Slashdot Mirror
Apple Releases Security Update 2002-08-20
Prozy.G3 writes "Mac OS X Security Update 2002-08-20 includes updated components (OpenSSL & Security) which provide increased security to prevent unauthorized access to applications, servers, and the operating system. Mac OS X Security Update 2002-08-20 is available either through the Software Update application (System Preferences) or at the Apple Knowledge Base." According to the Knowledge Base, it is for Mac OS X 10.1.5; are these components already in Mac OS X 10.2, or is another update forthcoming?
According to the Knowledge Base, it is for Mac OS X 10.1.5; are these components already in Mac OS X 10.2, or is another update forthcoming?
Wouldn't it be better to find that out from Apple as opposed to asking the general Slashdot audience?
-Bill
SlashSig Karma: Excellent (mostly affected by moderatio
10.2 has OpenSSL 0.9.6b 9 Jul 2001
;)
Someone compare this in 10.1.5 (type 'openssl' then 'version' to see, if you didnt already know)
$ Security
bash: Security: command not found
Maybe i should buy a subscription, (Mozilla 1.0 on 10.2)
Screen shot
at least you don't have to replace your entire kernel every few days to avoid filesystem corruption and IDE brain damage.
yeah well if you arent running a webserver or using the ssh server, then just dont update. but i have to ask, did apache and ssl run on your os9???
Too many updates...you have reached your limit.
The day I have to buy an Update to GPL software
will be the end of it all. Would you like GPL Fries with that Big Mac ?
brought to you by supercow and madcow....
(super cow powers)
On the kbase article apple advise you need a:
Mac OS X compatible computer
Note they don't say "Mac OS X compatible Macintosh"
They're making clones again!
brought to you by the reading-too-much-into-things dept.
a grrl & her server
I'm running the release version of Jaguar, and as of right now there is no update available (using Software Update). I guess they're punishing the early early adoptors and waiting until the release date.
The previous couple of updates installed a command-line utility to get software updates (/usr/sbin/softwareupdate). Very handy as I usually admin our servers over ssh.
But at the moment, this new update only shows up in the GUI Software Update panel -- running from the CL tells me "Your software is up to date" and then exits. Anyone know why?
You're missing the point. I DON'T run a web server or SSL on my mac in OSX, but now thanks to Apple I have to keep getting patches for them, or else some loser script kiddie will manage to break into my machine and delete my files. When MS ships IIS enabled by default everyone whines, but when apple ships Apache everyone goes "hooray open source!"
the difference is, Unlike MS IIS, nothing is shipped enabled by default. You have to turn it on manually.
Also, if you get a script that tells the computer to delete important files, you will have to authenticate or use su.
I DON'T run a web server or SSL on my mac in OSX
Then you have nothing to worry about. Your mac is safe.
There have been reports that Apple will post an update for 10.2 a couple of weeks after it is released to address some security concerns, like the most recent one for 10.1.x and to fix some minor bugs that have shown up since 10.2 went GM.
The documentation for the previous security update (Security Update 2002-08-02 for OpenSSL, Sun RPC, mod_ssl) said it included 0.9.6e of OpenSSL. But after I installed the update and checked with "openssl version" it said it was still 0.9.6b.
This had me worried for a while, and mad at Apple, until someone pointed out that it looked like the update changed the significant libraries, so it probably was patched. Pretty irritating though.
It's more like one a month.
And this one I got before I'd even heard there was a vulnerability.
I was under the impression the Darwin framework system was sophisticated enough to deal with new versions replacing old on running systems.
Is this just a holdover in thinking from the OS 9 days?
Protoplasm. Quiet Protoplasm. I like quiet protoplasm.
Then why does software update tell me I have to update?
You can't have it every way. The problem with windows is that there *isn't* a 'god damned patch' every time it's necessary.
MacOS X is based on open source tools. Bugs get seen. Bugs get fixed. Lap 'em up and enjoy - it's a small price to pay for decent security.
Alison
"It is a miracle that curiosity survives formal education." - Albert Einstein
Personal web sharing is disabled by default, BTW. This was not the case with IIS ...
Furthermore, you don't have to keep getting patches for them. Just stop clicking on that 'software update' button. I'm sure everything will be just fiiiine.
In short - quit bellyaching about patches. They're for your benefit. If you were running Linux, every time openssl rolls you'd have a whole lot of fun DLing the source/RPMs, building/updating a myriad of programs & crossing your fingers in the hope that everything still works. Apple does exactly this for you, packages it up all nice and all you can do is complain? WTF?
Alison
"It is a miracle that curiosity survives formal education." - Albert Einstein
Your OS contains the openssl/modssl/apache packages. Software Update knows this. Just 'coz you're not using web sharing today doesn't mean you won't click that button tomorrow & I'm guessing you'd be one of the first people to complain that, when you did, Apple was running a version of openssl on your box that was three revs behind. Right???
Alison
"It is a miracle that curiosity survives formal education." - Albert Einstein
However the next day, on the 21st, it appeared again with the same name; I reinstalled it and rebooted the machine again. Now it seems to be fine.
Anyone else experienced this?