Apple Computer on Tuesday released 20 patches for its OS X operating system designed to fix flaws that could catch users off-guard.
The vulnerabilities apply to Mac OS X v10.3.9 and Mac OS X Server 10.3.9, according to Apple's advisory. The announcement comes roughly a month after Apple issued nearly a dozen patches for its Mac OS.
The advisory also falls just days after Apple's much ballyhooed release of the latest version of its operating system, Mac OS X 10.4, widely known as Tiger. The flaws were already addressed in Tiger, so the patches apply only to the previous version, known as Panther.
Security company Secunia on Wednesday rated Apple's OS X flaws as "highly critical." Among the flaws of greatest concern is a vulnerability in the OS X AppKit that relates to the handling of TIFF graphics files.
"If people view a malicious TIFF, it could result in running arbitrary code," said Thomas Kristensen, chief technology officer for Secunia. "TIFF is usually viewed as safe form to view things, so this makes it more critical."
Another issue of concern is an AppleScript flaw. If users visit a Web site and accept AppleScript from that site, they could find it executing different code than they had expected, Kristensen added.
A flaw affecting the Apache Web server, meanwhile, could allow a buffer overflow in the htdigest program, which if used improperly in a CGI application could in turn allow a remote system attack.
Secunia downplayed the Apache flaw.
"Apache is an important bug fix, but it would be unusually difficult to exploit and it would need an unusual configuration," said Thomas Kristensen, chief technology officer for Secunia.
Two vulnerabilities were also found in the operating system's Bluetooth wireless capabilities. One could allow files to be shared without properly notifying the user, while another could be used by a malicious attacker to access files outside the default file exchange directory via the Bluetooth file and object exchange services.
Another flaw could allow directory services to be altered to give privileges to someone who is unauthorized to have them, according to the advisory.
Apple's OS X patch announcement also includes fixes for Finder, Foundation, Help Viewer, LDAP, libXpm, lukemftpd, NetInfo, Server Admin, sudo, Terminal and VPN.
Apple has no fixed schedule for issuing patches. By contrast, Microsoft in late 2003 moved to a monthly release of security fixes, and Oracle has adopted a similar practice, but on a quarterly basis.
Say it ain't so, Joe. So, that was 12 fixes last month, 20 this month & they won't even fix the problems with Tiger until August - hey this is way more secure than Winblows......how ?
I currently use 98SE, XP, OS X and Red Hat - so I'm not a single-OS bigot. But let me once again repeat RULE #1 - ALL SOFTWARE HAS BUGS.
how well Apple can push the patches out, and actually get folks to apply them. It has been one of the big problems for Microsoft. Patches are useless if your user base wont get them or install them.
Did you just make up the part about not fixing Tiger until August (or whatever month you said?) Because the story said that these minor vulnerabilities had already been fixed.
Maybe you are thinking of a Microsoft news story you just read? That would be typical for them to wait that long or at least until after it had been exploited many times (then the patch would create even worse problems.)
I use various vendor software/hardware for security - so sure, unless there's a consistant bug that crashes my machine, I can wait for a quiet time, to schedule a monthly update.
But if M$, Apple etc break down their OS's at a macro functional level & can apply patches in the background, and can guarantee no down time, I'd prefer to get things fixed ASAP. It's just that I don't trust them to make the updates transparent to current machine activity.
Operating on the assumption that Apple releases updates when it fixes the problems I'd rather have that than a monthly schedule. Maybe I'm being too charitable of course.
Monthly updates are good. What is expecially good is when the OS vendor can keep up with all vulnerabilities so well there there are NEVER any EXPLOITS. Also, most of the vulns are local exploits, and not network ones, not spyware, not adware, etc... this is also a GREAT thing WHEN YOUR VENDOR can do this!
Apple has no fixed schedule for issuing patches. By contrast, Microsoft in late 2003 moved to a monthly release of security fixes
I hope you don't actually froth at the mouth when reading articles about Apple looking for things to complain about. Just for the record all software will have bugs and vulnerabilities. Most companies, including Apple and Microsoft, will issue patches and updates to address these shortcomings. The company with the better record of avoiding actual exploits is the company with better security. Period. If there are other factors that may contribute to this result, so what? No amount of FUD is going to change actual experience.
Most users who went out and bought the first release of Tiger could care less about the VPN issues. Those who know about will wait to upgrade to Tiger. For me, however, I have one request.
They introduced an RSS feed screen saver. Its awesome, its useful, its functional. But why does it limit me to choosing only one RSS feed for the screen saver?
This new feature is not only aesthetically pleasing, but very useful, AND i prefer to have my screen saver running full time to give me useful information that is only a single keystroke away to read an article. Since I have multiple CPUs, and a KVM switch, I use my iBook for this feature more as an application rather a screen saver. Soooo ... PLEASE CHANGE the RSS feed screen saver to support multiple selection of RSS feeds.
FYI, my network of computers don't use a VPN so I had no problem with installing Tiger on my two macs. My 2003, 2000 and XP machines all play nicely with my mini-mac and ibook.
The original version of this story was incorrect about the frequency with which Apple issues patches. The company has no fixed schedule for releasing security updates for its software.
CNet is fast becoming my favorite humor site, the way they make a concerted effort to spin the facts.
In this article, "Apple released 20 patches" (in reality, one update) with the details explained in an "advisory" (in fact the ReadMe for the update).
The flaws could "catch users off-guard" (in fact, no one has seen even the very first instance of a user being "caught off-guard" by a security issue on the Mac).
And three paragraphs are taken up with threats of an "attack" due to an Apache issue ("ALERT! YOUR MAC WEB SERVER IS TOAST!!"), but even Secunia, who makes their living by making people fearful of security issues, pretty much says this one is a non-issue. (Of course, in CNet-speak, they "downplayed" it.)
Then, one of the greatest fact-twists of all: CNet implies that by having "no fixed schedule" for patches, Apple is less responsible than Microsoft or Oracle, when in fact Apple has issued patches MORE frequently than either, when needed.
This kind of stuff is done by enough writers to lead one to believe that CNet tells them to write stories this way. Notice that Mac stories are usually in the "Most Popular Headlines."
For some reason, any story regarding Apple is read overwhelming number of CNet readers. Secondly, they almost always generate the most comments.
Because of this, it can be easy to argue that CNet would always put a "twist" in a story regarding Apple. In fact, just to include any popular Mac product in a headline, generates a lot of links being selected, and comments posted to it.
Bottom-line, the stories with the most hits, and comments are placed in the "Top" headlines. There is nothing nefarious about the one, single point. Though I do wonder about the rest of what you pointed out. ;-)
Web giant is spending $120 million to beef up its Mountain View, Calif., headquarters, according to filings with the city reviewed by the San Jose Mercury News.
The Samsung Galaxy Mini 2 S6500 could make its debut at the Mobile World Congress in Barcelona later this month, according to a leaked promotional image.
MIT creates a simulation to celebrate the 50th anniversary of Spacewar. A relic of the early days of minicomputers, it was one of the first computer video games and set the stage for many others, including Asteroids.
I currently use 98SE, XP, OS X and Red Hat - so I'm not a single-OS bigot. But let me once again repeat RULE #1 - ALL SOFTWARE HAS BUGS.
August (or whatever month you said?) Because the story said
that these minor vulnerabilities had already been fixed.
Maybe you are thinking of a Microsoft news story you just read?
That would be typical for them to wait that long or at least until
after it had been exploited many times (then the patch would
create even worse problems.)
I found the Apple script issue to be very reminiscent of the VBScript issue a while back.
But if M$, Apple etc break down their OS's at a macro functional level & can apply patches in the background, and can guarantee no down time, I'd prefer to get things fixed ASAP. It's just that I don't trust them to make the updates transparent to current machine activity.
it fixes the problems I'd rather have that than a monthly
schedule. Maybe I'm being too charitable of course.
Gee, I guess it is just a bad think when Microsoft does it...
OS vendor can keep up with all vulnerabilities so well there there
are NEVER any EXPLOITS. Also, most of the vulns are local
exploits, and not network ones, not spyware, not adware, etc...
this is also a GREAT thing WHEN YOUR VENDOR can do this!
Apple has no fixed schedule for issuing patches. By contrast, Microsoft in late 2003 moved to a monthly release of security fixes
I hope you don't actually froth at the mouth when reading articles about Apple looking for things to complain about. Just for the record all software will have bugs and vulnerabilities. Most companies, including Apple and Microsoft, will issue patches and updates to address these shortcomings. The company with the better record of avoiding actual exploits is the company with better security. Period. If there are other factors that may contribute to this result, so what? No amount of FUD is going to change actual experience.
could care less about the VPN issues. Those who know about
will wait to upgrade to Tiger. For me, however, I have one
request.
They introduced an RSS feed screen saver. Its awesome, its
useful, its functional. But why does it limit me to choosing only
one RSS feed for the screen saver?
This new feature is not only aesthetically pleasing, but very
useful, AND i prefer to have my screen saver running full time to
give me useful information that is only a single keystroke away
to read an article. Since I have multiple CPUs, and a KVM switch,
I use my iBook for this feature more as an application rather a
screen saver. Soooo ... PLEASE CHANGE the RSS feed screen
saver to support multiple selection of RSS feeds.
FYI, my network of computers don't use a VPN so I had no
problem with installing Tiger on my two macs. My 2003, 2000
and XP machines all play nicely with my mini-mac and ibook.
In this article, "Apple released 20 patches" (in reality, one update) with the details explained in an "advisory" (in fact the ReadMe for the update).
The flaws could "catch users off-guard" (in fact, no one has seen even the very first instance of a user being "caught off-guard" by a security issue on the Mac).
And three paragraphs are taken up with threats of an "attack" due to an Apache issue ("ALERT! YOUR MAC WEB SERVER IS TOAST!!"), but even Secunia, who makes their living by making people fearful of security issues, pretty much says this one is a non-issue. (Of course, in CNet-speak, they "downplayed" it.)
Then, one of the greatest fact-twists of all: CNet implies that by having "no fixed schedule" for patches, Apple is less responsible than Microsoft or Oracle, when in fact Apple has issued patches MORE frequently than either, when needed.
This kind of stuff is done by enough writers to lead one to believe that CNet tells them to write stories this way. Notice that Mac stories are usually in the "Most Popular Headlines."
For some reason, any story regarding Apple is read
overwhelming number of CNet readers. Secondly, they almost
always generate the most comments.
Because of this, it can be easy to argue that CNet would always
put a "twist" in a story regarding Apple. In fact, just to include
any popular Mac product in a headline, generates a lot of links
being selected, and comments posted to it.
Bottom-line, the stories with the most hits, and comments are
placed in the "Top" headlines. There is nothing nefarious about
the one, single point. Though I do wonder about the rest of
what you pointed out. ;-)