Slashdot Mirror
Security Update 2003-08-14 Released
Delta-9 writes "Today, Apple released Security Update 2003-08-14, which 'addresses a potential vulnerability in the fb_realpath() function which could allow a local or remote user to gain unauthorized root privileges to a system.'" It's on Software Update, and will likely soon appear on the support downloads page.
Nice to see Apple is responding more quickly to security problems. I didn't even hear about this through my regular channels until after I had seen the update in Software Update.
-- Apple: Where Microsoft wants to go today.
The security update addresses the following vulnerability: http://isec.pl/vulnerabilities/isec-0011-wu-ftpd.t xt
Users who haven't activated the FTP server in the Sharing preference pane should not be vulnerable in any way to this bug. Furthermore, FTP servers running with anonymous access, aren't vulnerable either (unless anonymous write access is enabled), since the overflow exploit requires creating deep hierarchies of directories. Only users with regular accounts on the machine can use this bug to gain more privileges on the machine.
The advisory claims to have successfully exploited the problem on several Linux i386 platforms, but they "believe that exploitation of other little-endian systems is also possible". Note "litle-endian". This may suggest that the bug is not exploitable in a useful way on big-endian machines (like all Mac's, for example).
Or it may simply suggest that they haven't investigated the matter thoroughly on big-endian processors.
The advisory was posted some full two weeks ago, meaning that Apple was not as quick to respond as they normally are. Perhaps they were a bit too involved in Panther right now, and had to let this relatively minor insecurity wait a little while.
It looks like I jumped the gun on this...On several levels...
First, wu-ftpd is not the ftp server in Mac OS X. lukemftpd is.
Second, the most relevant advisory is not the quoted one, but this one (which previously appeared on Slashdot): FreeBSD-SA-03:08.realpath.
As the name implies, the bug originates from FreeBSD, and potentially leaves a long list of programs vulnerable (listed in the advisory).
This means that the problem is broader than my original message anticipated. It means that other remote services may be vulnerable, including sftp.
Thanks to the anonymous user who brought my attention to my (pretty bad) mistake.
Please spread this information instead of the wrongful information in the parent post. Mod parent down.
Did anyone notice that the email that went out to the mailing list had a bad signature???
Sam
As soon as the update finished downloading, I was no longer able to launch Camino, Firebird, or Mozilla. In other words, any Mozilla-based browser. Can anyone else confirm that???
I had a sucky sig.
I'm a former Mac user, only because I cant afford them anymore, otherwise I love them.
However, if people like you would quit pissing in your pants everytime someone makes fun of you, you might just find out that this shit doesn't get posted due to lack of attention.
I've posted this elsewhere, also. I know this seems odd, but imagine my surprise. In my home/Documents folder I have a subfolder named "Unstuffed". I have dircted Stuffit to place all of its results in this folder. It's been there for over a year. After running todays security update the subfolder was renamed "Documents", and a file called "Documents.1" was created in the original "Documents" folder. So now, in my home/Documents folder I have a subfolder called "Documents" (with the contents of the old "Unstuffed" folder) and a strange zero k file called "Documents.1". Never seen that happen before.
This coincides with the release of the new g5 laptops with Panther on them. I'm glad I won't have to worry about my new g5 laptop getting r00ted.
I bet your big-breasted wife doesn't know you're wasting your time playing with the boys here on \.
I think, therefore I am...I think.
Wake me up when you pass English 101 and can manage to post something that can be readily comprehended.
Sorry to disappoint you, I'm as straight as one can be, it just seems you're reaching out. All the signals are there: anger, denial, insults, taunts... the way a 12year old begs for his first kiss.
There are several community groups and counselors who can help you feel comfortable with who you are.
Let go of the fear and insecurity. We don't hate you. There there, feeling better?
I think, therefore I am...I think.
took longer than usual to open "Navigator," but it opened just fine. Don't know if you restarted or not -- I haven't yet.
But, I only use Navigator on rare occasions; testing session based problems was the order of the day today.
Notes From Under *nix: blas.phemo.us
It's amazing how fast that download went, what with half the computers in the U.S. offline. Slashdot, on the other hand, is crawling for some reason. Could be that most of Ontario still doesn't have power, so there are fewer local links to the backbone.
My reading of the issue on the FreeBSD advisory is that it is likely 10.1.x is affected by this too.
Can anyone confirm?
Is a fix from Apple likely? I would find it very disappointing if Apple have stopped issuing security fixes for this OS - even Microsoft support their previous generation products (Windows 2000 Professional, for example).
If not, given this affects the (open-source) Darwin core of the OS, is a patch to the affected library/ies a possibility?
Furthermore, I just noticed that the installer said; "The installer needs to run a program to determine if it can be installed. Do you want to continue?" - that's a cool security feature!
Oh, and the update is now up on Apple's downloads page
Alison
"It is a miracle that curiosity survives formal education." - Albert Einstein
Another update, another reboot. Sigh.. When is Apple going to stop requiring reboots?
And they do require them,as I discovered last night. I wanted to install 10.2.0 on another machine. Rather than try to download a whopping 100Megs of updates, I would use the 6 mini updates I already had to upgrade the computer to 10.2.6. And rather than repeat the install-reboot cycle a half dozen times, I would mount the other machine as a Firewire drive on my 10.2.6 machine. No reboots required, right?
Well, half an hour later, with the 10.2.6 upgrades installed, I boot up. Nothing except a grey screen with an Apple logo. No cyclic symbol. The only way to solve the problem was to reinstall 10.2.0, and upgrade piecemeal, rebooting each time.
Well, I ran this security update this morning, and the XP security updates a few days ago, and now my PowerBook and Compaq refuse to talk to each other. It seems one update or the other broke SMB between the 2 platforms, because it worked fine last week.
Now, after I try to connect to the XP box, it tries & then won't do it. A few moments later, it gives me that very annoying, very modal dialog box that grays out everything else, and says (in several languages) that I need to reboot. Ugh! Anyone else come across this problem?
When did the future switch from being a promise to a threat? -C. Palahniuk
Holy shit, that's the funniest fucking thing I've ever read. I mean I am totally busting a seam..... hahahahahahaha..... you dumb bastard...I can't imagine a knucklehead like you ever getting a chance to date much less do anything else. I know, you're one of the dorks from Wierd Science. Dude, seriously I got tears. And I modded you up as funny, keep all those proxies coming through I never get tired of reading the same stupid comment everytime, I mean seriously it lets me know I'm reading slashdot. Keep up the good work ya' dumb fuck.