Slashdot Mirror
Security Update 2003-08-14 Released
Delta-9 writes "Today, Apple released Security Update 2003-08-14, which 'addresses a potential vulnerability in the fb_realpath() function which could allow a local or remote user to gain unauthorized root privileges to a system.'" It's on Software Update, and will likely soon appear on the support downloads page.
Nice to see Apple is responding more quickly to security problems. I didn't even hear about this through my regular channels until after I had seen the update in Software Update.
-- Apple: Where Microsoft wants to go today.
The security update addresses the following vulnerability: http://isec.pl/vulnerabilities/isec-0011-wu-ftpd.t xt
Users who haven't activated the FTP server in the Sharing preference pane should not be vulnerable in any way to this bug. Furthermore, FTP servers running with anonymous access, aren't vulnerable either (unless anonymous write access is enabled), since the overflow exploit requires creating deep hierarchies of directories. Only users with regular accounts on the machine can use this bug to gain more privileges on the machine.
The advisory claims to have successfully exploited the problem on several Linux i386 platforms, but they "believe that exploitation of other little-endian systems is also possible". Note "litle-endian". This may suggest that the bug is not exploitable in a useful way on big-endian machines (like all Mac's, for example).
Or it may simply suggest that they haven't investigated the matter thoroughly on big-endian processors.
The advisory was posted some full two weeks ago, meaning that Apple was not as quick to respond as they normally are. Perhaps they were a bit too involved in Panther right now, and had to let this relatively minor insecurity wait a little while.
It looks like I jumped the gun on this...On several levels...
First, wu-ftpd is not the ftp server in Mac OS X. lukemftpd is.
Second, the most relevant advisory is not the quoted one, but this one (which previously appeared on Slashdot): FreeBSD-SA-03:08.realpath.
As the name implies, the bug originates from FreeBSD, and potentially leaves a long list of programs vulnerable (listed in the advisory).
This means that the problem is broader than my original message anticipated. It means that other remote services may be vulnerable, including sftp.
Thanks to the anonymous user who brought my attention to my (pretty bad) mistake.
Please spread this information instead of the wrongful information in the parent post. Mod parent down.
Did anyone notice that the email that went out to the mailing list had a bad signature???
Sam
Whatever the problem is, I doubt it's gecko related.
You are not alone. This is not normal. None of this is normal.
I've posted this elsewhere, also. I know this seems odd, but imagine my surprise. In my home/Documents folder I have a subfolder named "Unstuffed". I have dircted Stuffit to place all of its results in this folder. It's been there for over a year. After running todays security update the subfolder was renamed "Documents", and a file called "Documents.1" was created in the original "Documents" folder. So now, in my home/Documents folder I have a subfolder called "Documents" (with the contents of the old "Unstuffed" folder) and a strange zero k file called "Documents.1". Never seen that happen before.
Wake me up when you pass English 101 and can manage to post something that can be readily comprehended.
No problem here using Camino 0.7. Just finished the install of the update with reboot.
took longer than usual to open "Navigator," but it opened just fine. Don't know if you restarted or not -- I haven't yet.
But, I only use Navigator on rare occasions; testing session based problems was the order of the day today.
Notes From Under *nix: blas.phemo.us
I don't have any mozilla, but... go to the Network System Preference Pane. Under "Proxies", set "passive ftp" or something like that. That helped me in the past with Safari.
My reading of the issue on the FreeBSD advisory is that it is likely 10.1.x is affected by this too.
Can anyone confirm?
Is a fix from Apple likely? I would find it very disappointing if Apple have stopped issuing security fixes for this OS - even Microsoft support their previous generation products (Windows 2000 Professional, for example).
If not, given this affects the (open-source) Darwin core of the OS, is a patch to the affected library/ies a possibility?
I am afraid not. I just downloaded the update and Camino 0.7 works like a charm on OS X 10.2.6.
Furthermore, I just noticed that the installer said; "The installer needs to run a program to determine if it can be installed. Do you want to continue?" - that's a cool security feature!
Oh, and the update is now up on Apple's downloads page
Alison
"It is a miracle that curiosity survives formal education." - Albert Einstein
Another update, another reboot. Sigh.. When is Apple going to stop requiring reboots?
And they do require them,as I discovered last night. I wanted to install 10.2.0 on another machine. Rather than try to download a whopping 100Megs of updates, I would use the 6 mini updates I already had to upgrade the computer to 10.2.6. And rather than repeat the install-reboot cycle a half dozen times, I would mount the other machine as a Firewire drive on my 10.2.6 machine. No reboots required, right?
Well, half an hour later, with the 10.2.6 upgrades installed, I boot up. Nothing except a grey screen with an Apple logo. No cyclic symbol. The only way to solve the problem was to reinstall 10.2.0, and upgrade piecemeal, rebooting each time.
No problems with: Camino 0.7 Mozilla 1.5a Safari 1.0 Omniweb 4.5 or Explorer 5.2 All were there prior to the update and all still work fine.
I haven't tried Omniweb, but safari and IE work fine. I just can't believe it's a coincidence. This particular misery would sure love some company!
I had a sucky sig.
Well, I ran this security update this morning, and the XP security updates a few days ago, and now my PowerBook and Compaq refuse to talk to each other. It seems one update or the other broke SMB between the 2 platforms, because it worked fine last week.
Now, after I try to connect to the XP box, it tries & then won't do it. A few moments later, it gives me that very annoying, very modal dialog box that grays out everything else, and says (in several languages) that I need to reboot. Ugh! Anyone else come across this problem?
When did the future switch from being a promise to a threat? -C. Palahniuk
It killed Safari on my iBook, a reinstall fixed it just fine (thankfully I have Camino as a backup!) but Camino worked for me. I think it breaks something in the default browser and blocks it from launching until it times out and becomes a "crash".
TANSTAAFL