Apple Releases Security Update 2002-08-20
Prozy.G3 writes "Mac OS X Security Update 2002-08-20 includes updated components (OpenSSL & Security) which provide increased security to prevent unauthorized access to applications, servers, and the operating system. Mac OS X Security Update 2002-08-20 is available either through the Software Update application (System Preferences) or at the Apple Knowledge Base." According to the Knowledge Base, it is for Mac OS X 10.1.5; are these components already in Mac OS X 10.2, or is another update forthcoming?
Pre-update, 10.1.5 had OpenSSL 0.9.6b 9 Jul 2001.
Post-update, 10.1.5 has OpenSSL 0.9.6e 30 Jul 2002
So, it looks like 10.2 will generally be vulnerable until Apple rolls out the Jaguar version of the patch.
"It is our blasphemy which has made us great, and will sustain us, and which the gods secretly admire in us." - Zelazny
The previous couple of updates installed a command-line utility to get software updates (/usr/sbin/softwareupdate). Very handy as I usually admin our servers over ssh.
But at the moment, this new update only shows up in the GUI Software Update panel -- running from the CL tells me "Your software is up to date" and then exits. Anyone know why?
There have been reports that Apple will post an update for 10.2 a couple of weeks after it is released to address some security concerns, like the most recent one for 10.1.x and to fix some minor bugs that have shown up since 10.2 went GM.