Get Smart about Business Spending
- Related Stories
-
Exploit code raises Windows worm alarm
October 13, 2005 -
Microsoft plugs Windows worm holes
October 11, 2005
The patch was released Tuesday to fix four Windows flaws, including one that experts predict will be exploited by a worm in the coming days. The flaw, tagged "critical" by Microsoft, lies in a Windows component for transaction processing called the Microsoft Distributed Transaction Coordinator, or MSDTC.
Installing the patch can cause serious problems, Microsoft said in an advisory posted to its Web site Friday. The patch could lock users out of their PC, prevent the Windows Firewall from starting, block certain applications from running or installing, and empty the network connections folder, among other things, the software maker said.
The trouble appears to occur only when default permission settings on a Windows directory have been changed, according to Microsoft. The software maker has received "limited reports" of problems from customers but is still investigating the issue, a representative said.
Even if users experience PC trouble after installing the patch, they will still be protected against any attack exploiting the Windows flaw, a Microsoft representative said. The patch was delivered with Microsoft security bulletin MS05-051.
To resolve any problems caused by the MS05-051 patch, users should restore the default permissions for the Windows folder and the COM+ catalog. A guide is available on the Microsoft Web site, and steps start with changing the permissions on the "registration" folder in the Windows directory.
See more CNET content tagged:
patch, Microsoft Windows Firewall, software company, Microsoft Corp., firewall
"Even if users experience PC trouble after installing the patch, they will still be protected against any attack exploiting the Windows flaw, a Microsoft representative said."
Well what the hell at least I'm protected, hey wait I'm locked out of my computer. Gota love the bafoons at M$
This is just living proof.
to slip behind on desktop O/S development. Apple's OS X, for
example, is living proof that Windows does not have to be the
only option for consumers.
However, that fact still does not make Linux a viable choice for
the typical consumer. While the kernel, and closely related
services are quite robust, the rest of the package remains a
jumbled mess. I've worked with several linux distributions for a
few years now: Slackware, SuSE, Red Hat, and Debian. Each had
its strong points, and I enjoyed 'tinkering' with all of them.
However, they all sorely lacked the underlying sophistication and
stability necessary to attract an average department store
consumer.
There are a whole host of reasons why this is so, including the
fact that NO, most distributions DON'T "Just work" out of the
box. They do, if you know how to manually edit your /etc
directory files. They do, if you know how to deal with KDE /
Gnome conflicts. They do, if you know how to modify make
scripts. They do, if you know how to edit, test, and compile your
own peripheral device drivers.
That sort of tinkering is fine for those of us who like to hobby
(and read tech news boards), but Insisting that ALL users should
know how to do such things is like insisting that all drivers be
certified mechanics before they are allowed to purchase a car.
The fact is, for all its problems, it is the best option available for
the average mall shopper, for the prices they are willing to pay,
regardless of what we geeks think.
I Predict: Microsoft will weather this storm the same as they have
all the others, and those of us MS-haters will go on shaking our
fists at the rest of the world...
overhyped and unpolished this primitive, non-innovative, poorly
designed open source OS really is; and that by switching you
have to essentially say goodbye to all the high quality
commercial software you're accustomed to for Win/Mac, and use
HORRIBLY designed amateurware Open Sore applications in their
stead, yeah Linux is "better".
Stop playing the "grass is greener on the other side" bologne,
because it's a bait and switch move. Those of us who actually
use multiple platforms KNOW that Linux is not a good
mainstream desktop client, unless you intend to use it mainly
for email/web/IM, in which case it is fine. I use XP, OSX, Linux,
BeOS, even Solaris for kicks. If I had to dump Windows right
now, hands down I would go exclusively Mac. OSX is exciting
and innovative. There is absolutely NOTHING innovative about
Gnome or KDE. OSX and even Vista (when it ships) will leave
Linux stuck in the 1990's era of desktop computing. But then
again, when you're using software designed by programmers
with questionable skill levels working for free, I guess you get
what you pay for. ;-)
(Which was QDOS) for $20k, makes billions. Next, steals GUI
from Xerox, technology to make it work from the Mac, and
makes more billions. In order to make MORE billions, force
companies to sign agreements that even though they sell
computers without Windows©, Microsoft® gets paid. Now, to
put the icing on the cake, the core concept of the OS stays the
same for decades, keeping a structure that was so inherently
bad to start with, they NOW are releasing their own security
suite of tools to keep it running. Is the fox watching the hen
house here or what? I agree with John C. Dvorak, maybe they
should try releasing Windows© that works! YES, it?s BAD when
your patches are WORSE than the FLAWS. Gee, it?s a wonder that
Apple sold more Macs than ever last quarter. It?s also funny that
80% of the workers on the Redmond campus walking around,
listening to iPods.
The accusation that Microsoft "stole" the concept of a GUI interface from Xerox was settled long ago by the courts. Once again, what is wrong with taking purely academic ideas and actually making useful products out of them. If anyone should be criticized it should be the leadership at Xerox, for letting great ideas languish in their labs.
Those who complain about the "core concept of the OS" staying the same are some of the same people who would be jumping up and down if Microsoft had made radical changes to the OS, rather than evolutionary ones. The gradual changes have allowed software vendors to provide a smooth migration path for users. Users have bennefitted from industry standards that have provided tens of thousands of inexpensive programs for every conceivable need.
The dramatic increase in the need for patches is the result of rampant and unrelenting criminal cyber attacks. If you owned a house, that was constantly beeing egged, having rocks thrown through the windows, locks picked, items stolen, etc. would you be blaming your house or insisting the police aprehend and punish the perpetrators?
The fact that "80% of the workers on the Redmond campus" use iPods is evidence that the market is working. People buy solutions that provide them with the best blend of features, function and value. This is precisely why Windows, not the MAC has the greatest market share. Once again, if you don't like the fact that the MAC has a minority position in the market, perhaps you should ask Steve Jobs why he didn't: Allow Mac Clones, Allow 3rd-parties to write unrestricted applications for the platform, accept Intel's offer in 1987 to port the OS to the Intel platform, etc. etc. etc.
I thought I had lost it all.
Thank you Microsoft for a job well done.
Not !!!
But it is not a reason to go to the Dark Side. The Dark Side might be quicker, easier, and has better costumes, but it is not more powerful.
What is the dark side?
Anything that is not MS?
Who are you defending?
And just in case, I do understand your point? Don't say you aren't reading my meaning.
When push comes to shove for reply you say that was not what I was referring to or my point.
Again what is your point? State it clearly so everyone understands what your are referring to or what is the point of your reply.
Bill
than one. Thankfully Macs don't run into these big puddles of
crap. I don't worry about security issues as much, spyware,
viruses, etc.
I like the fact they're not as big as M$, keeps everything working
tighter. Never for many years has computing experience been as
nice as it's been with Macs. I still use a PC, didn't want to give it
away so I turned it into a HTPC running Win Media Center and I
use it like a Tivo but not for surfing the web or doing anything
worthwhile.
docs a Mac will work fantastically.
You can even buy what is called the Mac Mini, it is a small
computer that you can use with your existing PC's screen and
keyboard. They are about 600$.
I think you will be pleasantly surprised how much easier and
trouble free your life will be.
Make the switch!
Here is the list of apple exploits (known)
2005 - 17 Secunia Advisories
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 1 of 17 in 2005
Release Date:
2005-09-23 Secunia Advisory ID:
SA16920 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Cross Site Scripting
Exposure of sensitive information
Privilege escalation
System access
Where:
From remote
Short Description:
Apple has issued a security update for Mac OS X, which fixes 10 vulnerabilities. [Read More]
Apple Mac OS X update for Java
Vendor Patch. Secunia Advisory 2 of 17 in 2005
Release Date:
2005-09-14 Secunia Advisory ID:
SA16808 Solution Status:
Vendor Patch
Criticality:
Impact:
Hijacking
Security Bypass
Manipulation of data
Privilege escalation
Where:
From remote
Short Description:
Some vulnerabilities have been reported in Java for Mac OS X, which can be exploited by malicious, local users to manipulate certain data, disclose sensitive information and gain escalated privileges, and by malicious people to bypass certain security restrictions. [Read More]
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 3 of 17 in 2005
Release Date:
2005-08-16 Secunia Advisory ID:
SA16449 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Cross Site Scripting
Manipulation of data
Exposure of sensitive information
Privilege escalation
DoS
System access
Where:
From remote
Short Description:
Apple has issued a security update for Mac OS X, which fixes more than 40 vulnerabilities. [Read More]
Apple Airport Insecure Association Security Issue
Vendor Patch. Secunia Advisory 4 of 17 in 2005
Release Date:
2005-07-20 Secunia Advisory ID:
SA16132 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Where:
From remote
Short Description:
A security issue has been reported in Airport, which may result in a user associating to an unsecure network without warning. [Read More]
Apple Mac OS X Two Vulnerabilities
Vendor Patch. Secunia Advisory 5 of 17 in 2005
Release Date:
2005-07-13 Secunia Advisory ID:
SA16047 Solution Status:
Vendor Patch
Criticality:
Impact:
Manipulation of data
DoS
Where:
From remote
Short Description:
Two vulnerabilities have been reported in Mac OS X, which can be exploited by malicious people to cause a DoS (Denial of Service) or replace system widgets on a user's system. [Read More]
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 6 of 17 in 2005
Release Date:
2005-06-09 Secunia Advisory ID:
SA15481 Solution Status:
Vendor Patch
Criticality:
Impact:
Unknown
Security Bypass
Exposure of system information
Exposure of sensitive information
Privilege escalation
DoS
System access
Where:
From remote
Short Description:
Apple has issued a security update for Mac OS X, which fixes various vulnerabilities. [Read More]
Mac OS X Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 7 of 17 in 2005
Release Date:
2005-05-20 Secunia Advisory ID:
SA15436 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Exposure of system information
DoS
Where:
From remote
Short Description:
Apple has issued an update for Mac OS X, which fixes various vulnerabilities. [Read More]
Mac OS X Mail Account Wizard Exposure of User Credentials
Unpatched. Secunia Advisory 8 of 17 in 2005
Release Date:
2005-05-10 Secunia Advisory ID:
SA15301 Solution Status:
Unpatched
Criticality:
Impact:
Exposure of sensitive information
Where:
From remote
Short Description:
Markus Wörle has reported a security issue in Mac OS X, which may expose sensitive information to malicious people. [Read More]
Mac OS X pty Permission Security Issue
Vendor Patch. Secunia Advisory 9 of 17 in 2005
Release Date:
2005-05-04 Secunia Advisory ID:
SA15224 Solution Status:
Vendor Patch
Criticality:
Impact:
Exposure of sensitive information
Where:
Local system
Short Description:
Matt Johnston has discovered a security issue in Mac OS X, which can be exploited by malicious, local users to gain knowledge of potentially sensitive information. [Read More]
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 10 of 17 in 2005
Release Date:
2005-05-04 Secunia Advisory ID:
SA15227 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Spoofing
Exposure of sensitive information
Privilege escalation
System access
Where:
From remote
Short Description:
Apple has issued a security update for Mac OS X, which fixes various vulnerabilities. [Read More]
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 11 of 17 in 2005
Release Date:
2005-04-18 Secunia Advisory ID:
SA14974 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Privilege escalation
DoS
System access
Where:
From remote
Short Description:
Apple has issued an update for Mac OS X, which fixes various vulnerabilities. [Read More]
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 12 of 17 in 2005
Release Date:
2005-03-22 Secunia Advisory ID:
SA14655 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Spoofing
Exposure of sensitive information
Privilege escalation
DoS
System access
Where:
From remote
Short Description:
Apple has issued a security update for Mac OS X, which fixes various vulnerabilities. [Read More]
Apple Mac OS X update for Java
Vendor Patch. Secunia Advisory 13 of 17 in 2005
Release Date:
2005-02-23 Secunia Advisory ID:
SA14346 Solution Status:
Vendor Patch
Criticality:
Impact:
System access
Where:
From remote
Short Description:
Apple has acknowledged a vulnerability in Java for Mac OS X, which can be exploited by malicious people to compromise a user's system. [Read More]
Mac OS X Finder Insecure File Creation Vulnerability
Vendor Patch. Secunia Advisory 14 of 17 in 2005
Release Date:
2005-02-08 Secunia Advisory ID:
SA14188 Solution Status:
Vendor Patch
Criticality:
Impact:
Privilege escalation
Where:
Local system
Short Description:
vade79 has discovered a vulnerability in Finder, which can be exploited by malicious, local users to perform certain actions on a vulnerable system with escalated privileges. [Read More]
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 15 of 17 in 2005
Release Date:
2005-01-26 Secunia Advisory ID:
SA14005 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Cross Site Scripting
Spoofing
Exposure of system information
Exposure of sensitive information
Privilege escalation
System access
Where:
From remote
Short Description:
Apple has issued a security update for Mac OS X, which fixes various vulnerabilities. [Read More]
Mac OS X iSync mRouter Buffer Overflow Vulnerability
Vendor Patch. Secunia Advisory 16 of 17 in 2005
Release Date:
2005-01-26 Secunia Advisory ID:
SA13965 Solution Status:
Vendor Patch
Criticality:
Impact:
Privilege escalation
Where:
Local system
Short Description:
Braden Thomas has reported a vulnerability in iSync, which can be exploited by malicious, local users to gain escalated privileges. [Read More]
Mac OS X Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 17 of 17 in 2005
Release Date:
2005-01-20 Secunia Advisory ID:
SA13902 Solution Status:
Vendor Patch
Criticality:
Impact:
Privilege escalation
DoS
Where:
Local system
Short Description:
Multiple vulnerabilities have been reported in Mac OS X, which can be exploited by malicious, local users to cause a DoS (Denial of Service) or gain escalated privileges. [Read More]
2004 - 15 Secunia Advisories
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 1 of 15 in 2004
Release Date:
2004-12-03 Secunia Advisory ID:
SA13362 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Spoofing
Exposure of sensitive information
Privilege escalation
DoS
System access
Where:
From remote
Short Description:
Apple has issued a security update for Mac OS X, which fixes various vulnerabilities. [Read More]
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 2 of 15 in 2004
Release Date:
2004-10-05 Secunia Advisory ID:
SA12690 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Exposure of system information
Exposure of sensitive information
DoS
System access
Where:
From remote
Short Description:
Apple has issued a security update for Mac OS X, which fixes various vulnerabilities. [Read More]
Apple Mac OS X Security Update Fixes iChat Vulnerability
Vendor Patch. Secunia Advisory 3 of 15 in 2004
Release Date:
2004-09-17 Secunia Advisory ID:
SA12575 Solution Status:
Vendor Patch
Criticality:
Impact:
System access
Where:
From remote
Short Description:
Apple has issued a security update for Mac OS X iChat client. This fixes a vulnerability, which can be exploited by malicious people to compromise a vulnerable system. [Read More]
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 4 of 15 in 2004
Release Date:
2004-09-08 Secunia Advisory ID:
SA12491 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Cross Site Scripting
Manipulation of data
Exposure of system information
Exposure of sensitive information
Privilege escalation
DoS
System access
Where:
From remote
Short Description:
Apple has issued a security update for Mac OS X, which fixes various vulnerabilities. [Read More]
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 5 of 15 in 2004
Release Date:
2004-08-10 Secunia Advisory ID:
SA12249 Solution Status:
Vendor Patch
Criticality:
Impact:
Exposure of sensitive information
DoS
System access
Where:
From remote
Short Description:
Apple has issued a security update for Mac OS X, which fixes various vulnerabilities. [Read More]
Apple Mac OS X Internet Connection Privilege Escalation
Vendor Patch. Secunia Advisory 6 of 15 in 2004
Release Date:
2004-07-27 Secunia Advisory ID:
SA12157 Solution Status:
Vendor Patch
Criticality:
Impact:
Privilege escalation
Where:
Local system
Short Description:
B-r00t has reported a vulnerability in Mac OS X, which can be exploited by malicious, local users to gain escalated privileges. [Read More]
Mac OS X Multiple Unspecified Vulnerabilities
Vendor Patch. Secunia Advisory 7 of 15 in 2004
Release Date:
2004-05-30 Secunia Advisory ID:
SA11724 Solution Status:
Vendor Patch
Criticality:
Impact:
Unknown
DoS
Where:
From remote
Short Description:
Apple has issued an updated version of Mac OS X, which fixes some unspecified vulnerabilities. [Read More]
Mac OS X Volume URI Handler Registration Code Execution Vulnerability
Vendor Patch. Secunia Advisory 8 of 15 in 2004
Release Date:
2004-05-22 Secunia Advisory ID:
SA11689 Solution Status:
Vendor Patch
Criticality:
Impact:
System access
Where:
From remote
Short Description:
A vulnerability has been reported in Mac OS X, allowing malicious web sites to compromise a vulnerable system. [Read More]
Mac OS X URI Handler Arbitrary Code Execution
Vendor Patch. Secunia Advisory 9 of 15 in 2004
Release Date:
2004-05-17 Secunia Advisory ID:
SA11622 Solution Status:
Vendor Patch
Criticality:
Impact:
System access
Where:
From remote
Short Description:
Two vulnerabilities have been reported in Mac OS X, allowing malicious web sites to compromise a vulnerable system. [Read More]
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 10 of 15 in 2004
Release Date:
2004-05-04 Secunia Advisory ID:
SA11539 Solution Status:
Vendor Patch
Criticality:
Impact:
Hijacking
Security Bypass
Manipulation of data
Privilege escalation
DoS
System access
Where:
From remote
Short Description:
Apple has issued a security update for Mac OS X, which fixes some older, known vulnerabilities along with some new unspecified issues. [Read More]
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 11 of 15 in 2004
Release Date:
2004-04-07 Secunia Advisory ID:
SA11303 Solution Status:
Vendor Patch
Criticality:
Impact:
DoS
System access
Where:
From remote
Short Description:
The vendor has acknowledged multiple vulnerabilities in Apple Mac OS X, which can be exploited by malicious people to cause a DoS (Denial of Service) or compromise a vulnerable system. [Read More]
Apple Filing Protocol Insecure Implementation
Vendor Patch. Secunia Advisory 12 of 15 in 2004
Release Date:
2004-03-01 Secunia Advisory ID:
SA11012 Solution Status:
Vendor Patch
Criticality:
Impact:
Exposure of sensitive information
Where:
From remote
Short Description:
Chris Adams has reported a vulnerability in Mac OS X, which may allow malicious people to gain knowledge of sensitive data like user credentials. [Read More]
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 13 of 15 in 2004
Release Date:
2004-02-24 Secunia Advisory ID:
SA10959 Solution Status:
Vendor Patch
Criticality:
Impact:
Exposure of system information
Exposure of sensitive information
DoS
System access
Where:
From remote
Short Description:
Multiple vulnerabilities have been discovered in Apple Mac OS X, where some of the specified issues can be exploited to gain knowledge of sensitive information, cause a DoS (Denial of Service), and potentially compromise a vulnerable system. [Read More]
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 14 of 15 in 2004
Release Date:
2004-01-27 Secunia Advisory ID:
SA10723 Solution Status:
Vendor Patch
Criticality:
Impact:
Manipulation of data
Privilege escalation
DoS
Where:
From remote
Short Description:
Apple has issued a security update for Mac OS X, which fixes some older, known vulnerabilities along with some new unspecified issues. [Read More]
Mac OS X Local Denial of Service Vulnerability
Vendor Patch. Secunia Advisory 15 of 15 in 2004
Release Date:
2004-01-05 Secunia Advisory ID:
SA10524 Solution Status:
Vendor Patch
Criticality:
Impact:
DoS
Where:
Local system
Short Description:
Matt Burnett has reported a vulnerability in Mac OS X, which can be exploited by malicious, local users to cause a Denial of Service. [Read More]
2003 - 23 Secunia Advisories
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 1 of 23 in 2003
Release Date:
2003-12-22 Secunia Advisory ID:
SA10474 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Privilege escalation
DoS
System access
Where:
From remote
Short Description:
Apple has issued security updates for Mac OS X. These fix several vulnerabilities, which can be exploited by malicious people to perform a variety of attacks. [Read More]
Mac OS X cd9660.util Privilege Escalation Vulnerability
Vendor Patch. Secunia Advisory 2 of 23 in 2003
Release Date:
2003-12-16 Secunia Advisory ID:
SA10440 Solution Status:
Vendor Patch
Criticality:
Impact:
Privilege escalation
Where:
Local system
Short Description:
Max has reported a vulnerability in Mac OS X, which can be exploited by malicious, local users to escalate their privileges. [Read More]
Mac OS X Insecure Default DHCP Packet Handling Vulnerability
Vendor Patch. Secunia Advisory 3 of 23 in 2003
Release Date:
2003-11-27 Secunia Advisory ID:
SA10295 Solution Status:
Vendor Patch
Criticality:
Impact:
System access
Where:
From local network
Short Description:
A vulnerability has been identified in Mac OS X, which can be exploited by malicious people to compromise a vulnerable system. [Read More]
Mac OS X Security Update Fixes Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 4 of 23 in 2003
Release Date:
2003-11-20 Secunia Advisory ID:
SA10269 Solution Status:
Vendor Patch
Criticality:
Impact:
DoS
Where:
From remote
Short Description:
Apple has issued a Security Update, which fixes an OpenSSL vulnerability in Mac OS X as well as a couple of older issues in version 10.2.8. [Read More]
Mac OS X Terminal Application Unspecified Vulnerability
Vendor Patch. Secunia Advisory 5 of 23 in 2003
Release Date:
2003-11-06 Secunia Advisory ID:
SA10151 Solution Status:
Vendor Patch
Criticality:
Impact:
Privilege escalation
Where:
Local system
Short Description:
Apple has reported a vulnerability in Mac OS X, which can be exploited by malicious users to gain "unauthorized access to a system". [Read More]
Mac OS X Screen Lock Bypass Vulnerability
Vendor Patch. Secunia Advisory 6 of 23 in 2003
Release Date:
2003-10-29 Secunia Advisory ID:
SA10089 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Where:
Local system
Short Description:
A vulnerability has been reported in Mac OS X, which can be exploited by malicious users to perform actions while Screen Lock is enabled. [Read More]
Mac OS X Unspecified Quicktime Java System Compromise
Vendor Patch. Secunia Advisory 7 of 23 in 2003
Release Date:
2003-10-29 Secunia Advisory ID:
SA10087 Solution Status:
Vendor Patch
Criticality:
Impact:
System access
Where:
From remote
Short Description:
Apple has reported a vulnerability in Mac OS X, which can be exploited by malicious people to gain unauthorised access to a system. [Read More]
Mac OS X Updated Version Addresses Thirteen Vulnerabilities
Vendor Patch. Secunia Advisory 8 of 23 in 2003
Release Date:
2003-10-29 Secunia Advisory ID:
SA10086 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Exposure of sensitive information
Privilege escalation
DoS
Where:
From local network
Short Description:
Multiple vulnerabilities have been reported in Mac OS X, where the impact spans from local DoS (Denial of Service) vulnerabilities to privilege escalation, security bypasses and information disclosure. [Read More]
Mac OS X Multiple Vulnerabilities
Vendor Patch. Secunia Advisory 9 of 23 in 2003
Release Date:
2003-09-23 Secunia Advisory ID:
SA9814 Solution Status:
Vendor Patch
Criticality:
Impact:
DoS
System access
Where:
From remote
Short Description:
Apple has acknowledged several vulnerabilities in Mac OS X, which potentially can be exploited by malicious people to compromise a vulnerable system or cause a DoS (Denial of Service). [Read More]
Mac OS X "fb_realpath()" Buffer Overflow Vulnerability
Vendor Patch. Secunia Advisory 10 of 23 in 2003
Release Date:
2003-08-15 Secunia Advisory ID:
SA9535 Solution Status:
Vendor Patch
Criticality:
Impact:
System access
Where:
From remote
Short Description:
Apple has acknowledged a vulnerability in Mac OS X, which potentially can be exploited by malicious people to compromise a vulnerable system. [Read More]
Mac OS X Insecure Account Creation
Vendor Patch. Secunia Advisory 11 of 23 in 2003
Release Date:
2003-07-24 Secunia Advisory ID:
SA9344 Solution Status:
Vendor Patch
Criticality:
Impact:
System access
Where:
Local system
Short Description:
Apple has issued an update for Workgroup Manager because accounts are created without a password. [Read More]
Mac OS X Screensaver Password Bypass Vulnerability
Vendor Patch. Secunia Advisory 12 of 23 in 2003
Release Date:
2003-07-05 Secunia Advisory ID:
SA9184 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Where:
Local system
Short Description:
A vulnerability has been identified in Mac OS X, which can be exploited by a malicious person with physical access to a system to bypass the password protected screensaver. [Read More]
Mac OS X Security Update for Apache and dsimportexport
Vendor Patch. Secunia Advisory 13 of 23 in 2003
Release Date:
2003-06-13 Secunia Advisory ID:
SA9025 Solution Status:
Vendor Patch
Criticality:
Impact:
DoS
Exposure of sensitive information
Exposure of system information
Where:
From remote
Short Description:
Apple has issued a Security Update for Mac OS X Server, which fixes two vulnerabilities. [Read More]
Mac OS X File Sharing Insecurity
Vendor Patch. Secunia Advisory 14 of 23 in 2003
Release Date:
2003-06-10 Secunia Advisory ID:
SA8978 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Manipulation of data
Where:
From local network
Short Description:
Apple has issued an update to fix a potential security issue with sharing of UFS and re-sharing of NFS volumes allowing malicious users to overwrite arbitrary files. [Read More]
Mac OS X LDAP Clear Text User Credentials
Vendor Patch. Secunia Advisory 15 of 23 in 2003
Release Date:
2003-06-05 Secunia Advisory ID:
SA8945 Solution Status:
Vendor Patch
Criticality:
Impact:
Exposure of sensitive information
Where:
From local network
Short Description:
A vulnerability has been identified in the LDAP implementation in Mac OS X allowing malicious people to sniff clear text passwords. [Read More]
Apple Mac OS X IPSec ACL Bypass
Vendor Patch. Secunia Advisory 16 of 23 in 2003
Release Date:
2003-05-19 Secunia Advisory ID:
SA8798 Solution Status:
Vendor Patch
Criticality:
Impact:
Security Bypass
Where:
From remote
Short Description:
A vulnerability has been discovered in IPSec on Apple Mac OS X, which allows certain IP traffic to bypass ACLs (security policies) based on port numbers. [Read More]
Apple Safari and Konqueror Embedded Common Name Verification Vulnerability
Vendor Patch. Secunia Advisory 17 of 23 in 2003
Release Date:
2003-05-09 Secunia Advisory ID:
SA8756 Solution Status:
Vendor Patch
Criticality:
Impact:
Spoofing
Where:
From remote
Short Description:
Apple Safari and Konqueror Embedded fails to validate the Common Name of a SSL certificate. This makes it possible to spoof SSL sites, so that users can't trust the authenticity of a SSL website. [Read More]
Apple update for Mac OS X fixes 7 vulnerabilities
Vendor Patch. Secunia Advisory 18 of 23 in 2003
Release Date:
2003-04-11 Secunia Advisory ID:
SA8571 Solution Status:
Vendor Patch
Criticality:
Impact:
Exposure of sensitive information
Privilege escalation
DoS
System access
Where:
From remote
Short Description:
Apple has released an update for Mac OS X. This fixes some known vulnerabilities as well as some new issues. [Read More]
Samba exploitable buffer overflow
Vendor Patch. Secunia Advisory 19 of 23 in 2003
Release Date:
2003-04-07 Secunia Advisory ID:
SA8533 Solution Status:
Vendor Patch
Criticality:
Impact:
System access
Where:
From local network
Short Description:
Samba is vulnerable to a buffer overflow, which can be exploited by anonymous users. [Read More]
Apple Mac OS X openssl and samba vulnerabilities
Vendor Patch. Secunia Advisory 20 of 23 in 2003
Release Date:
2003-03-25 Secunia Advisory ID:
SA8401 Solution Status:
Vendor Patch
Criticality:
Impact:
System access
Exposure of system information
Where:
From local network
Short Description:
Apple has issued updates for samba and openssl. [Read More]
Samba Packet Fragment Re-assembly Buffer Overflow
Vendor Patch. Secunia Advisory 21 of 23 in 2003
Release Date:
2003-03-17 Secunia Advisory ID:
SA8299 Solution Status:
Vendor Patch
Criticality:
Impact:
DoS
System access
Where:
From local network
Short Description:
A vulnerability has been identified in Samba, which can be exploited by a malicious person to compromise a vulnerable server. [Read More]
Mac OS X security updates
Vendor Patch. Secunia Advisory 22 of 23 in 2003
Release Date:
2003-02-17 Secunia Advisory ID:
SA8064 Solution Status:
Vendor Patch
Criticality:
Impact:
System access
Where:
From remote
Short Description:
Apple has released a patch to cover multiple security issues. [Read More]
Mac OS X TruBlueEnvironment privilege escalation
Vendor Patch. Secunia Advisory 23 of 23 in 2003
Release Date:
2003-02-15 Secunia Advisory ID:
SA8062 Solution Status:
Vendor Patch
Criticality:
Impact:
Privilege escalation
Where:
Local system
Short Description:
TruBlueEnvironment lets the user executing the application, supply path and name to the file which should contain debugging information. [Read More]
2002 - 3 Secunia Advisories
CUPS multiple vulnerabilities
Vendor Patch. Secunia Advisory 1 of 3 in 2002
Release Date:
2002-12-20 Secunia Advisory ID:
SA7756 Solution Status:
Vendor Patch
Criticality:
Impact:
System access
Where:
From remote
Short Description:
CUPS has been found vulnerable to multiple issues. [Read More]
Mac OS X local Denial of Service
Vendor Patch. Secunia Advisory 2 of 3 in 2002
Release Date:
2002-12-11 Secunia Advisory ID:
SA7685 Solution Status:
Vendor Patch
Criticality:
Impact:
DoS
Where:
Local system
Short Description:
Mac OS X does not handle certain directory operations correctly. [Read More]
Mac OS X NetInfo Manager Privilege Escalation Vulnerability
Vendor Patch. Secunia Advisory 3 of 3 in 2002
Release Date:
2002-09-13 Secunia Advisory ID:
SA7107 Solution Status:
Vendor Patch
Criticality:
Impact:
Privilege escalation
Where:
Local system
Short Description:
Christopher Allene has reported a vulnerability in Mac OS X, which can be exploited by malicious, local users to gain escalated privileges. [Read More]
Search
Secunia News
2005-06-21
Multiple browsers are vulnerable to the Dialog Origin Spoofing Vulnerability.
- - - - - - - - -
2005-04-04
Various Mozilla browsers are vulnerable to the Mozilla Arbitrary Memory Exposure Vulnerability.
- - - - - - - - -
2005-03-17
Want a new IT Security job?
Vacant positions at Secunia
- - - - - - - - -
2005-02-07
Multiple browsers are vulnerable to the IDN Spoofing Vulnerability.
Secunia Feeds
Secunia Advisories
Get the RSS feed or use our HTML version.
Secunia Virus Alerts
Get the RSS feed.
Special Requests
Special requests for your website can be sent to our support, or read more about featuring Secunia information here.
this year. Maybe in another 20 years, they'll get it right.
but remember, this is the age of the great security push!
actually did what it was intended to do, instead of cause more
problems.
OSX : A 50 year old Kernel, with a 30 year old interface, a 20 year old CEO for 10 year old users with 5 year old sales tactics.
should have been taken into account. Changing
permissions from default is going to be done by
people for various reasons, or by software that
has done it for them without their knowledge (you
don't get notified of such activity, after all).
Presumably they are aware of how
permissions/flags work in their own operating
system. Presumably they would have the insight to
adjust verify and reset the permissions as
required for the patch and notify the user of the
changes or restore the permissions after the
patch is applied. That they didn't simply shows
the patch was sloppily put together, nothing
more.
I used to develop some utilities for Windows, and
subscribed to MSDN. I was always taken aback by
the volume of stuff you got and the fact that
they did so much so sloppily (documenting side
effects of API calls, nonsensical defaults for
permissions, flags, etc.). I suppose things have
improved since (it's been some time), but it's
clear that they hadn't been keeping up with the
Jones' back then - QC and best practices were a
long way behind.
It's called the internet.
Windows was not and is not designed for networking. It was originally conceived to run a standalone PC, in a non-networked environment.
If you want a network-ready O/S, get a *nix. Including, of course, OS/X.
that, it's a mini player. Second, YOU need to check your facts,
Wikipedia would be a good start for you. Third, Xerox lost out on
the GUI concept becasue they were the ones that let it out and let
Apple, MS run with the ball for several years, thus making it fair use
through inaction to shut the door.
Let's face it, in any UNIX-like OS (and as far as this goes, Windows is a UNIX-like OS), there are a lot of system directories that need specific permissions. If you mess them up, the OS won't work. That should not be surprising, and it is not a serious flaw.
Admittedly, if the patch introduces *new* requirements for these permissions, it should probably also check whether they are normal, and offer to reset them if they're not.
Now this won't affect HOME users, it is true, since they don't have to worry about other users authentication, and aren't likely to "lock down" their systems according to best practices, but it's negligent regardless on MS part. Just my opinions
If not I'd say you have nothing to worry about. I ran the update last night with no problems.
Gabe (and a few other buddies) left Microsoft to startup their own video game company, 'Valve'. To their credit, they put out the best modern videogame ('Half-Life') in the fall of '98 - and all was well. Valve had positioned itself as the best video game developer ever and Gabe was slightly richer.
Fast forward 6 years to the release of their next game: 'Half-Life 2'. For a couple of years Valve had been tinkering with a new peice of software called 'Steam' - it's a simple concept: create a free account for Steam, tell it your Half-Life serial number, and it'll register that game (and s/n) to your account. The benifits of Steam seemed to good to be true, download your games to any computer through Steam, chat with friends (even play chess or poker) through Steam's own 'friends network', never have to worry about someone stealing your game (it's registered to your account, they can't register it to theirs), and get every update and patch almost immediatly and automatically.
Turns out, it WAS too good to be true. You HAVE to log in to play any game, and that usually means being online (using Steam offline is hit-or-miss, with an huge emphasses on miss). The 'friends network' hasn't worked for years (repeat: years), downloading games through Steam takes for-freaking-ever (and if you're downloading one game off Steam you can't play another at the same time), There are hundreds of cases of "someone stole my account, and all my games from me", and worst of all, the 'updates' are not just automatic - they're MANDITORY, and (starting with Half-Life 2) so is using Steam for all of Valve's games.
Now, here's the key bit: The forced updates, that HAVE to be downloaded to play the game, that you have to wait for to finish to play ANY game through Steam, that CAN'T be downloaded outside of Steam, that download incredibly slowly, that CAN'T be uninstalled or downgraded, that HAVE to be instaled (even if you re-instal the whole game you still have to use Steam, and it'll force the updates on you)... don't always work.
That's right, the 'updates' that Steam downloads don't always work. In some cases, actually degrade the performance of the software EXTREMELY. Imagine playing Half-Life 2's modification 'Counter-Strike:Source' over the internet with a ping of 20, and getting 50 to 60 frames-per-second... now imagine getting (read: force fed) a patch that added NOTHING to the game (visual or otherwise) and dropped your frame-rate (from 50) to 15, and shot your ping through the roof (450-1050).
Imagine going to the offical support forums (by-the-way the forums are the ONLY support option - no phone, no fax, no mailing address) and hearing that other PAYING CUSTOMERS couldn't even start the game up because of the new patch.
Imagine NO WORD from the company about (1) there being a problem (2) when it'll be fixed or (3) what client-side fixes can be done.
Now imagine that patches like this are common place. That's right, they happen more often than not on Steam.
Now think about Bill Gates and Windows - seems like your best friend now, eh?
Your suggestion taken to it's logical conclusion should make you very nervous indeed.
- Okay Okay Okay. You Guys are Freaks
- by SystemsJunky October 16, 2005 8:37 AM PDT
- And I really dont even know where this story came from. Ive installed these updates now on over 500 computers with 2k, XP, and a few server 03's. No Problems....YET
- Like this Reply to this comment
-
Showing 1 of 3 pages (185 Comments)