but consider this post a public service announcement.
The thing is that this is an issue created by Apple. The portion of your analogy that you left out is that hypothetical car manufacturer is the one who put a nail in the tire as the new owner drove it off the lot, which resulted in it going flat.
Also if ballmerisanape then jobsisamonkey so they come from same family :).
Just read if you wish and enjoy nothing personal here :)
I would have thought that the Snow Leopard upgrade would just remove Flash from the computer as part of the 7 GB of disk recovery and make you install Flash yourself the first time it was called for by a website same as all the other OS's do.
So just do it...
Am sure you guys do remember Charlie Miller. Here's what he recently said: I'm going to keep saying Snow Leopard is less secure than Windows 7, Miller said. Fix that one thing and I would stop saying it.
source: (Apple's Snow Leopard Is Less Secure Than Windows, But Safer): http://www.wired.com/gadgetlab/2009/09/security-snow-leopard
Endangered OS Snow leopard was released in a hurry because they were already feeling the heat of Windows 7. And after the release of Windows 7, Apple knew they will be DOOMED so they had to do it. That reminds of Vista...
Of course it is not a big deal (I think), and probably flash will update itself after you install the OS.
But I'm sure that some people would have trash Windows and Microsoft.
The double standard is very much in play.
The security "expert" would also concede that any update requests from the same application they have been "diligently" keeping up-to-date, will simply update the application.
So .... let me think .... the security "expert"s' own logic shoots his entire "alarm" to pieces ... tiny little ones, I'd like to add (if not totally obliterated) ...
Bottom-line ... comprehending the security "expert"s own logic yields a simple "***?"
Why was Flash included in the first place? It has nothing to do with OS X and isn't needed for an upgrade.
What on Gods green earth made you think that Adobe didn't provide the software installation package? Anyone know of a different, non-best practice to follow like that?
VD, shame on you, I KNOW you know that the controlling installer simply invokes the 3rd party installer.
Think First
"Think First:
Okay let me think about that. Flash gets installed when you install OS X Snow Leopard. Flash is not needed for OS X to run. It is only there because Apple authorized its inclusion. It is there intentionally.
Thank you, that clears up absolutely nothing. Perhaps you didn't read my comment. To help you, I'll restate it:
Why was Flash included in teh first place?
Read. First. Before. Responding.
Mac OS X java is a first party Apple component.
@ckh1272
Mac OS X java is a first party Apple component."
That's true to an extent, but it is still a component provided by Sun. Besides, there are plenty of other examples of 3rd party installs like that, past and present. This article is still much ado about nothing, if you ask me. This nothing but a bait article for more hits and we all fell for it, hook, line, and sinker.
BTW Sun have nothing to do with the Java implementation on the mac other than to collect the license fee from Apple. But I agree with you that there are a lot of non stories round here designed to start flame wars :/
Apple could add a post or pre-install step to check for latest versions of the bundled 3rd party components; they apparently didn't.
Is it a big deal in a personal use scenario? - No, unless the first Flash-enabled site you happen to visit is a malware spreading one (intentionally set up to be that way, or just freshly hacked).
For a large scale deployments that may be a bigger deal.
No vendor is perfect. Pick imperfections according to your preferences.
What else you expect from CRAPPle fans?"
@BingItOn--I guess we expect the same answer that we get from people like you. Complete and utter ignorance.
@ckh1272, people like me ??? okay I will just ignore your comment as it looks like personal attck :)"
@BingItOn--How is my statement any different than your "CRAPPle fans" statement? Also, it's no more a personal attack than "jobsisamonkey". Think about it for once.
Option 2: Follow the link in the article to the blog post, which has links to Adobe's Flash website, where you can download the latest version (and check the current version).
As usual, the haters have run with this story but really it's a non-event. The reason they have run with it is they have so little to run with that they latch onto anything they can get and make the biggest deal they can of it. They do this to make themselves feel better about the lousy computer decisions they have made themselves.
After all, we were ALL in the same boat on July 29th.
A company works over a year on an OS upgrade.
They have to burn a GM DVD at some point.
How in the HELL will everything be up-to-date when it ships?
Answer: It won't.
Not from Apple, Red Hat, or Microsoft.
Move on.
Microsoft nor red-hat bundles flash with their OS."
Microsoft does bundle Java (3rd party), which has security issues as well, so what is your point??
That fact millions of Mac users don't agree with you isn't even an issue here, but that is what seems to drive your participation in these posts, so carry on.
As for Apple's generous nature, perhaps you should look into that before you end up with not just egg, but rotten egg on your face...
As for Cluley's blog post, it is his job security issues. Bravo to him for finding this and alerting people, even if it would be updated automatically the first time someone tried to use flash. Its just one more thing to make sure you know. And I would say this weather it was for OSX, Windows, *nix, OS2, whatever. I don't fault Apple, and as someone stated earlier, they can't have every single 3rd party software updated at the time they go gold.
- by MaggieRed September 3, 2009 12:58 PM PDT
- Yep and you have to update your Flip-4-Mac too.
- Like this Reply to this comment
-
(62 Comments)