Slashdot Mirror
Security Update 2004-09-07
sizemoresr writes "Security Update 2004-09-07 delivers a number of security enhancements and is recommended for all users of Mac OS X 10.2.8 and later. This update includes the following components: CoreFoundation, IPSec, Kerberos, libpcap, lukemftpd, NetworkConfig, OpenLDAP, OpenSSH, PPPDialer, rsync, Safari and tcpdump."
Downloaded.. .
Installed.
Optimized...............
Restarted.
Checked email.
Posted comment.
(dual 1.8 G5)
...s that the update is provided for two Panther releases, 10.3.5 AND for 10.3.4.
From apple's Security Announce list:
Given the relatively recent release of the Mac OS X v10.3.5 Software
Update, this security update is available for both Mac OS X v10.3.4
and Mac OS X v10.3.5. Customers who are still evaluating Mac OS X
v10.3.5 for large-scale deployment can apply the security update for
Mac OS X v10.3.4 to increase the security of their systems during the
evaluation period. After updating to Mac OS X v10.3.5, Security
Update 2004-09-07 should be installed onto Mac OS X v10.3.5 even if it
was previously installed on a Mac OS X v10.3.4 system.
From memory some of the other security updates could be put on before the release they came with, but I wouldn't trust just my memory as far as I could throw it. Anyway, it's specifically noted this time.
Thought you logged out of your super secret intranet page - no you didnt...
Just go ahead and update and try FedEx.com or DirectTV.com
You may just want to wait a bit
Keep on Folding! Team MaC OS X rocks! Join Us!
This update apparently "secures" the FTP daemon in quite an original way, by rendering it completely inoperable.
There are a few reports about it on Apple's discussions site.
The workaround suggested in the above link is to revert to the original ftpd supplied with Panther/Jaguar using the OS X install discs and a tool like Pacifist - though I'm trying to look at the glass as half-full and use this as the kick in the pants I need to start using sftp instead..
I use the rsync available here because it includes support for HFS+ volumes, meaning it will preserve resource forks. It installs to /usr/local/bin so it doesn't overwrite the existing rsync at /usr/bin. You need to have it installed on all OS X machines that you are syncing between.
To rsync data that includes files with resource forks from a remote server to a local server via ssh, use something like this:
<user>@<remoteserver>:<path> <localpath>
The --eahfs switch is what tells it to preserve resource forks.
sig != null
Most of the problems I've encountered are with Safari. The following sites all have similar problems and are entirely unusable with Safari after applying the patch:
7 98 :
http://www.fedex.com/
http://www.compusa.com/
http://www.bestbuy.com/
I'm sure there are many others. G5 systems do not appear to be affected. G4s are.
As noted on http://docs.info.apple.com/article.html?artnum=61
Component: Safari
CVE-ID: CAN-2004-0361
Available for: Mac OS X 10.2.8, Mac OS X Server 10.2.8
Impact: A JavaScript array of negative size can cause Safari to access out of bounds memory resulting in an application crash.
Description: Storing objects into a JavaScript array allocated with negative size can overwrite memory. Safari now stops processing JavaScript programs if an array allocation fails.
This security enhancement was previously made available in Safari 1.0.3, and is being applied inside the Mac OS X 10.2.8 operating system as an extra layer of protection for customers who have not installed that version of Safari. This is a specific fix for Mac OS X 10.2.8 and the issue does not exist in Mac OS X 10.3 or later systems.
----
This particular fix is specific to 10.2.8 and NOT 10.3 or later, yet appears it may install with the 10.3.x update. This could well be the cause of the problems. This is further supported by the fact that all of the known sites that fail to render properly use JavaScript 1.2 extensively.
Word is the Safari team is aware of the problem and working on it.
I couldn't find anything so far about the swap file password reveal being fixed or not.
That's a serious issue that I expected to be fixed soon.
If he explores all forms and substances Straight homeward to their symbol-essences; He shall not die.
The latest Security Update has (predictably) broken my rsyncX install. I was able to fix this by overwriting /usr/bin/rsync (Apple's rsync) with /usr/local/bin/rsync (which is where rsyncX installs by default). However, be sure to RTF-security information first the version of rsync that rsyncX uses (2.6.0) is not secure in daemon mode (use SSH mode instead).
At our school, we don't earn a degree when we graduate—we earn pi/180 radians
Looks like that Safari is not correctly rendering some sites that use OpenCube's Visual QuickMenu http://www.opencube.com/
Other sites that aren't rendering correctly:
http://www.subaru.com/
http://www.memcorpinc.com/
http://osx.hyperjeff.net
Good catch Jeff!!
Ahh, at least the culprit is named and shamed!
Someone is WRONG on the Internet!
go to a terminal prompt and type
/etc /usr/etc
/usr/etc instead /etc for it's config.
sudo ln -s
As someone pointed out above, Apple mucked up the ftpd compile and made the ftp daemon look in