Slashdot Mirror
Security Update Fixes the Screen Effects Hole
jellomizer writes "Here is is. Available from Software Update. 'Security Update 2003-07-14 addresses a potential vulnerability when a password is required upon waking from the Screen Effects feature, which could allow an unauthorized user access to the desktop of the logged in user.'
Now we can use our screen savers with the warm and fuzzy secure feeling."
Anybody have any idea what files this updates and what version it updates those files to?
This is what the package contains. I haven't installed it, so I don't know what the new versions are.
Listing files for Security Update 2003-07-14This updates a system framework, which is likely in use by multiple, running, applications. The safest way to ensure everything is operating as it should is to require a restart. Had this been an update of something else, like a user-level application or daemon, then the restart would not have been required.
You have to remember that this is an operating system for the masses and their desktops. I'm sure this update could've not required a restart, but what if something went wrong? Would your grandmother know how to make sure the current version of a shared library is loaded for her applications?
Noone's forcing you to restart. I just opened up the Mac's Terminal.app and:
...After that I just closed the Terminal. I keep on working and at the end of the day, if I feel like restarting I will. I will also upgrade my OSX webserver this way, and probably never restart it until a real major upgrade occurs.
% sudo softwareupdate SecurityUpd2003-07-14-1.0
[wait for install to finish]
Installing "Security Update 2003-07-14"... 98% 98% 99% 99% 99% 99% done.
You have installed one or more updates that requires that you restart your
computer. Please restart immediately.
Those who laugh at you for you having a Mac.. are the people who constantly call you to fix their PC.
For and update to an application library (Cocoa in this case), you don't really need to restart, you just need to quit all Cococa apps, this includes the Login Window. To accomplish this, do the following:
1. download and install the patch. 2. log out, if you can. 3. type ">console" or maybe even ">exit" in the user name field of the login window. 4. once in the console, I believe a ctl-D will restart the login window.
That means, it is just a new Security Framework see the benefit of shared libraries.
After updating, I tried to crash a few other apps using the "leave an object on the keyboard" method, and the text boxes simply stopped accepting input after a certain amount of time.
Apple's page for the update, if you prefer to download manually.
I don't notice a performance hit while using the files in my home directory (I don't keep MP3s there however). You can monitor the amount of CPU that is being used decrypting files by checking the CPU usage of the 'hdid' process in top or the CPU monitor. But I encrypt my home directory (as you suggested) to protect my Library, financial records, my code, and the files for my business which I use all the time. My desktop (my download folder) is encrypted and I don't notice a performance hit while downloading. (I'm running a Dual 500 MHz machine, should you care)
I dont really see this as that much of a problem.
So instead you power cycle the laptop, hold down S durring boot to enter single user mode.
At this point you do technically have root, although without a GUI.
Change target accounts password, reboot, login.
If you have a password set in openfirmware to prevent single user mode boots, I have to zap the pram 3 times and the password is gone.
Granted this is a whole lot harder than breaking the screen saver, but still, any computer someone can get physical access to is not secure under any conditions.
There is also a fresh iDVD software update today as well. Rumored to fix the "I don' wanna!!!" message...something about multiplexing :)
No restart needed!!
The download file is named: "SecurityUpd2003-07-14.dmg
Its SHA-1 digest is: 210f4819b8559b590632cd62b4055a437b9a0267
Just Hide it. Then it's out of the way but still in the Dock reminding you that you eventually should restart.
Try using the "Save to desktop" command in Software Updater. It downloads the updater (unfortunately doesn't allow you to save it anywhere but the desktop, but you can move it after it's downloaded) so you can run it when it's more convenient.
As mentioned before, there's not much reason to run the updater if you're not going to reboot right away. Yeah, yeah, maybe sometimes there's some reason, but generally not.
There is a simple solution. Apple Menu->Force Quit... or Command-Shift-Esc.
Just like any other application, Software Update can be forced to quit. When it finishes writing out the update to disc and asks you to restart, just force quit Software Update and restart your computer when you're done with whatever you're busy with.
The updated Security.framework will be loaded by ScreenSaverEngine.app the next time it runs - in other words, the next time the screen saver activates.
Have you tried it? I have. No reboot, and no more crashing screen saver.
Anything that is already running retains the old version of Security.framework until it's started again, but ScreenSaverEngine.app and loginwindow are both immune. There may be other (unrealized? unreported?) exploits that the update fixes that require a logout or reboot, but to fix the simple screen saver exploit, no such silliness is required.
Mark