Slashdot Mirror
Apple Releases Security Update 2004-01-26
ollie_ob writes "Apple's released an important security update for Mac OS X today. The update includes changes to the following important apps and services: Apache 1.3, Classic, Mail, Safari, Windows File Sharing. In addition, it includes the 2003-12-19 Security Update. It's available via Software Update." It's also available for Server.
Shouldn't 10.3.3 be here soon?
In the time of chimpanzees I was a monkey --Beck
This item's been sitting here a while, without even a FP troll. Is the Apple OS so secure that a security patch is not an immediate "get it now"?
Don't blame Durga. I voted for Centauri.
We're not sure what it does. But it installs fine and seems to work!
Anyone know if/when Apple will incorporate Apache 2.0? Or if there would be any use to doing so?
The last security update was December 19th.
As for a monthly update... thanks, but I want new features (and especially security updates) as they become available.
Looking at my updates, which actually don't go back too far because I reloaded my laptop, the last system update i did was Dec 20th... that's over a month. The only updates I've done between then and now were application updates, like iCal. That's definitely better than being on a monthly patch release schedule for critical OS bugs.
Ever since the 10.3.2 update crashed my laptop I wait a day or two to see how things are going. That was the only crash I've ever had in Mac OS X though, and I had reloaded and (automatically) had all my settings back to the way they were before the crash, and had the system all patched up, even with the patch that crashed the system, within 35 minutes. This was amazing to me, considering all the hundreds of times I've spent reloading my own or other people's windows boxen and the frustration of importing all the previous settings (and never quite getting them ALL back). I'm not going to say OS X is the OS that does it all, but I will say that after using MS OSes since DOS 3.2 my new desktop OS of choice is OS X for reasons like that... Even so, I still do wait a day or so to patch because clearly things can, and do, go wrong some times.
I don't know weather to write this as troll, astroturfing or just ignorance. I rather update my box more frequently, if it fixes the bugs and security problems. My Fedora boxes run "yum update-check" nightly, my RedHat boxes run up2date nightly, my OS X boxes check software update daily, and I have no complaints when they find an update. I like having notices sent to my mail box, so I can check them all in one place. (you can do this with scripting the OS X command line softwareupdate).
I wish I could automate the checking for updates form Microsoft. Launching a web page and clicking through daily is no way to check for updates (and MS's security announcements are typically not sent when the updates are made available, but can be a day or two later).
MS's "monthly" policy scares me. There is more to an OS than uptime. I'd rather know my boxes are secure than know that it's been a while since I rebooted them (and I run a number Linux, OS X and Windows boxes).
I am, and always will be, an idiot. Karma: Coma (mostly effected by
Err, you can. I believe the feature is built-in to WinXP, and may have been available as a standard part of Win2k. However, it's also available as a separate update for any version of Windows going back at least as far as Win98.
With the Windows auto-update option installed, the system will periodically check for available updates and, depending on your settings, automatically inform you of them, download first & inform you that updates are waiting to be installed, or automatically download and install. I like the second option, if only to grab a copy of everything and show me before anything is committed, but it's up to you.
I think the auto-update runs weekly, but it should just be controlled by the system scheduler. Depending on your version of Windows, you should be able to go in and set this to run at whatever schedule you please, and if that's not good enough for you, you can probably script it with DOS, VB, Perl (ActiveState), Python (ActiveState), Bash (Cygwin), etc. Windows still lags badly behind the scripting abilities of Linux or Macintosh, but the facilities are there if you want to take advantage of them.
DO NOT LEAVE IT IS NOT REAL
Looks like someone's abusing the moderation system again. I really wonder why people don't get banned from it after enough Unfairs.
Do any of these fixes affect 10.2.8 or only for 10.3?
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
I have installed it on 3 machines, and everything seems to work fine with one exception. Every time I install it and reboot, there it is in the Software Update list again. I even tried installing it a 2nd time on one machine, sure enough it was there again after reboot. Big Ben, Parliament, kids
OS X in this regard is no better than Windows. It's an opaque operating system and dispite the list of changes that Apple provides, there's no real way to know if the patch is going to kill your system.
Did you miss http://developer.apple.com/darwin/?
Have fun with the kernel...
Happy 20th Anniversary, Macintosh users. You get... a security fix.
Fingers crossed...been waiting for months.
Alright, posted a comment that is negative twords apple in an apple article, mod me down just like the grandparent post.
Updates are
A small icon in the bottom of the start bar (which is what the auto-update gives you using the settings you describe) is a far cry from an e-mail that lets me know from my workstation. I really have no desire to log in to each server to check this. Plus, the small icon doesn't show up when you log in to a Windows Server via RDP connection, and yes I am aware of Timbuktu, VNC, radmin, etc. RDP is how I'm connecting to one of my windows servers right now from home since work is snowed in (bandwith isn't limitless). Big difference between one desktop and a number of servers. Windows Auto-update just doesn't cut it for this. It's fine for my notebook. Just not for my servers.
There is some improvement to this situation thanks to a program written by someone here at Virginia Tech called Daisy that helps to check for updates to more than just the OS, but this is still a far cry from an update notification in one central location (central meaning my e-mail where I get the messages from all my other systems). You can run Daisy scripted. It's a great package.
However, updating an OS is efficiently should be the responsibility of the OS distributor, not the responsibility of third party developers.
(I highly recommend Daisy. Best thing to hit Windows server administration ever.)
I am, and always will be, an idiot. Karma: Coma (mostly effected by
im not entirely sure, but instead of downloading Apache security updates made by Apple, you could roll your own patches, download them from the source, compile and install them. No restart needed then.
APPLE-SA-2004-01-26 Security Update 2004-01-26
t y_pgp .html
Security Update 2004-01-26 is now available. It contains security enhancements for the following:
AFP Server: Improves AFP over the 2003-12-19 security update.
Apache 1.3: Fixes CAN-2003-0542, a buffer overflow in the mod_alias and mod_rewrite modules of the Apache webserver.
Apache 2: Fixes CAN-2003-0542 and CAN-2003-0789 by updating Apache 2.0.47 to 2.0.48. Installed only on Server systems.
Classic: Fixes CAN-2004-0089 to improve the handling of environment variables. Credit to Dave G. of @stake for reporting this issue.
Mail: Fixes CAN-2004-0085 and CAN-2004-0086 to deliver security enhancements to Apple's mail application. Credit to Jim Roepcke for reporting CAN-2004-0086.
Safari: Fixes CAN-2004-0092 by delivering security enhancements to the Safari web browser.
System Configuration: Fixes CAN-2004-0087 and CAN-2004-0088 where the SystemConfiguration subsystem allowed remote non-admin users to change network setting and make configuration changes to configd. Credit to Dave G. from @stake for reporting these issues.
Windows File Sharing: Fixes CAN-2004-0090 where Windows file sharing did not shutdown properly.
This message is signed with Apple's Product Security PGP key, and details are available at:
http://www.apple.com/support/security/securi
Or, if you know that it's say just Apache being updated. force quit the Software Update app, then restart Apache by hand. This is unix afterall. If it's not a core part of the OS, then you don't *need* a restart, but this is a consumer driven OS company (X Server is still based on the concept of a consumer server OS) they keep it simple with a reboot. If you know what to issue the kill command to, you're all set. I've avoided a number of reboots this way. Become Zen with your OS, no matter what it is. (yes, that includes Windows as well). Zen multi-platform? What crack am I smoking at this hour? Become one with the universe of operating systems! OK, time to go to bed now.
I am, and always will be, an idiot. Karma: Coma (mostly effected by