November 30, 2005 8:02 AM PST
Apple releases OS X security patches
- Related Stories
-
Apple plugs 'critical' holes in OS X
September 23, 2005 -
Apple fixes Java flaws in Mac OS
September 14, 2005 -
Apple fixes broken OS X patch
August 19, 2005
Apple released on Tuesday security patches for Mac OS X 10.4.3, otherwise known as Tiger, as well as Mac OS X 10.3.9, dubbed Panther, according to the company's advisory.
Thirteen security flaws were found in areas related to the Apache 2 Web server, curl technology and the Safari browser. The vulnerabilities ranged from potentially letting an attacker launch a denial-of-service attack to taking control of a person's system remotely.
"The most severe of these are the vulnerabilities found in curl and the PCRE library used by Safari," said Thomas Kristensen, chief technology officer for security site Secunia, which rated Apple's updates as "highly critical"--the second-highest danger ranking.
A large number of applications could be affected by the vulnerability in the PCRE library used by Safari's JavaScript engine, Kristensen said. People who inadvertently click on a malicious Web site with their Safari browser could find the flaw exploited, leading to a remote execution of code on their system.
A flaw in Apple's curl technology, which is a library frequently used to download large files and pass them along, could be exploited if visiting a malicious Web site. The site, once detecting curl technology is present on a user's system, can take advantage of the security flaw, Kristensen said. That could result to a remote execution of code on a computer.
One security flaw addressed in the update involves a boundary error found in WebKit. This marks the second time in four months that Apple has addressed a flaw in WebKit, Kristensen said.
This latest flaw could let an attacker launch a buffer overflow, or denial of service attack, that could also lead to a remote execution of code and control of a person's system. The earlier flaw in WebKit dealt with the handling of PDF documents.
The new Mac OS X patches follow one issued earlier this month by Apple to address vulnerabilities in four areas of its operating system.
Apple was not available for immediate comment.
110 comments
Join the conversation! Add your comment (Log in or register)
Windows, OSX, and Linux I've had to patch them all. Always have
and unfortunately always will.....
I can't say that for my wife's Win2k machine. The patches to that 'roto-rooter' broke iTunes with some form of DLL hell error when it eventually loaded some patches a while back.
Apple's packaging and the whole underlying OS is just designed and implemented better.
patches windows after attacks have been made. No OS will EVER be
100% secure as long as hacker experience and tools evolve,
however, all you need to do is compare number of vulnerabilities to
the number of exploits in the wild and the truth will rise to the top
with that ratio. It's not just about how many vulnerabilities there
are, it's how many of them are exploited. That can't be rationally
denied.
was released there have been patches. That's how a product
evolves, dear boy.
There still have been no viruses - I think you are mixing that
comment up with the patches comment. Apple has to keep
vunerabilities closed just like windows tries to as well.
your mind, you have equated a few proactive patches with
thousands of existing exploits. This argument is so dumb, I'm not
even going to try bother addressing it directly. I can only assume
that you are looking for some rationale to jusity why you continue
to use an OS that you know sucks. The "grass is dead on the other
side too" mentality I guess.
Windows is easy to hack,the only way to make it reasonalby safe is to unplug it from the internet, that is not the case with *nix. Hacking those systems actually takes some skill.
INCIDENTS of worms, viruses, trojans, etc. an OS experiences. As
far as I know, OS X still has experienced zero incidents, including
all the users who have not been diligent about doing the security
updates. The *nix core of OS X was designed from the beginning
with security in mind, and it shows!
2. Thou shall not use Microsoft Products
3. Thou shalt not use anything else but apple products.
4. Thou shalt not take SJ's name in vain
5. Thou shalt covet thy neighbors PC's and throw up thy useless dribble on all who oppose thy view.
6. Thou shalt bend over and take it from SJ while he uses sandpaper with no questions. Thou shall feel delighted to : "take it like a man" in the rear and in the pocket book.
7. Thou shall flock from thy homes and offices to be slaughtered like cows.
8. Thou shall never play a "video game"
9. Thou shalt never question Apples authority
10. Thou shalt ever see anything past the Mac and thou shall be blind to all else. Thou shall be completely closed minded.
MWHAHAHAHAHA
MWHAHAHAHAHA
MWHAHAHAHAHA
MWHAHAHAHAHA
MWHAHAHAHAHA
MWHAHAHAHAHA
using System.Sarcasm.Not
if else
System.Dribble.Start
to write anything of importance, or even of interest. Consistency
has some value......
LOL :-)
Doesn't change the fact that there has still been (AFAIK) zero/zip/nada OS X malware or exploits.
Windows: 20x the market share.
Windows: 20,000x the malware/exploits.
Buy what you like ... that's what I do.
And yet, when you're on the defensive, taking (a sick, to be sure) pleasure in the deficiencies of the competition is deplorable?
All in good fun, Paul, but when the Apple Zealots go bonkers with every announcement of a Windows flaw, you have to expect this sort of thing when the time comes to pay the piper. What is it they say about people in glass houses, again?
1.a) Most people dont care about Apple
1.b) Most exploit hunters fall in one of the above categories
2) FanBoys don't post exploits they quietly email them to Apple so that they can continue to say how Apple has no exploits and can continue justify the FanBoy experience
3) I dont care anough to continue making points
lol
feel that, if they are running Mac OS X, then all is well,"
Dhamankar said. "That is no longer true." (The Register®):
<a class="jive-link-external" href="http://www.theregister.co.uk/2005/12/01/secfoc_macos/" target="_newWindow">http://www.theregister.co.uk/2005/12/01/secfoc_macos/</a>
Some arguments put forth in this thread debunked.
Systems Admin for both Mac & Windows, agnostc: all OS's have
strengths & weaknesses ;-)
No, I am not saying they don't have vulnerabilities.
Yes, I am saying they are more secure, inherently by design and no, not solely because of market share.
The ONLY NEWS HERE, and it is OLD NEWS, is that Apple fixes potential problems BEFORE THEY HAPPEN.
YOU HAVE FAILED TIME AND TIME AGAIN TO EVEN MAKE THIS THE POINT. GUESS WHAT, IT IS THE ONLY POINT THAT EVEN MATTERS IN THESE STORIES.
YOU SUCK
Shocking, I know, especially if you pay any attention to any of the Mac Zealots who seem to think that all Windows machines are spyware infested, security hole-ridden computers ripe for the hacking. Of course, they all call me a liar, but people tend to do that when they don't want to face reality.
:)
<a class="jive-link-external" href="http://safety.live.com/site/en-US/default.htm" target="_newWindow">http://safety.live.com/site/en-US/default.htm</a>
Does it seem strange to anyone that Microsoft can scan and change what's on your computer ONLINE??? And if Microsoft can do it, how hard would it be for ANYONE to do it?
I hit the "Full Service Scan" button and got the message, "Whoops. The scanner doesnt work with your Web browser or operating system." In my book, that's the best security news you can get!
-Apple has many flaws , like iTunes, OS X holes.
-Apple OSX costs around $140--so does Windows
-Another verion of OSX is released every 3 months--Windows is released only every 2 years. So, Windows costs less.
-Windows has around 90% of the market, so 90% of hackers target windows.
-Mac has only 7% of hackers, if any; and there are dozens of security holes already. Imagine how many would be there is mac was as widely used as Windows.
My point: Macs cost more, hardware is expensive and propriatery, and we still get a product which is no better than Windows. Mac Sucks.
up until this day. I started using OS X on a Mac when it first
became available in 2001. Since that time, OS X has become a
solid piece of software. Many applications, including Microsoft's
Office run better on OS X. It is much more stable and robust. It is
designed with *NIX, BSD to be exact, under the hood. As any
software system that needs to communicate with programs and
other parts of it's own code, there will ALWAYS be holes to
patch. It's the nature of software when there is a trust factor that
is violated by a few bad apples (no pun intended). In order for
code to communicate in the programs and with the operating
system and to cooridinate with use over a public internet, this
will happen. The difference between Microsoft and Apple is that
the code in OS X is designed from the ground up, where as in
Windows, it's a continued patch of bad code over more bad
code. That's the reason for the larger vulnerabilities and
unrealiability. To this day I still use Windows and write programs
in Windows only environments and would rather work in the OS
X environment if I could. To state that Macs "suck" as you put it,
just shows how little you know. You must still be a kiddie in
school or someone with very little advanced computer
knowledge. As you grow older you will learn to choice your
words more wisely, so when you have to eat them later they will
go down much easier.
But, if the source code has been comprimised (and in Windows it has been - big time!), Then it's time to throw the book away & start over. Apple did just that. They suffered initially for doing it, also. When they rebuilt their OS, most of the older MAC programs didn't work any longer, & users initaially took their business & their computing dollars elsewhere. What does Uncle Billy do when some borg-like cracker exploits his code & wreaks havoc? Does he prosecute them to the fullest extent of the law? No. He gets them a position at Microsoft. Want a nice, cozy position at Microsoft? Exploit his code, & destroy hundreds of thousands of on-line lives! Then the employment application form will be right there waiting for you! He might even send it to you postpaid! OS-X, Linux, Solaris, Unix, BSD. There are more secure alternatives...
power Ebay. They also use Java.
deleted the Info.plist file associated with the Mail.app Package.
The problem I experienced was that Mail wouldn't do anything
when I tried to launch it -- the dock icon would bounce 3 time
and then Nothing! Subsequent clicks got only one bounce.
This was right after installing the recent slug of 20 security
updates. Some digging (I don't even know what an Application
Package is) got the following error in Terminal:
2006-03-05 11:53:09.257 Mail[268] No Info.plist file in
application bundle or no NSPrincipalClass in the Info.plist file,
exiting
Indeed, the Info.plist file wasn't in the Package. After replacing
the Mail.app file in my Applications folder with a backed up
version the Info.plist was restored and the programs appears to
be working.
XP was supposed to also, in fact they do have an Administrator, problem is it was implemented in a half-assed way. Vista is not only coming to the party years late and underfeatured, but it will still hang on to "features" that cause windows to degrades over time(no other OS degrades, only windows) and cause security issues(aka the registry,activeX, ect). There inclusion might make for better backwards compatibility, but at a high cost of security and performance issues.
As for the rest of your uninformed post, read Johnny Mnumonics reply.
And to all the uninformed in cyberspace,
Your Welcome!
Jon N.
POSIX, which is the Portable Operating System
Interface. C was developed for UNIX in order
to more easily port it to another platform.
The primary Internet protocols were developed on
a UNIX system. When it comes to standards, Linux
and UNIX based systems are the leaders. Rather,
Microsoft tends to "embrace and extend". It takes
a open standard and closes it.
Regarding your statement about the more popular
platform being a larger target...
Perhaps the most oft-repeated myth regarding
Windows vs. Linux security is the claim that
Windows has more incidents of viruses, worms,
Trojans and other problems because malicious
hackers tend to confine their activities to
breaking into the software with the largest
installed base. This reasoning is applied to
defend Windows and Windows applications. Windows
dominates the desktop; therefore Windows and
Windows applications are the focus of the most
attacks, which is why you don't see viruses, worms
and Trojans for Linux. While this may be true, at
least in part, the intentional implication is not
necessarily true: That Linux/UNIX and Linux/UNIX
applications are no more secure than Windows and
Windows applications, but Linux/UNIX is simply too
trifling a target to bother attacking.
This reasoning backfires when one considers that
Apache is by far the most popular web server
software on the Internet. According to the
September 2004 Netcraft web site survey, 68% of
web sites run the Apache web server. Only 21% of
web sites run Microsoft IIS. If security problems
boil down to the simple fact that malicious
hackers target the largest installed base, it
follows that we should see more worms, viruses,
and other malware targeting Apache and the
underlying operating systems for Apache than for
Windows and IIS. Furthermore, we should see more
successful attacks against Apache than against
IIS, since the implication of the myth is that the
problem is one of numbers, not vulnerabilities.
Yet this is precisely the opposite of what we
find, historically. IIS has long been the primary
target for worms and other attacks, and these
attacks have been largely successful. The Code Red
worm that exploited a buffer overrun in an IIS
service to gain control of the web servers
infected some 300,000 servers, and the number of
infections only stopped because the worm was
deliberately written to stop spreading. Code Red.A
had an even faster rate of infection, although it
too self-terminated after three weeks. Another
worm, IISWorm, had a limited impact only because
the worm was badly written, not because IIS
successfully protected itself.
Yes, worms for Apache have been known to exist,
such as the Slapper worm. (Slapper actually
exploited a known vulnerability in OpenSSL, not
Apache). But Apache worms rarely make headlines
because they have such a limited range of effect,
and are easily eradicated. Target sites were
already plugging the known OpenSSL hole. It was
also trivially easy to clean and restore infected
site with a few commands, and without as much as a
reboot, thanks to the modular nature of Linux and
UNIX.
Perhaps this is why, according to Netcraft, 47 of
the top 50 web sites with the longest running
uptime (times between reboots) run Apache. None of
the top 50 web sites runs Windows or Microsoft
IIS. So if it is true that malicious hackers
attack the most numerous software platforms, that
raises the question as to why hackers are so
successful at breaking into the most popular
desktop software and operating system, infect
300,000 IIS servers, but are unable to do similar
damage to the most popular web server and its
operating systems?
Food for thought.