Slashdot Mirror
Security Updates, Notices for Mac OS X
Myrrh writes "eEye reports they discovered a heap overflow in QuickTime 6.5, which 'allows a remote attacker to reliably overwrite heap memory with user-controlled data and execute arbitrary code.' Now's a swell time to visit Apple and download the updates for both programs." Also, Apple today released Security Update 2004-05-03, which includes updates for AFP Server, CoreFoundation, and IPSec, and is, like the QuickTime 6.5.1 update, available via Software Update.
Mac OS X does get less security problems than any other OS..perhaps apart from BeOS, but I think we can guess why BeOS doesn't get holes found ;)
'allows a remote attacker to reliably overwrite heap memory with user-controlled data and execute arbitrary code.' damn that apple, even their exploits are reliable!? i'm really thinking about making the switch..
stealing the first posts of honest american slashdot trolls, you insensitive clod!
I think I'll wait a while before downloading these patches, Apple seems to have a bit of a history of b0rking things with them, like that iTunes patch that came a while back. Oh, and I don't have a mac yet;-(
The heap overflow vulnerability mentioned here only applies to the Windows version of the Quicktime player, not the Mac OS version.
See here (section IV), or here, or here.
Mod this a -1 STUPID but who finds most of these security flaws?
No matter if it's OS X, Windows, or Linux, there are always these security fixes popping up. I assume there is a QA team that is working on this stuff but unless there is a vulnerability that manifests itself in the form of a virus or hacked system, who finds these things and why were they looking in the first place?
I only came here to do two things; kick some ass, and drink some beer...looks like we're almost out of beer.
I guess Macs are just more reliable computers all around...
*ducks*
See Apple's email for info and links to the downloads.
If you have AFS turned on, patch now.
1 .txt
@Stake Security Advisory
Advisory Name: AppleFileServer Remote Command Execution
Release Date: 05/03/2004
Application: AppleFileServer
Platform: MacOS X 10.3.3 and below
Severity: A remote attacker can execute arbitrary
commands as root
Authors: Dave G.
Dino Dai Zovi
Vendor Status: Informed, Upgrade Available
CVE Candidate: CAN-2004-0430
Reference: www.atstake.com/research/advisories/2004/a050304-
Overview:
The AppleFileServer provides Apple Filing Protocol (AFP) services for
both Mac OS X and Mac OS X server. AFP is a protocol used to
remotely mount drives, similar to NFS or SMB/CIFS. There is a
pre-authentication, remotely exploitable stack buffer overflow that
allows an attacker to obtain administrative privileges and execute
commands as root.
Details:
The AppleFileServer provides Apple Filing Protocol (AFP) services
for both Mac OS X and Mac OS X server. AFP is a protocol used to
remotely mount drives, similar to NFS or SMB/CIFS. AFP is not
enabled by default. It is enabled through the Sharing Preferences
section by selecting the 'Personal File Sharing' checkbox.
Thereis a pre-authentication remotely exploitable stack buffer
overflow that allows an attacker to obtain administrative
privileges. The overflow occurs when parsing the PathName argument
from LoginExt packet requesting authentication using the Cleartext
Password User Authentication Method (UAM). The PathName argument
is encoded as one-byte specifying the string type, two-bytes
specifying the string length, and finally the string itself. A
string of type AFPName (0x3) that is longer than the length declared
in the packet will overflow the fixed-size stack buffer.
The previously described malformed request results in a trivially
exploitable stack buffer overflow. @stake was able to quickly
develop a proof-of-concept exploit that portably demonstrates this
vulnerability across multiple Mac OS X versions including Mac OS X
10.3.3, 10.3.2, and 10.2.8.
so what are these updates going to break? let's start a pool.
Every time QT for Windows tries to paint the annoying "register now or later" splash-screen/pop-up, it immediately crashes. This is on Windows 2003 server with a Matrox G450 Dual-Head video card running the latest Matrox video drivers. This has been happening for me with the entire 6.x series of QuickTime for Windows.
Is anyone seeing this? Apple must not bother to ask Microsoft for the Windows Error Reporting data on QuickTime, because I've only submitted error reports on this crash about a bazillion times now.
Moderator hint: a comment is neither "Flamebait" nor "Troll" if it is true.
Right after I rebooted after installing the security update, Mac OS X started up and then showed the gray kernel panic screen after I logged in. I rebooted again, and it appears to be running fine, though I'll probably run Disk First Aid soon.
I see that fear and panic has ensued over Apple's latest updates. Well it went well on my 10.3.3 system and has not yet affected any other programs. I think, therefore iMac. - Highly unoriginal
My girlfriends iBook G4 (about two weeks old!) kernel panic'd in the Optimization stage of the update..... had to power button it, and now the spinning boot logo displays forever.... archive reinstall time?
my Mail program is completely wiped and reset wtf??? this happen to anyone else?
and before anyone suggests importing my old mailboxes, that's not the problem.... they're there under username\library\Mail but are completely empty now!
Is there any more thorough source of information on the nature of the changes in the security update?
For example, what IPSec changes were made?
I understand how to confuse the computer -- give it a sufficiently large "number of entries" such that (n+2)*16 is larger than (2^m-1).
But how does overwriting the rest of memory allow you to gain control? Surely the "execution" pointer -- where the computer is looking next for an instruction -- is in some unpredictable place relative to the code you've written in to the heap? Is this just a way to crash the machine as I do if I accidentally reference a memory position I haven't allocated?
Do you just wait and hope that the pointer ends up in your patch of overwritten memory, and write your malicious code so that you can make sure it never leaves your space? Or is there some way to trick the machine into sending the execution pointer directly to your chunk of code?
Protect your liberties. Donate to the ACLU
But why do we still have buffer overflows. Maybe i've got the wrong impression, but i thought that overflows were a trivial issue to fix & equally as simple to avoid. Call me ignorant if you'd like (though a decent non-flaming response would be better) but how super-simple testing isn't standard practice?
I RTFG (RTF Google) and the third article down (watch out, its a pdf) says bounds checking is usually turned off 'in the name of efficiency'. How hard is it for any programmer to run his source through a prog that checks for stupid stuff like this? My favorite part of this kid's paper has to be this:
[Fuck Beta]
o0t!
eEye?
eEye?
Oh.
And you, madam, are very ugly. In the morning, I shall be sober.