Slashdot Mirror
Apple Releases Security Update 2003-03-24
skeeter17 writes "Apple updates security again. According the description: 'Security Update 2002-03-24 addresses a Samba vulnerability which could allow unauthorized remote access to the host system. .... OpenSSL is also updated to address an issue in which RSA private keys can be compromised when communicating over LANs, Internet2/Abilene, and interprocess communication on local machine. ... It is recommended that all users install this Security Update.' Well! There you have it folks!" It is available via Software Update.
ALERT: There is still known vulnerabilities with the Cha Cha Cha, the Cabbage Patch, and especially the Boogaloo. You've been warned.
I think it is quite admirable that Apple is so dedicated to these security updates. Certainly there is one other operating system software company in the world that isn't as vigilant. *cough*
I know at work, whenever an exploitation was discovered on the PC, the IT department would wait and wait. After several weeks, when problems started happening, they would issue an advisory, telling the people workarounds and what not to do and such until an update happened.
They never did that for the marketing/communications Macs. The reasons are threefold:
a.) there are fewer exploits in Mac OS X's old age (read: UNIX/FreeBSD/Darwin),
b.) when there are holes, they are patched, almost always very, very promptly.
c.) they were afraid of the Macs, anyway.
I think the latter is the least substantial, but, nonetheless, still relevant.
Anyway. I wanted to make a note of this. I don't see how there's much else that we can regularlly pony up in Software Update discussions...
justen
Microsoft file sharing is the most secure in the world. In fact, you don't even need to use a firewall with Windows.
That's right - all you need to do is leave your box hooked up to the network with no firewall, and in less than 5 minutes, one of a large number of dedicated volunteers will scan your system for any security flaws. If any are found, this tireless worker will log into your box, and install any necessary patches for you.
Don't worry if the disk thrashes from time to time, or if there is a lot of network activity, these are just symptoms of the high level of careful service you are receiving from your unknown friend.
To ensure the best service, be sure to tip him, by putting your credit card number, zip code, expiration date, SSN, and a suggested tip amount in a file called c:\tip.txt. A little gesture like this can go a long way!
Since OS X 10.2.4 came out, I think this is only the second security update. However, for XP there have been countless updates. The Service Pack One update from a few months back was 120MB! They must've had quite a bit of holes to need a upgrade that big.
It seems that almost every week, my IT deartment is running around trying to install security updates on our computers. It's a good thing I only use my PC for e-mail (not for long, since MS Exchange will soon work with Entourage). I use my Mac for real work.
Mr. Bond, they have a saying in Chicago: Once is happenstance. Twice is coincidence. The third time is enemy action.
And let's not forget that these security updates are due to exploits and holes in the software of the OSS community at large (sendmail, samba, openssl, openssh), not due to Apple's own bungling or inattention to security.
Why did they release a patch for this so quick, but they haven't fixed the 1969/70 bug? Seriously Apple, I have not turned on this feature ever (you have to turn it on since it is off by default).
This patch is for SAMBA...which is a Windows file sharing protocal. Go figure.
I know the parent is a troll. Last one I feed today, I promise.
Huh. Seems in Software Update, it's titled 2003-3-24, but in the description, it's *2002*-3-24.
Weren't they a year off last time, too?
I'm confused! Anyone know what OpenSSL bugs are patched, specifically, by each security update?
Can't you see that everyone is buying station wagons?
Not to rag too much on apple, but they're still slower to release fixes than open source. Both fink and my gentoo linux box are usually patched the same week (and often the same day) that I hear about the problem.
Gentoo is getting a reputation for releasing fixes before slashdot announces, as the smug 1337 gentoo users like to point out.
Does that make me one of them now, too?
I'm not meaning to say that apple is doing a poor job, by any means. I'm just wanting to point out that apple is not the only organization that takes security seriously, and that there are others that beat apple out the door with security fixes.
You say
There went my two weeks of uptime... ;-)
"Common Sense Ain't" -Unknown
Please, do me a favor and go kiss Jobs ass. Enough of this "my OS is better than yours". When MSFT releases security updates, you probably complain. When they don't on time, you probably complain too. But when APPL releases its updates 2 weeks later, it's all praise. Squeeze those cheeks real hard.
You have to run OS X 10.2.4 to get this patch. Does this mean that 10.2.3 is secure from this bug, or do I need to hook up to my mom's school's T1 line to be up to date? 10.2.3 has been running very, very smoothly with little or no problems (mainly due to 3rd party programs/drivers).
"Some fight for law. Some fight for justice. What will you fight for? One day, you will see."
horribly worded.....10.2.3's problems are due to the use of 3rd party drivers and programs. Sorry for any trouble I might have caused in the reading of the parent post...
"Some fight for law. Some fight for justice. What will you fight for? One day, you will see."
OpenSource does not have a major disadvantage that Apple does: Apple has to test the security update to make sure it doesn't break anything and prepare the distribution for release (which geeks normally take care of on their own in the OSS community).
Integrate Keynote and LaTeX
Put an other way, you're right, but your confusing Apple's software with the code. Most of the services on OSX are open source and to say that "they are slower to release fixes than open source" rather misses the forest for the trees. (Or vice versa) What Apple does is provide a quick, easy update for regular users who don't want to deal with the complexities of compiling their open source programs. As such Apple reacts very timely and does a lot of checking.
So to differentiate Apple's security and open source's security is a false dichotomy.
Someone should mod this chump up, so everyone can take a moment to share with him what a fool he is...
-dewhite
uh. if anyone out there hypothetically has safari v67 and has just installed the security update i would be very interested to know if safari v67 would work following the update...? thanks.
What, you mean MSFT ever released a security update in time? The recent "RtlDosPathNameToNtPathName_U" bug was actually discovered in Usenet about two years ago, in NT4.
3: The user shuts it down every night to conserve energy?
4: The computer is located in a California 'Rolling Black-Out' zone (snnnuck)
I hate Grammar Nazi's
It is a statistically provable fact that there are more gay men using PCs than Macs, through sheer marketshare.
Besides, how do you account for the gay man's superior sense of style?
And, how do you account for proving this point by cutting-and-pasting the same woefully pathetic incendiary letter on every single goddamned Apple post?
How, AC, do you reconcile the fact that you are somehow *threatened* by what is (by your own admission) the Mac's superior technology? How do you respond to that without looking, to all the world, like Jackass Prime?
Answer: you don't.
The only time my OS X machines crash is when I'm connected to windows shares. Isn't that neat?
I just hate how the security patches kill my uptime. 5 days 18:04 since I last rebooted on my iBook, and I think that was the last security patch, too.
- Cloud
You know I wrote this response to the perennial Mac Troll a few weeks ago, and am greatly amused to see that it has taken on a life of its own, and continues to plague said Mac Troll autonomously. Kudos.
The security fix causes the Apache webserver to crash when a secure connection is requested. The Apache SSL library was updated, but there is a memory addressing error manifesting itself in the "ssl_var_lookup_ssl_cert" function. This causes a segmentation fault and crashes that instance of the Apache server.
I'd be interested in hearing from anyone else having similar difficulties.
Jesus, moderaters, get a fucking sense of humor.
I just wish they would have released OS X with a mail server (Apple Mail) that wasn't open to relaying by default.
'false dichotomy'? What an asshole. He can't write English either.