Apple Releases Security and Xcode Updates

optikz writes "A security update is available in Software Update. 'Security Update 2003-11-04 addresses a potential vulnerability with the Terminal application in Mac OS X v10.3 and Mac OS X Server v10.3 that could allow unauthorized access to a system.'" sandrift writes "Software Update just popped up with Xcode Update 2003-11-03" Apple notes that "The Xcode update addresses an issue in the Xcode IDE that could potentially lead to data corruption or the loss of files particularly when source files contain illegal characters." Apple does not note, however, that Software Update will attempt to quit Terminal.app when installing the Security Update.

Comments

No 10.2?

[Otter]

Security Update 2003-11-04 addresses a potential vulnerability with the Terminal application in Mac OS X v10.3 and Mac OS X Server v10.3...

What? They're not issuing an update for 10.0 or 10.1? It's a plot to force Mac users to upgrade! Apple is worse than Microsoft! Worse than Red Hat! That's why they'll never Succeed In The Enterprise!

OK, maybe not worse than Red Hat.

Re:No 10.2?

[gooru]

Perhaps the problem only exists under Panther and not under previous versions of OS X.

Re:No 10.2?

[Anonymous Coward]

or maybe he was being sarcastic? It's people like you who always ruin the punchline.

Re:No 10.2?

[mrpuffypants]

meh, i'm switching to SCO because of this. I can't take a company that hates its users as much as Apple does!

What about File Vault?

[Juntao]

Wonder when they'll fix it.

Re:What about File Vault?

[Anonymous Coward]

Well, seeing as how it's not broken...

The only thing wrong with FileVault is that its target audience is too stupid to understand how it works.

Re:What about File Vault?

[valkraider]

its target audience is too stupid to understand how it works

Isn't that true of maybe 75% of ALL computers?

Re:What about File Vault?

[Anonymous Coward]

Isn't that true of maybe 75% of ALL computers?

Closer to 100%

Re:What about File Vault?

[Carnildo]

90%

Re:What about File Vault?

[Juntao]

> Well, seeing as how it's not broken...

It most certainly is. It corrupts many files. I've lost half of my preferences because of File Vault. It also has a hard time recovering unused space.

Use it for more than 20 seconds next time.

Re:What about File Vault?

[Anonymous Coward]

It corrupts many files.

Something often asserted, but never actually observed under controlled conditions.

I've lost half of my preferences because of File Vault.

You are aware, are you not, that FileVault has nothing to do with preferences? Perhaps there's something going in inside the NSUserDefaults runtime environment. Ever considered that?

It also has a hard time recovering unused space.

"A hard time?" Not sure what you mean by that.

Use it for more than 20 seconds next time.

I've been using it full-time since June on three different machines. During those early post-WWDC builds... woah. That was some bad stuff. But since about 7B74, it's worked flawlessly.

You, incidentally, are one of those people I was referring to when I said that the target audience is too stupid to understand how FileVault works.

Re:What about File Vault?

[Rascasse]

I lost many of my preferences as well when File Vault was enabled. Since I've disable it, I've lost none. Whenever I mention this bug some Apple apologist chimes in and claims there is no bug.

Re:What about File Vault?

[thbbpt]

You mean Vile Fault?

Re:What about File Vault?

[gaelicwizard]

I've lost half of my preferences because of File Vault.

You are aware, are you not, that FileVault has nothing to do with preferences? Perhaps there's something going in inside the NSUserDefaults runtime environment. Ever considered that?

You are aware, are you not, that preferences are stored in files?

I lost my whole home folder to file vault. Even if I am too stupid to use, it it is UNACCEPTABLE that this would EVER happen with an option that is available to ANYONE on the computer. Think about it. If it *might* have negative side-effects, then it needs to give a BIG F*CKING WARNING before even telling you that you may or may not encrypt your home folder.

Re:What about File Vault?

[Anonymous Coward]

What's wrong with it?

File Vault runs fine!

Re:What about File Vault?

[Anonymous Coward]

You are aware, are you not, that preferences are stored in files?

Oh, well, that seals it.

Idiot.

I lost my whole home folder to file vault.

User error, no doubt.

Even if I am too stupid to use, it it is UNACCEPTABLE that this would EVER happen with an option that is available to ANYONE on the computer.

Yes. Computers should be unbreakable. The fact that they're not gives you the right--nay, the mandate--to complain righteously.

If it *might* have negative side-effects, then it needs to give a BIG F*CKING WARNING before even telling you that you may or may not encrypt your home folder.

What's the deal, Sparky? Did you not read the BIG FUCKING WARNING in BIG BOLD RED TYPE before you clicked that widdle buddon?

Re:What about File Vault?

[Anonymous Coward]

Do you know what "bug" means, Asscasse? A "bug" is reproducible. If it's not reproducible, it's not a bug.

I don't know what the hell you did wrong to trash your preferences. But it was NOT REPEAT FUCKING NOT a FileVault bug.

So?

[trublaha]

Apple does not note, however, that Software Update will attempt to quit Terminal.app when installing the Security Update.

Is that such a big deal? I mean, if it's replacing the application, it's kinda going to have to quit it! Normally I like to quit as many running processes and applications before applying updates, just be sure.

Anyways, good to get an update so early. Haven't really noticed any of the problems with XCode, but it's reassuring knowing they're being addressed before I can encounter them!

Re:So?

[Anonymous Coward]

Also, the operative word there is "try." If your terminals are active (running anything other than a shell, that is), you'll get a "do you really want to quit?" alert.

Re:So?

[pudge]

Is that such a big deal? I mean, if it's replacing the application, it's kinda going to have to quit it!

It is if you weren't thinking about it, had some processes running in the Terminal, and didn't have the preferences set to not close without warning if you have processes running (which, IIRC, is the default).

It's not a huge deal, but it absolutely should warn you before doing it.

Re:So?

[tm2b]

Look at it as Apple doing some preemptive education of its user base, teaching us to pay more attention.

It could be sorta bad. It's not obvious that Terminal is being replaced - you might guess it's something like sshd or apache and simply not care enough to check - or you might be one of those unsophisticated users who say "Oh My GOD! Apple says to install a security update now, don't know what this means but it must happen ASAP!"- if you tell it to go ahead and install without checking you can lose a session. Not that someone who doesn't know what Terminal.app is is likely to be running Terminal.

In any case, it's one of those things that you are only likely to do once. :)

Re:So?

[Carthag]

...and didn't have the preferences set to not close without warning if...

Mind... melting..

Re:So?

[rixstep]

I mean, if it's replacing the application, it's kinda going to have to quit it!

Not at all. You've obviously never tried. What's loaded is loaded - you won't get any new NIBs if the old ones are removed - but you're perfectly capable of overwriting the disk image of a running process.

Re:So?

[MoneyT]

The terminal is set by default to ask you if you want to quit if you have processes running. If you turned that off, it's your fault for not thinking ahead.

Re:So?

[Herbmaster]

I mean, if it's replacing the application, it's kinda going to have to quit it!

Not necessarily, but it's a reasonable expectation. Of course, it's a reasonable expectation that Apple didn't provide. When I installed the update I don't recall it giving me any indication that it was terminal.app that was going to be modified, let alone that it would be trying to quit terminal for me. They should have indicated both. Most Apple security updates require delayed reboots to finish installation, IIRC, so I was pleased to see that this one didn't at least.

Re:So?

[gryphokk]

I mean, if it's replacing the application, it's kinda going to have to quit it!

You would hope so, wouldn't you.

My wife was very nervous about operating my computer when she first started (an Amiga 2000). She was sure she would break something. I assured her it was very user-friendly, and she couldn't do anything to it that I couldn't fix (not a boast I would make today ;-) ).

She wrote her document. "What do I do now?"

I told her to save the document before printing. She dutifully saved the document -- in the same folder as the word processor -- with the same name as the word processor.

She printed the document successfully, quit the program.

Next day, she wanted to revise the letter. She double-clicked the file icon, which had no application to run it!

When she asked me for help, I looked in the folder window. She indicated "this" was her document. I said, no, that's the program.

She had replaced the word processing program with a document of the same name!

What I told her was true -- she couldn't break anything I couldn't fix. I reinstalled the WP and everything was great after that. But, yes, you can delete or overwrite a running application (at least in Amiga.)

Note: Mac does prevent you from overwriting an app with a document, so thie particular error wouldn't happen on Mac. But I don't see any obstruction to deleting a running application.

Re:So?

[aduzik]

Also (and I learned this the hard way) you need to make sure to quit Xcode when it updates that, too. My system hung -- I mean "gray screen of death" hung -- because I was running Xcode when I updated. At least, that's what I've been able to figure out so far.

It could be worse.

[jptechnical]

I have installed some win updates that shut down the entire system with no warning.

Nothing gets your blook pumping like a minor patch rebooting the DC in the middle of the afternoon.

Note to self... 'finish' sometimes means restart.

Re:It could be worse.

[Pathwalker]

Shouldn't you be applying those patches during a scheduled change window, outside of production hours?

Shouldn't you have noticed that the patch forces a reboot when you applied it to one of your test systems to see if it would cause any problems?

Re:It could be worse.

[Anonymous Coward]

Shouldn't you be less of a pawn to the borg

Re:It could be worse.

[Anonymous Coward]

Shouldn't people be doing that for any OS - microsoft product or not?

Re:It could be worse.

[rf600r]

Note to self: Don't hire this moron who patches a DC in the middle of the afternoon.

Re:It could be worse.

[Anonymous Coward]

Note to self self: Don't work for a moronic company whose DC doesn't have to redundancy to be patched without disrupting everyone.

Re:It could be worse.

[Anonymous Coward]

Shouldn't you wake up to the reality that not everybody can/wants to spend every waking hour worrying about something as simple as a software patch/update.

Patching should be a 1-4 minute process. Not ages of testing and re-testing.

Re:It could be worse.

[Pathwalker]

Shouldn't you wake up to the reality that you can't trust any software - Linux or Windows or MacOS - to be bugfree.

Which would you rather do?

1. Spend an hour or so checking out a patch on a test system before installing it.
2. Tell your boss to send everyone else home for the rest of the day because you fucked up because you didn't take a basic precaution because you were in too much of a hurry.

How do you think your boss will react if you chose option 2?

Patch bug or PEBKAC?

[Squozen]

Hmm. Once I've applied the patch Software Update still lists it as an available patch the next time I check for updates. I wonder what I managed to break when I installed Fink..?

Re:Patch bug or PEBKAC?

[neverkevin]

I always move my chair to the other side of the room when installing updates to prevent PEBKAC errors :)

Re:Patch bug or PEBKAC?

[Elwood P Dowd]

Some software updates reappear until you reboot.

Re:Patch bug or PEBKAC?

[the_proton]

That's your friendly neighbourhood proxy caching the results of the "what to scan" file from Apple. Force the proxy to refresh by either loading http://swscan.apple.com/scanningpoints/scanningpoi ntX.xml in a browser that supports a force reload, or if you have wget isntalled:

wget --cache=off "http://swscan.apple.com/scanningpoints/scanningpo intX.xml"

- proton

Re:Patch bug or PEBKAC?

[Squozen]

Thanks, I'll give that a shot. I had a 512Mb DIMM sitting on my desk when I arrived at work this morning so I have a good reason for shutting it down now.. :)

Re:Patch bug or PEBKAC?

[fr0dicus]

Put your Terminal.app back in /Applications/Utilities.

Worked for me.

Re:Duh...

[Anonymous Coward]

If you're running the update from within Terminal.app.

Re:Mac users shouldn't be using command line away.

[Anonymous Coward]

Remember, kiddies: The more mouse buttons you have, the bigger your penis is!!!

Better yet...

[AvantLegion]

... you should've thrown a fit about the Xcode patch not being available on earlier OS X's. :)

No, please, you go first

[bpbond]

Boy, after Apple's recent Firewire drive and FileVault data erasure issues, I think I'll let someone else go first. Let me know how things look, post-update, tomorrow morning...

Re:No, please, you go first

[Anonymous Coward]

Just did the update and nothing untoward happened. So I guess it works.

Re:No, please, you go first

[bpbond]

Thanks; no thanks to the moderator who slapped a flamebait on my post above.

Re:No, please, you go first

[Anonymous Coward]

Fixed that. Getting tired of the standard of some of the moderating here lately.

Re:Duh...

[Anonymous Coward]

doesnt seem to be a problem debian has...

illegal characters?

[k3vmo]

Ummm. Any note of what characters they are referring to?

Re:illegal characters?

[Paradise Pete]

Any note of what characters they are referring to?

"(C) SCO", I believe.

Re:illegal characters?

[Tisephone]

"(C) SCO", I believe.

Really? My own tests suggested that it was "Netcraft confirms".

Re:illegal characters?

[Paradise Pete]

Really? My own tests suggested that it was "Netcraft confirms".

I like yours better.

Re:illegal characters?

[MoneyT]

I'm going to guess illegal characters refer to any reserved symbols that get used where they aren't supposed to be used.

my iMail app is broken

[Anonymous Coward]

I just installed the updates and now it seems iMail crashes when it attempts to fetch email:

Date/Time: 2003-11-04 21:55:29 -0800
OS Version: 10.3 (Build 7B85)

Command: Mail (/Applications/Mail.app/Contents/MacOS/Mail)
PID: 672
Thread: 5

Exception: EXC_BAD_ACCESS (0x0001)
Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0:
#0 0x900075c8 in mach_msg_trap (mach_msg_trap + 8)
#1 0x90007118 in mach_msg (mach_msg + 56)
#2 0x90191930 in __CFRunLoopRun (__CFRunLoopRun + 848)
#3 0x901960bc in CFRunLoopRunSpecific (CFRunLoopRunSpecific + 328)
#4 0x927d5ecc in RunCurrentEventLoopInMode (RunCurrentEventLoopInMode + 172)
#5 0x927dc640 in ReceiveNextEventCommon (ReceiveNextEventCommon + 380)
#6 0x927fe6d0 in BlockUntilNextEventMatchingListInMode (BlockUntilNextEventMatchingListInMode + 96)
#7 0x92dd2a80 in _DPSNextEvent (_DPSNextEvent + 384)
#8 0x92de93fc in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 116)
#9 0x92dfd730 in -[NSApplication run] (-[NSApplication run] + 540)
#10 0x92eb9a1c in NSApplicationMain (NSApplicationMain + 464)
#11 0x0001317c in 0x1317c
#12 0x00041f70 in 0x41f70

Thread 1:
#0 0x90012668 in syscall_thread_switch (syscall_thread_switch + 8)
#1 0x90a03024 in +[NSThread sleepUntilDate:] (+[NSThread sleepUntilDate:] + 152)
#2 0x92dcac2c in -[NSUIHeartBeat _heartBeatThread:] (-[NSUIHeartBeat _heartBeatThread:] + 1172)
#3 0x90a3a198 in forkThreadForFunction (forkThreadForFunction + 108)
#4 0x900247e8 in _pthread_body (_pthread_body + 40)

Thread 2:
#0 0x90017048 in semaphore_wait_signal_trap (semaphore_wait_signal_trap + 8)
#1 0x9000e890 in _pthread_cond_wait (_pthread_cond_wait + 624)
#2 0x7ca12274 in -[_MFRecursiveLock lock] (-[_MFRecursiveLock lock] + 80)
#3 0x7ca6e580 in -[MessageRouter asynchronouslyRouteMessages:] (-[MessageRouter asynchronouslyRouteMessages:] + 92)
#4 0x7ca8bd58 in -[POP3FetchStore connection:didRetrieveData:forMessageNumber:] (-[POP3FetchStore connection:didRetrieveData:forMessageNumber:] + 304)
#5 0x7ca88790 in -[POP3Connection retr:] (-[POP3Connection retr:] + 764)
#6 0x7ca88be4 in -[POP3Connection fetchMessages:] (-[POP3Connection fetchMessages:] + 240)
#7 0x7ca8a350 in -[POP3FetchStore fetchSynchronously] (-[POP3FetchStore fetchSynchronously] + 2052)
#8 0x7caab5e0 in -[POPAccount fetchSynchronously] (-[POPAccount fetchSynchronously] + 192)
#9 0x90836774 in objc_msgSendv (objc_msgSendv + 180)
#10 0x909fb270 in -[NSInvocation invoke] (-[NSInvocation invoke] + 884)
#11 0x7ca1af44 in -[MonitoredInvocation invoke] (-[MonitoredInvocation invoke] + 144)
#12 0x7ca176a0 in -[InvocationQueue _drainQueue] (-[InvocationQueue _drainQueue] + 408)
#13 0x90a3a198 in forkThreadForFunction (forkThreadForFunction + 108)
#14 0x900247e8 in _pthread_body (_pthread_body + 40)

Thread 3:
#0 0x900075c8 in mach_msg_trap (mach_msg_trap + 8)
#1 0x90007118 in mach_msg (mach_msg + 56)
#2 0x90191930 in __CFRunLoopRun (__CFRunLoopRun + 848)
#3 0x901960bc in CFRunLoopRunSpecific (CFRunLoopRunSpecific + 328)
#4 0x909fced0 in -[NSRunLoop runMode:beforeDate:] (-[NSRunLoop runMode:beforeDate:] + 172)
#5 0x90a159ec in -[NSRunLoop run] (-[NSRunLoop run] + 76)
#6 0x7ca3acec in +[_NSSocket _runIOThread] (+[_NSSocket _runIOThread] + 92)
#7 0x90a3a198 in forkThreadForFunction (forkThreadForFunction + 108)
#8 0x900247e8 in _pthread_body (_pthread_body + 40)

Thread 4:
#0 0x9000b30c in select (select + 12)
#1 0x90196d40 in __CFSocketManager (__CFSocketManager + 508)
#2 0x900247e8 in _pthread_body (_pthread_body + 40)

Thread 5 Crashed:
#0 0x9604541c in LSMImmutableMapCounter::LSMImmutableMapCounter[uni

Re:my iMail app is broken

[Black Noise]

Perhaps you should send the stack trace to apple instead of posting it here.

Running the patch now

[sakusha]

I'm doing the update now, its a little slow downloading. I just backed up and reformatted my old Pismo G3/500 for a fresh install of Panther, I figure I should start with a baseline OS with all current updates. Now I can try this before it can cause any trouble, on a blank new CPU. I have nothing to lose.

Re:Running the patch now

[Anonymous Coward]

'on a blank new CPU'?

How do you make a CPU blank?

Re:It could be worse (Windows 2000)

[xiaodidi]

Well, what if you are forced to use Windows, yet you don't get enough support, and you have to install software yourself, for your daily work?
Do you go back to the office in the middle of the night, in order not to disrupt your own daily schedule?
The official OS here is Windows 2000. This one needs to restart even after installing third party applications that have nothing to do with the OS. (Now, I am not allowed to upgrade to XP).
By contrast, OS X, basically from day one, only needs to be restarted after installing an handful of components, such as Quicktime and Java, in addition to the OS itself, of course.

Patched, no problems.

[gsdali]

Maybe this will solve the problem with tcsh gobbling up loads of CPU cycles. I doubt it though, apple would have probably mentioned it directly. The problem with Mail detailed above could be something else entirely.

And it doesn't require restart!

[your_mother_sews_soc]

Apple does not note, however, that Software Update will attempt to quit Terminal.app when installing the Security Update.

Panther seems stable and very solid, even though it did deep six my ProTools, wouldn't let me use my Geforce4MX card, etc . So I figured I'd give it a shot. Oh yeah, and reading bpbond's post forced me to give it a go.

Much to my surprise, that the security patch didn't require a restart. To the best of my knowledge, this is a first. And, like the new installer, at the end it went through a "disk optimization" stage. I am impressed! Now if Avid could update ProTools, and I can get ssh to listen over port 23 again (my place of employment has telnet open, but nothing else - I need to read slashdot!) ...

Re:And it doesn't require restart!

[stripes]

Now if Avid could update ProTools, and I can get ssh to listen over port 23 again (my place of employment has telnet open, but nothing else - I need to read slashdot!)

Doesn't adding "Port 23" to /etc/sshd_config do it? (not that I have tryed, but a quick scan of hte man page says it will... oh, you probbably have to HUP sshd). Or are you asking how to get the client to use another port (-p 23 I think).

Good luck.

Re:And it doesn't require restart!

[your_mother_sews_soc]

This is probably totally off topic, but yes, you are right. That's how I've managed to get it to work through 10.2.8. As a matter of fact, right now I am tunnelling from work into a fresh 10.2.8 install.

I have sshd_config set with Port 23, and Apache running mod_proxy. On the client (Windows side) I use putty.exe to use ssh over 23 and then set up port forwarding to Apache. This enables me to do all my "bad" surfing - Slashdot, MacNN, Macintouch - etc., all encrypted and below the radar of our contet-filtering cops.

I've tried everything on Panther, rebooted, disabled the firewall, played with ipfw - all to no avail. So to keep my sanity, I launch 10.2.8 and go to work. And here I am! Panther is good, maybe too good.

Re:And it doesn't require restart!

[bucklesl]

Yeah, add

Port 23

to the /etc/ssh/sshd_config. Also, if you want to make sure you get on from other places, and you don't run a web server, just use some common WWW ports.

Port 80
Port 443
Port 8080

SCSI problems - whose fault?

[teamhasnoi]

My Adaptec 2096 SCSI card has been 'disappeared' since I installed Panther. It worked fine under 10.2.8.

Apple is blaming Adaptec, Adaptec is blaming Apple. Since the driver was built into OS X, who should I go after? I hope this isn't another, "We no longer support SCSI".

Corrected TROLL!

[ErnstKompressor]

What?? WHAT!!???? A bug in Apple's software? My god that's impossible!!!!! The submitter must be trolling!! FYI, only Microsoft (sorry, "M$") software has bugs. RMS, ESR and other luminaires of the open source world such as the brilliant Slashdot editors have said it is so. Neither Apple nor GNU/Whatever software has bugs. Please delete this article immediately as it serves no purpose whatsoever except to troll. Troll, troll. Please die troll.

The above post does not represent the views of Ernstkompressor. All rights belong to some Anonymous Coward. Thank you for your support