Slashdot Mirror
Security Update 2003-08-14 Released
Delta-9 writes "Today, Apple released Security Update 2003-08-14, which 'addresses a potential vulnerability in the fb_realpath() function which could allow a local or remote user to gain unauthorized root privileges to a system.'" It's on Software Update, and will likely soon appear on the support downloads page.
Nice to see Apple is responding more quickly to security problems. I didn't even hear about this through my regular channels until after I had seen the update in Software Update.
-- Apple: Where Microsoft wants to go today.
The security update addresses the following vulnerability: http://isec.pl/vulnerabilities/isec-0011-wu-ftpd.t xt
Users who haven't activated the FTP server in the Sharing preference pane should not be vulnerable in any way to this bug. Furthermore, FTP servers running with anonymous access, aren't vulnerable either (unless anonymous write access is enabled), since the overflow exploit requires creating deep hierarchies of directories. Only users with regular accounts on the machine can use this bug to gain more privileges on the machine.
The advisory claims to have successfully exploited the problem on several Linux i386 platforms, but they "believe that exploitation of other little-endian systems is also possible". Note "litle-endian". This may suggest that the bug is not exploitable in a useful way on big-endian machines (like all Mac's, for example).
Or it may simply suggest that they haven't investigated the matter thoroughly on big-endian processors.
The advisory was posted some full two weeks ago, meaning that Apple was not as quick to respond as they normally are. Perhaps they were a bit too involved in Panther right now, and had to let this relatively minor insecurity wait a little while.
It looks like I jumped the gun on this...On several levels...
First, wu-ftpd is not the ftp server in Mac OS X. lukemftpd is.
Second, the most relevant advisory is not the quoted one, but this one (which previously appeared on Slashdot): FreeBSD-SA-03:08.realpath.
As the name implies, the bug originates from FreeBSD, and potentially leaves a long list of programs vulnerable (listed in the advisory).
This means that the problem is broader than my original message anticipated. It means that other remote services may be vulnerable, including sftp.
Thanks to the anonymous user who brought my attention to my (pretty bad) mistake.
Please spread this information instead of the wrongful information in the parent post. Mod parent down.
I've posted this elsewhere, also. I know this seems odd, but imagine my surprise. In my home/Documents folder I have a subfolder named "Unstuffed". I have dircted Stuffit to place all of its results in this folder. It's been there for over a year. After running todays security update the subfolder was renamed "Documents", and a file called "Documents.1" was created in the original "Documents" folder. So now, in my home/Documents folder I have a subfolder called "Documents" (with the contents of the old "Unstuffed" folder) and a strange zero k file called "Documents.1". Never seen that happen before.
took longer than usual to open "Navigator," but it opened just fine. Don't know if you restarted or not -- I haven't yet.
But, I only use Navigator on rare occasions; testing session based problems was the order of the day today.
Notes From Under *nix: blas.phemo.us
My reading of the issue on the FreeBSD advisory is that it is likely 10.1.x is affected by this too.
Can anyone confirm?
Is a fix from Apple likely? I would find it very disappointing if Apple have stopped issuing security fixes for this OS - even Microsoft support their previous generation products (Windows 2000 Professional, for example).
If not, given this affects the (open-source) Darwin core of the OS, is a patch to the affected library/ies a possibility?
Furthermore, I just noticed that the installer said; "The installer needs to run a program to determine if it can be installed. Do you want to continue?" - that's a cool security feature!
Oh, and the update is now up on Apple's downloads page
Alison
"It is a miracle that curiosity survives formal education." - Albert Einstein
Another update, another reboot. Sigh.. When is Apple going to stop requiring reboots?
And they do require them,as I discovered last night. I wanted to install 10.2.0 on another machine. Rather than try to download a whopping 100Megs of updates, I would use the 6 mini updates I already had to upgrade the computer to 10.2.6. And rather than repeat the install-reboot cycle a half dozen times, I would mount the other machine as a Firewire drive on my 10.2.6 machine. No reboots required, right?
Well, half an hour later, with the 10.2.6 upgrades installed, I boot up. Nothing except a grey screen with an Apple logo. No cyclic symbol. The only way to solve the problem was to reinstall 10.2.0, and upgrade piecemeal, rebooting each time.