Slashdot Mirror
Apple Releases Mac OS X 10.3.9 Update
OmniVector writes "Right after the Mac OS X 10.4 Tiger announcement just a few days ago, Apple has released an update to version 10.3.9 for Mac OS X and Mac OS X Server (both available via Software Update). The changes mostly include bugfixes with Stickies, Safari, and the Finder." The Server update also addresses issues with Open Directory, cyrus, AFP, and SMB, among others. Apple also updated iMovie, iPhoto, iDVD, and iSight this week.
Now my Mac doesn't lock up when I choose the "Restart..."/"Shut Down..." and then sleep the screen during the optional 2-minute wait period.
-- Boycott Shell
wow i'm a dumbass, and completely left out something really important! Safari 1.3 came out with this update. and consequently seems to have caused problems with some of my Adium themes and Colloquy no longer even renders. Also, one of my Safari plugins caused safari to crash on launch. (AcidSearch it appears).
lastly, folks, beware of the warning on apple's front page with this update if you're running mac os x server! You must have an administrator account password that does not contain spaces or Option-keyed characters to install this update.
- tristan
I've been bug reporting and complaining about the SSL performance in Safari for almost two years. Folks here and on other Mac forums have dismissed me as some type of loon (they are more right than I'd like to admit most of the time). Apple finally does something about it (though, we'll see if it really helps...I'm installing it now).
It's nice to be right...
Mind the gap...
It seems as if this update fixed the sensitivity problems with my PowerBook trackpad. I have a 1.67Ghz PB with the new trackpad that supports the vertical/horizontal scrolling stuff and it has always been far less sensitive than my old PB -- until I rebooted after this update. Cool!
Although the Safari upgrade re-added Apple, Amazon, eBay, etc. links to my bookmark bar. That was sort of annoying, but easy enough to fix.
Hexy - a strategy game for iPhone/iPod Touch
The last update to 10.2 made it far slower and buggier, and in my somewhat paranoid mind they 'broke' 10.2 so one would be more motivated to buy 10.3.
Does this update break 10.3 so I will be encouraged to get 10.4?
Everything feels peppier and more responsive! Doesn't take 15 minutes to copy a 20MB file anymore either.
;)
Haven't even run the update yet either.
Karma: Chameleon (mostly due to the fact that you come and go).
There are definitely some bugfixes for stickies and the like. But there are also some important security fixes in the bag. That is a lot of CAN entries for a update that is "mostly bugfixes."
For whatever reason apple felt icky about calling it an "update," so they threw in this language:
"Note: It is Apple's standard practice to provide security fixes via a Security Update. On occasion, when a security fix is required to a core system component such as the Kernel, it will be released in a Software Update."
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2005-04-15 Mac OS X v10.3.9
Mac OS X v10.3.9 and Mac OS X Server v10.3.9 are now available and deliver the following security enhancements:
Kernel
CVE ID: CAN-2005-0969
Impact: A kernel input validation issue can lead to a local denial of service
Description: The Kernel contains syscall emulation functionality that was never used in Mac OS X. Insufficient validation of an input parameter list could result in a heap overflow and a local denial of service through a kernel panic. The issue is addressed by removing the syscall emulation functionality. Credit to Dino Dai Zovi for reporting this issue.
Kernel
CVE ID: CAN-2005-0970
Impact: Permitting SUID/SGID scripts to be installed could lead to privilege escalation. Description: Mac OS X inherited the ability to run SUID/SGID scripts from FreeBSD. Apple does not distribute any SUID/SGID scripts, but the system would allow them to be installed or created. This update removes the ability of Mac OS X to run SUID/SGID scripts. Credit to Bruce Murphy of rattus.net and Justin Walker for reporting this issue.
Kernel
CVE ID: CAN-2005-0971
CERT: VU#212190
Impact: A Kernel stack overflow in the semop() system call could lead to a local privilege escalation.
Description: The incorrect handling of system call arguments could be used to obtain elevated privileges. This update includes a fix to check access to the kernel object.
Kernel
CVE ID: CAN-2005-0972
CERT: VU#185702
Impact: An integer overflow in the searchfs() system call could allow an unprivileged local user to execute arbitrary code with elevated privileges
Description: The searchfs() system call contains an integer overflow vulnerability that could allow an unprivileged local user to execute arbitrary code with elevated privileges. This update adds input validation on the parameters passed to searchfs() to correct the issue.
Kernel
CVE ID: CAN-2005-0973
Impact: Local system users can cause a system resource starvation
Description: A vulnerability in the handling of values passed to the setsockopt() call could allow unprivileged local users to exhaust available memory. Credit to Robert Stump for reporting this issue.
Kernel
CVE ID: CAN-2005-0974
CERT: VU#713614
Impact: Local system users can cause a local denial of service
Description: A vulnerability in the nfs_mount() call due to insufficient checks on input values could allow unprivileged local users to create a denial of service via a kernel panic.
Kernel
CVE ID: CAN-2005-0975
Impact: Local system users can cause a temporary interruption of system operation
Description: A vulnerability in the parsing of certain executable files could allow unprivileged local users to temporarily suspend system operations. Credit to Neil Archibald for reporting this issue.
Safari
CVE ID: CAN-2005-0976
Impact: Remote sites could cause html and javascript to run in the local domain.
Description: This update closes a vulnerability that allowed remote websites to load javascript to execute in the local domain. Credit to David Remahl for reporting this issue.
Note: It is Apple's standard practice to provide security fixes via a Security Update. On occasion, when a security fix is required to a core system component such as the Kernel, it will be released in a Software Update.
Mac OS X v10.3.9 and Mac OS X Server v10.3.9 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site:
Douglas Calvert
...installed fine on both the single proc. G5 at work and the dual G5 I have at home. Subjectively, it feels faster in the Finder, as well as Safari.
Bring on Tiger!
The PC Weenies: 11 Years of Online Tech 'Too
Installed it tonight on my 15" PowerBook (1.5 GHz), and all is fine. PithHelmet is disabled by the long-awaited Safari 1.3 update, for those of you who count on it, but the developer's site says he's already finishing up a fix for it. It's nice to finally see 1.3, even if it's only a couple more weeks until Tiger and 2.0.
I haven't really noticed any other changes so far - my mileage hasn't magically improved, it's not Snappier (tm), and I haven't gotten a whiter, brighter smile from it. But it's good to see that they've gotten Panther into a fairly solid state, since this will probably be the final release other than security patches from here on in with this codebase.
-- Josh Turiel
"2. Do not eat iPod Shuffle."
Does anyone have a problem with the trackpad in Firefox? On my girlfriend's 12" Powerbook, Firefox goes "Back" when trying to use the trackpad to scroll (no keys pressed).
Hey has anyone else found that java apps stop working. I can't get Eclipse or FurtherNET to start.
Are any of you getting a segfault when running java from the Terminal?
Anyone have this problem and found a fix? I'm out of ideas.
If you use AcidSearch, you'll find that Safari segfaults on startup. You can get Safari back by removing /Library/Application Support/SIMBL/Plugins/AcidSearch.bundle. AcidSearch is cool; I hope they update soon.
The light sensor in my Powerbook isn't going nuts changing my screen brightness anymore. Maybe this issue has been fixed too. I'm not in fluorescent lighting to give it a good test though.
Um, wierd. I just installed 10.3.9 on my 1.67GHz PB, and now in the finder under the network browser it shows:
...all of which appear to be empty, instead of the regular:
Applications
Library
Users
Local
Servers
WORKGROUP
Anyone know how to get the network browsing back to normal?
Yeah, thanks. I just updated to 10.3.8 this morning and there's already a new update.
:-)
Guess I'll have to cheer for the bugfixes
The hip way to get your IP. No ads, ever.
If you can't wait for the developer's fix, you can patch the Info.plist file so it will load in the new Safari.
I nfo.plist" change the MaxBundleVersion from "146" to "312"
In the file "/Library/Application Support/SIMBL/Plugins/PithHelmet.bundle/Contents/
It seems to load and work without any problems for me
When in doubt, have a man come through a door with a gun in his hand.
Good call. Rebooting a second time after the update fixed it. Apparently there's still some bugs left in Panther :)
Safari is FAST, it's like Christmas in um, April.
1.3 17 PB.
Just the standard bookmarks, don't know why
Download and reinstall Security Update-002
I was credited with discovery of the Safari flaw.
Due to lacking communications, Apple did not notify me in advance that the issue was addressed in 10.3.9, and failed to link to my independent advisory on the issue. Hopefully they will rectify that on Monday.
My advisory for CAN-2005-0976 is called DR001 and is available on my web site at remahl.se/david/vuln/001/. It has also been posted to bugtraq.
nt
Not about the update itself, but what it implies about webcore.
Safari
Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9
CVE ID: CAN-2005-0976
Impact: Remote sites could cause html and javascript to run in the local domain.
Description: This update closes a vulnerability that allowed remote websites to load javascript to execute in the local domain. Credit to David Remahl for reporting this issue.
"local domain" sounds a lot like Microsoft's "local security zone". I had assumed that Apple would be smarter than Microsoft here, and rather than copying their dangerous idea of treating webpages differently depending on where they were loaded from it would use some irrevocable and inheritable rights control established by the application... and this there would be no code path available to a webpage loaded from Safari to do anything dangerous... no matter where the page was loaded from.
If that's not the case... Apple, before going any further down this path, please reconsider.
Safari 1.3 seems considerably faster to me in terms of page scrolling on my 1.42ghz mac mini.
Just installed 10.3.9. Opened up eclipse no problems.
Weird.
-- The doctor said I wouldn't get so many nose bleeds if I just kept my finger out of there!
Kernel
CVE ID: CAN-2005-0970
Impact: Permitting SUID/SGID scripts to be installed could lead to privilege escalation. Description: Mac OS X inherited the ability to run SUID/SGID scripts from FreeBSD. Apple does not distribute any SUID/SGID scripts, but the system would allow them to be installed or created. This update removes the ability of Mac OS X to run SUID/SGID scripts. Credit to Bruce Murphy of rattus.net and Justin Walker for reporting this issue.
Isn't the ability to run SUID/SGID scripts or apps a fundemental part of Unix. Yes it can be used for naughty things. But that is the responsibility of the end user not Apple.
Why are Apple taking a Nanny State stance about what can be permitted or not ? It's none of their business what scripts I run on my machine.
All this leaves me with a bad taste in the mouth when it comes to OS X and security updates where they seem to be taking a too trigger happy approach to appear as though they are 'on top of the problem' to the computing media etc. Yet notoriously Apple's security updates often break basic functionality for many users.
While many would argue that MS are often perceived to be behind on security issues, I think I understand their mentality now which seems to more about giving the end user choice.
Apple, since OS X have become something more like a high street bank in their attitude towards end users. Cold, silent and we simply don't give a shit about you and will dictate the terms on which you use our operating system. (which ironically is in large part something they didn't even write)
That's my feeling about the security updates rolled into 10.3.9
On 10.3.9 itself, perhaps unsuprisingly Apple have yet again annouced features they have fixed in the update which were already working. Several times they have done this now. Again much like a big high street bank, one department doesn't know what the other department is doing and the customer is left confused.
I guess I don't use Stickies enough. But it seems like a very simple application.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
This update was going to fix firewire audio issues. With an M-Audio Firewire 410, Audacity no longer causes a kernel panic, it just doesn't work. :-/ At least you don't have to power off the computer now when you try it.
"The changes mostly include bugfixes with Stickies, Safari, and the Finder." The Server update also addresses issues with Open Directory, cyrus, AFP, and SMB, among others. Apple also updated iMovie, iPhoto, iDVD, and iSight this week."
Gee, where are the flames about "having to update all the time because of bugs"? (and quite a few are security related, hah-ha-a) It obviously happens often enough to put a "Software Updates" link somewhere in the OS.
If I really am talking out of my ass...explain it to me with respect so I'll at least pull my ears out to listen.
Where did you get this information? Perhaps you are running and older version than 10.3.8? Or maybe the readme that comes with the update is incomplete? The update from 10.3.8 to 10.3.9 does not mention any security updates.
Currently hooked on AMP
The new display drivers and energy saver settings made for some trouble on Beige G3s, especially Beige G3 DTs.
Turning off display sleep and swapping the display drivers with a previous version via Pacifist did the trick to "fix" it, but for those who didn't want to bother with all that just stuck with 10.2.6.
Up, Up, Down, Down, Left, Right, Left, Right, B, A, START
I'm sure this is too quick for that, and we know what happened the last time apple added something at the last minute for 10.2.8, but has apple said anything at all about the 10 year old bug ? P
-- My dog can beat up your dog.
thats the email that Apple sent out today. Subject was "APPLE-SA-2005-04-15 Mac OS X v10.3.9"
n nounce/
you can subscribe to this mailinglist here: http://lists.apple.com/mailman/options/security-a
The information can also be found on the web: KB 301327.
It is quite unfortunate that Apple "forgot" to mention the new security vulnerabilities that the update addresses in the short blurb. It does mention "previous stand-alone security updates", but not the new ones.
Beats having to open up a terminal, typing apt-get, then praying that the updated items will not break the dependencies of your current applications and system tweaks.
Also beats opening up an insecure Web browser, visiting Windows Update, being shown a list of updates with vague descriptons, and getting your machine updated without being asked for an Administrator's password.
I got it from Apple's Security mailing list, it is also available on the security website. Where else?
3 01 327
http://docs.info.apple.com/article.html?artnum=
I wish I was wrong about this but it seems apple tried to pull a fast one on this. It really would have been nice if apple released these security updates separately from the OS upgrade like they said they did. But I can not find these updates anywhere else...
Douglas Calvert
I always wished Safari's download manager would list the transfer rate in addition to the file size and estimated time remaining.
And lo and behold, after installing 10.3.9 it does! Way to go, Apple!
Duct tape is like the Force. It has a light side, a dark side, and it holds the universe together.
After the last update, it might pay to let this one sit a few days!
Drag n' Drop DVD Recommendations
Now if I'm typing something online, and hit Command+Shift+Left/Right, it will actually select everything from where I am to the beginning of the line, just like it does in TextEdit and most other apps.
I like it a lot more than when I would hit it and it would switch tabs, even though I was typing something in a text box.
Does anyone here use securemote VPN ? it used to work with 10.3.8, rebooting in 10.3.9, securemote says it can't start :(
I just installed the update and the first thing I noticed was that the tooltips in Google maps no longer render correctly. Anyone know how I can fix this or revert to the older safari version?
Not that this will affect many people but for some reason in the past when I would surf to my school's WebCT page Safari would beachball right after I logged in. This seems to be fixed with the new update. Good job!
WTF APPLE? Did I ask you to put extra shit in my bookmark bar???? NO!!! Apple, the next Netscape?
+ Undo in text fields! + improved pop-up window blocking + faster, especially on https connection + command-shift-arrow works properly now + improved javascript compatibility All around, a great release for this browser. I was on the cusp of switching to Firefox, but undo and spelling checking in the web form text areas are the dog's bollocks!
Yeah, I just noticed undo in text fields. That alone is worth the entire update, as anyone on Slashdot who uses Safari and has lost an entire comment or journal entry because they selected all and then hit 'c' instead of cmd-'c' can attest.
well after my update to 10.3.9, the image of my external hard drive no longer appears in my finder, can't get files off it, can't play my music which is on it, can't do anything about it.*bugger*
Wow. I guess my little play on words there flew over some heads.
Shitram Brown, PhD
Professor of Mathematics
I don't use .Mac, and did not know that not having it bookmarked was a bug.
This reminds me of my other Safari pet peeve. When I type a URL into the address bar, Safari "helpfully" tries to fill in my URL with sites that I don't even have bookmarked and have never visited as I type. How much do you think those companies paid for that placement?
San Francisco Photographers
When I right-click an image in Safari, I am no longer able to specify which folder I want to save it to. The only option is "Save to Safari Downloads".
This does streamline things... but I think I miss the customization options that a save dialog provides.
Long live the apple forums, there's a fix for this problem.
5 awFHYat.2@.68ac466a/15
http://discussions.info.apple.com/webx?14@472.eTM