Slashdot Mirror
Security Update 2004-09-07
sizemoresr writes "Security Update 2004-09-07 delivers a number of security enhancements and is recommended for all users of Mac OS X 10.2.8 and later. This update includes the following components: CoreFoundation, IPSec, Kerberos, libpcap, lukemftpd, NetworkConfig, OpenLDAP, OpenSSH, PPPDialer, rsync, Safari and tcpdump."
;^)
I can't believe Apple would do something like this to 10.2 users! I paid $120 for Mac OS X v10.2 and now Apple refuses to fix critical security flaws in my OS, which is not yet 2 years old. I refuse to pay this annual Apple tax! And what's with the one mouse button, overpriced, non-upgradable hardware, combustible batteries, and abnormally long file copy times. I mean come on my 486 box with... wait, what?
The update IS for 10.2 and 10.3 users? Oh. Good then. I don't really feel like deleting the other stuff I wrote. Good to get it out of the way anyway, I guess.
Thanks Apple!
Two security updates in less than a month's time. Doesn't look like a panic job either.
Nor did they publish a list of applications that won't work after you install.
Think different... [than micr0s0ft]
At least so far. Nothing's tripping up, no "Shock and Awe"-worthy problems. And most importantly, my Ti-book (10.3.5) still doesn't work like a windows machine.
Si hoc legere scis nimum eruditionis habes sed iliud latine dici non potest.
...s that the update is provided for two Panther releases, 10.3.5 AND for 10.3.4.
From apple's Security Announce list:
Given the relatively recent release of the Mac OS X v10.3.5 Software
Update, this security update is available for both Mac OS X v10.3.4
and Mac OS X v10.3.5. Customers who are still evaluating Mac OS X
v10.3.5 for large-scale deployment can apply the security update for
Mac OS X v10.3.4 to increase the security of their systems during the
evaluation period. After updating to Mac OS X v10.3.5, Security
Update 2004-09-07 should be installed onto Mac OS X v10.3.5 even if it
was previously installed on a Mac OS X v10.3.4 system.
From memory some of the other security updates could be put on before the release they came with, but I wouldn't trust just my memory as far as I could throw it. Anyway, it's specifically noted this time.
Thought you logged out of your super secret intranet page - no you didnt...
Just go ahead and update and try FedEx.com or DirectTV.com
You may just want to wait a bit
Keep on Folding! Team MaC OS X rocks! Join Us!
You mean rsync runs correctly in both user and daemon mode????
On 10.2?
Yay! I've been trying to get BackupPC to backup our XServe with no luck at all to this point. Finally! I had tried compiling from sources and from Fink and both failed miserably. Something about an OS-specific bug. w00t!
Karma: Chameleon (mostly due to the fact that you come and go).
This update apparently "secures" the FTP daemon in quite an original way, by rendering it completely inoperable.
There are a few reports about it on Apple's discussions site.
The workaround suggested in the above link is to revert to the original ftpd supplied with Panther/Jaguar using the OS X install discs and a tool like Pacifist - though I'm trying to look at the glass as half-full and use this as the kick in the pants I need to start using sftp instead..
Of course, that's the link in the article. Got too used to looking for it in the comments... :-P
I saw the IPSec update and that makes me a little bit fearful for stability of third-party IPSec tools...
Someone is WRONG on the Internet!
He can barely get well enough from the beating the last update gave him when the next one comes around and does it to him again. Next time, I'll see about putting him in a kennel just so the update will leave him alone... Other than the dog, the only other problem I had with the update was that it formatted my HD.
Sleep your way to a whiter smile...date a dentist!
Most of the problems I've encountered are with Safari. The following sites all have similar problems and are entirely unusable with Safari after applying the patch:
7 98 :
http://www.fedex.com/
http://www.compusa.com/
http://www.bestbuy.com/
I'm sure there are many others. G5 systems do not appear to be affected. G4s are.
As noted on http://docs.info.apple.com/article.html?artnum=61
Component: Safari
CVE-ID: CAN-2004-0361
Available for: Mac OS X 10.2.8, Mac OS X Server 10.2.8
Impact: A JavaScript array of negative size can cause Safari to access out of bounds memory resulting in an application crash.
Description: Storing objects into a JavaScript array allocated with negative size can overwrite memory. Safari now stops processing JavaScript programs if an array allocation fails.
This security enhancement was previously made available in Safari 1.0.3, and is being applied inside the Mac OS X 10.2.8 operating system as an extra layer of protection for customers who have not installed that version of Safari. This is a specific fix for Mac OS X 10.2.8 and the issue does not exist in Mac OS X 10.3 or later systems.
----
This particular fix is specific to 10.2.8 and NOT 10.3 or later, yet appears it may install with the 10.3.x update. This could well be the cause of the problems. This is further supported by the fact that all of the known sites that fail to render properly use JavaScript 1.2 extensively.
Word is the Safari team is aware of the problem and working on it.
I couldn't find anything so far about the swap file password reveal being fixed or not.
That's a serious issue that I expected to be fixed soon.
If he explores all forms and substances Straight homeward to their symbol-essences; He shall not die.
The latest Security Update has (predictably) broken my rsyncX install. I was able to fix this by overwriting /usr/bin/rsync (Apple's rsync) with /usr/local/bin/rsync (which is where rsyncX installs by default). However, be sure to RTF-security information first the version of rsync that rsyncX uses (2.6.0) is not secure in daemon mode (use SSH mode instead).
At our school, we don't earn a degree when we graduate—we earn pi/180 radians
Looks like that Safari is not correctly rendering some sites that use OpenCube's Visual QuickMenu http://www.opencube.com/
Other sites that aren't rendering correctly:
http://www.subaru.com/
http://www.memcorpinc.com/
http://osx.hyperjeff.net
Good catch Jeff!!
This update changed something in FTP and now I can't FTP into my computer. Any help for this would be greatly appreciated.
Ahh, at least the culprit is named and shamed!
Someone is WRONG on the Internet!
go to a terminal prompt and type
/etc /usr/etc
/usr/etc instead /etc for it's config.
sudo ln -s
As someone pointed out above, Apple mucked up the ftpd compile and made the ftp daemon look in
Just installed this patch, and FTP seems to have broken itself...
220 inuBook.inuchance.net FTP server (tnftpd 20040810) ready.
Name (localhost:inuchance):
331 Password required for inuchanc.
Also, note that before you start trying to FTP into this server, that it's behind a NAT router.
whoooooooosaaaaaa!