Slashdot Mirror
Apple Releases 'Highly Critical' Patch
Toothpick writes "Apple Insider reports that a new security update is available for download from Apple. This addresses issues identified in sudo, Safari, and OpenSSL among others.
The gory details are, predictably, available on the Apple Info site." Commentary from ZDNet is also available.
"Highly critical"??
If you think about it, it's not really highly critical at all, mainly because the odds are that there will be no programs written that exploit these security flaws. If these were Windows flaws then yes, it would be critical as you could bet a virus would be written within the week that exploited them.
I bet you could leave your OSX system unpatched for years without ever really being at risk.
... oh, they did? Before there were any exploits in the wild?
Never mind.Information wants to be anthropomorphized.
Installed yesterday. No problems so far.
No. Mac OS X is based on BSD (mainly FreeBSD). It has nothing to do with RMS.
Well, it does use a version of gcc and their terminal app has bash as the default shell, so it's a little strong to say it has "nothing" to do with RMS.
Information wants to be anthropomorphized.
So called highly critical patch installed itself yesterday on my iBook.
:-)
For those of us who need it, Apple update takes care of it.
If there was an exploit that meant we should click on "Software Update" instead of waiting for it to cycle round, great but this is just Apple-bashing. Is this a microsofty going "look! other OS's have security updates too" while there are many many exploits in the wild for them?
Anyway it's a day late. This is "internet time", if you can remember that far back
- Paul
Really? I use bash as my shell on my FreeBSD box, and I compile programs with gcc. Then maybe I should call it GNU/FreeBSD?
I installed it yesterday, but decided to give Software Update a check anyway. for those of you with iPod shuffles, there's a new iPod updater with some bug fixes.
I don't even use the "GNU/" prefix when I'm talking about Linux, but credit where credit is due. Stallman and other GNU participants have made a crapload of really good tools which are used in almost every flavor of *nix these days, including OS X.
Information wants to be anthropomorphized.
That isn't responsible when the security updates are patches that users of non-proprietry OS's applied upto 1.5 months ago (OpenSSL).
All OS's are going to have their vulnerabilities. Without even looking at number and severity of them, look at the typical response. Apple finds what they also may consider "highly critical" issues (although relatively not), and they are all over it. Someone finds an issue in Linux, and coders all over the world are all over it. Microsoft finds a critical flaw (or more likely is told about it) and it's, "Bah, minor DDoS issue. Nothing to worry about." And we've recently seen how that ended up.
I'm not trying to be flamebait, but c'mon. How low can "Good enough" get?
Ignore anything I said above, I actually agree with everything you believe - mod accordingly.
Indeed, even the KHTML part of Safari is GPLed. So Apple owes a lot to GPL. On a lighter note it would be great fun to see Steve Jobs and Richard Stallman clash... such two dominant personalities... maybe one of them is made of anti-matter and if they touched they'd anihilate in a bright flash of light.
Apple includes the BSD userland utilities, and while it does include some GPL'd software it does not require any to run properly. However, I believe we should petition them to starting calling it the "Mach based Darwin/BSD/Mac OS X featuring OSS Software by GNU, Apache, Postfix, Samba, ect."
Hmmm.. I thought that the GNU part in GNU/Linux referred to the GNU tools and the Linux kernel, not to the GPL'ed kernel. But it's true, I never heared RMS make the same claims for .*BSD systems, although they also use the GNU tools unless I'm terribly mistaken.
"It's too bad that stupidity isn't painful." - Anton LaVey
n/t
nstalled yesterday. No problems so far
I installed updates on a 10.3.9 and a 10.4 machine and it appeared fine til I noticed I can't share files anymore between the two machines. Might be a configuration change though.
"I am the king of the Romans, and am superior to rules of grammar!"
-Sigismund, Holy Roman Emperor (1368-1437)
Apparently the Apple File Sharing had become unchecked after the patch and by rechecking it and rebooting both machines it resolved the issue (oddly enough it wouldn't resolve the issue til they were rebooted)
"I am the king of the Romans, and am superior to rules of grammar!"
-Sigismund, Holy Roman Emperor (1368-1437)
Ummmmmm... when did Apple change their domain to "get.sent.to" ? Don't support someone with clickthrough advertising, just go directly to http://www.apple.com/support/downloads/
I'm told that Jobs recently appeard on "Charlie Rose" with Bill Gates.
Word is, he was quietly smirking to himself when Rose asked Gates about Dell's recently-stated desire to offer OS X 10.4 on their systems.
Information wants to be anthropomorphized.
You don't understand the Windows vs. Professional OS sequence for vulnerabilities:
Professional OS:
-Vulnerability found by white hat security world
-OS Vendor informed
-OS Vendor works on patch that both fixes vulnerability and doesn't make things worse
-Vendor tests patch thoroughly
-Vendor releases patch; world as a whole, including script kiddies, first hear about vulnerability
-Users, trusting vendor's track record, install patch (see "doesn't make things worse" above)
-Any exploit is too little, too late.
Microsoft:
-Vulnerability found
-Microsoft informed
-Nature of vulnerability leaks out to world as a whole
-Microsoft shoves thumb up bum, waits 6 months
-Exploit released
-Microsoft shoves second thumb up bum, wonders about apparent discomfort
-Microsoft eventually releases patch, may or may not make things better or worse
-Frustrated people buy Macintoshes
Simple, isn't it?
Yeah, but Steve Jobs bathes, so he wins. :)
- oZ
// i am here.
OS X has bugs and security vulnerabilities???? No way!
Actually, I am a HUGE Apple fan. They are pretty timely with their updates. They don't let an exploit linger for long. Neither do most Linux distros.
I tend to wonder though, when it comes to MS Patching stuff like IE, does Microsoft delay because the fix breaks too manyu things? MS has said before that IE can't be fully standards compliant because it would break too many intranets.
Safari is crashing repeatedly, and reproducibly on a PB. I've been pumping Apple reports for two weeks on their crash catcher. Another iBook running Safari is unaffected, running a lower ver of MacOS X.
Take the update at face value, friends.
...Pobody's Nerfect
Nothing sucks like a Vax, nothing blows like a PowerMac G4
By the way, both sudo and OpenSSL are OpenBSD spin-offs and nothing at all to do with the GNU project.
I am TheRaven on Soylent News
http://www.securityfocus.com/news/11359
Look at the numbers. Whoever would have thought that the numbers for MS and Apple would have got this close? Complacency is their, and their users, greatest danger right now. You can see it in most of this thread. Time to wake up.GNU refers to the GNU OS, which when combined with Linux, makes GNU/Linux (GNU slash Linux, or GNU with Linux, as I prefer to say) - if GNU had just been a project to make userland tools, there would be no GNU prefix.
Join the Free Software Foundation
1) Securityfocus is owned by a company with a vested interest in selling anti-virus software to Mac (and PC) users. It does serve a useful purpose, but when the points made are so vague, I consider it more advertising than service.
Say I wanted to market X, and say that I'm a sneaky and underhand individual. I might purchase or support a website dedicated either to X or anti-X and have *some* articles on it that suit my purpose. I wouldn't undermine the integrity of the site (well, much), but I would use it as an authoratitive mouthpiece that mouthed off about *my* preferred direction.
So, ok I'm a cynic, but so far my cynicism has been proved right depressingly often. Sigh.
2) "Looking at the numbers" is no useful guide to pretty much anything to do with security. The phrase works when the numbers themselves are the pertinent facts (eg: a bank-balance sheet). "Humans are obviously not the dominant species on the planet - there are millions more houseflys. Look at the numbers".
The point is that one dose of cancer can kill you, but you may survive fifty or more infections of the common cold without significant harm. The numbers don't tell you the relative importance of the problem, and indeed may just reflect different counting methods or diligence in detection.
Simon.
Physicists get Hadrons!
My brother recently switched to Apple.. We were IM'ing about this update and he said..
"one thing i looove about this thing is that i'm never afraid to update like in windows. i'm not scared that it will be worse off"
Trust is important. How many people haven't updated Windows to SP2 still??
Everyone is entitled to his own opinions, but not his own facts.
I have to agree. I modded up several posts that were reasonable yet critical (or both Apple and open source). They're all labeled Troll or Flamebait now. The groupthink is out of control.
If you removed them then you would replace them with the BSD counterparts and have a perfectly usable system.
For that matter, I doubt you need them at all to run a stardard kde+firefox+thunderbird+minesweeper setup.
Pain lasts, kid. Its how you know you're alive. Sometimes I think this growing up thing is just pain management-TheMaxx
If you removed them and replaced them with BSD counterparts, you would not have a GNU/Linux system, you would have a BSD/Linux system. Similarly, you could remove the Linux kernel and replace it with a FreeBSD kernel built with Linux ABI support and probably not notice (you can even install Debian on a FreeBSD kernel instead of a Linux one). This doesn't mean that the system isn't Linux.
For that matter, I doubt you need them at all to run a stardard kde+firefox+thunderbird+minesweeper setup.
Well, let's look at the boot process, shall we. The kernel starts. Then it runs init. Init runs a load of shell scripts (ooops, you've just removed /bin/sh, provided by the GNU project). Never mind, init could execute binaries instead - well, as long as they are statically linked, since the standard Linux loader is GNU, and so you've just removed it. Never mind, still at least you can log in to your statically linked system. Well, you could if you hadn't just deleted your login program. Never mind, we can replace it with a statically linked copy of X - that's not GNU, at least. Oh, it seems X won't compile - you've just deleted GNU libc, and X won't run without it.
Sure, you could replace bash, glibc, top, ps, cat, chown, chmod, ls, ln, cp, mv, ld, ldd, getty, etc. with non-GNU counterparts, but until you do then you should accept the fact that a significant amount of essential GNU software exists in your 'Linux' OS and defines the visible behaviour a lot more than the Linux kernel does.
I am TheRaven on Soylent News
I think you need to remember your tags next time, otherwise everyone just takes your post at face value.
"She's furniture with a pulse"
Thanks, I have learned something today (karma well spent, I'd say :-P)
.*BSD, but now I realize they are but one of the alternatives. I was a bit misguided, I admit. I really should make the time/diskspace to install some .*BSD's and Darwin on a spare system, but "make time" keeps returning an error message ;-).
I knew that the GNU utils were running on
"It's too bad that stupidity isn't painful." - Anton LaVey
Internet Explorer can't be secured because it would require changing the API. I expected them to do that back in 1997, when it became obvious that backing out the tight integration between the desktop, the browser, and the ActiveX API was the only way to fix the real problem. Obviously I'm naive... having seven (no, eight now) years of spyware and viruses is preferable to abandoning their 'loophole' in the consent decree.
But if they're prepared to stonewall on deep security flaws, why do you expect them to pay attention to compliance with standards that they don't need to comply with because everyone has to support them anyway?
Microsoft: the latest security hole in the HTML control is a buffer overflow in Javascript. They've known about it for months. Nothing happens until a sample exploit is released.
Apple: the latest security hole in Webkit is a buffer overflow in URLs. The first anyone hears of it is a patch through Software Update.
-Frustrated people buy Macintoshes
Huh? Given Microsoft's security record this should mean that Apple's share of PC market is at least 70%...
“Wait for Hurd if you want something real” –Linus
Given Microsoft's security record this should mean that Apple's share of PC market is at least 70%...
If most people were as easily frustrated and as aware of why they should be frustrated and care about security as you and I are, it would be. But it's amazing how much crap people are willing to accept as a normal cost of using computers.
I find myself regularly watching people put up with horribly broken systems and, after I fix the problem (because I can't even stand watching someone suffer), they're shocked. They didn't even realise the problem was a problem that could be fixed, they just EXPECTED it.
And security?
After having a contractor who is technically very good, and has been working in this business longer than me, stand there and argue why he should be an exception to my "No Outlook" policy WHILE I'M CLEANING OUT HIS COMPUTER THAT WAS INFECTED THROUGH AN OUTLOOK HOLE... I reckon that there's some fundamental difference between "average computer users" (no matter how skilled) and people like myself myself that goes far beyond experience and training and into some kind of "Zen" thing... I don't know.
The WiFi support in OpenBSD is nicer, as is pretty much anything connected to networking, although FreeBSD is slowly importing most of the OpenBSD code (they've got pf - a really nice packet filter - and OpenBSD's dhcpd already). If you're looking for something to put on a firewall, OpenBSD is what you want - pf is so much better than any alternative I've seen (miles ahead of iptables, which was clearly designed by someone on LSD, both for flexibility and ease of use).
FreeBSD has some nicer features on a desktop. The new scheduler, SCHED_ULE, is great for interactive processes - a compile job using 100% of the CPU has no effect on the responsiveness of the desktop, it's almost like being on an SMP machine (you need to enable it in a custom kernel in 6.0 - the default one is throughput, not latency, optimised). FreeBSD also has nVidia support in the form of binary drivers and DRI drivers for many other cards, OpenBSD does not yet. FreeBSD also supports some Windows WiFi card drivers through Project Evil.
Both FreeBSD and NetBSD have a more modern init system (init scripts contain requires and provides lines, allowing them to be run in the right order with as much parallelism as possible), while OpenBSD uses the simpler BSD init system.
Which you prefer will be a matter of personal perference. Do make sure you read the documentation. All of the BSDs have good man pages (although OpenBSD is ahead here by quite a margin), and the FreeBSD Handbook is also very good.
I am TheRaven on Soylent News
Posts critical of open source ARE INHERENTLY flaimbait or troll posts.
Sorry, Micro$oft fanboi.
While comparing these things is difficult at best, try (for example) Secunia's relevant product pages:
Advisories (2003-2005) OSX 57 & XP Pro 102
As for vendor patches Apple is at 100%... not bad.
(XP Professional) http://secunia.com/product/22/
and...
(Mac OS X) http://secunia.com/product/96/
Is any system perfect... no (even OpenBSD admits to 1 hole in 8 years), but Apple does make it as painless as possible.
You just don't understand what they mean by critical. I installed this patch and it immediately started complaining about all the junk on my desktop. Then it started berating me for my lack of sensible folder organization. It criticized my choice of web browsers. I turned on iTunes to drown it out and it started giving me a hard time about my musical choices. By the time it started in on my clothes I was sick of it, so I uninstalled the patch. I'll take the data insecurity so as not to put up with the emotional insecurity, but YMMV.
The patch caused no issues for me on any of our four Macs. I'm pleased that (most of the time) Apple patches fairly fast and in high quality.
Now, if they can just make an iPod Nano that doesn't scratch because you breathe on it...
A Passionate Independent Musician
Mostly only apple people read apple.slashdot. We're already all patched up, days before this item came to print. There are no worm, trojans, virii, or etcetera. In short, this isn't news. If this were microsoft it would be news. Because it is Apple, this is not news. As it is only Apple people who read apple.slashdot this shouldn't be taken as a flame: This article on slashdot, and the time of oue lives we wasted reading this is evidence of our superiority. We are superior in our decision making process. We are superior in recognising quality. I would even hazard a guess that, due to the efficiency of our time spent on computers, we are better looking (more leisure time for sport, sunshine, and etcetera). In short - nothing to see here - feel good.
KHTML is LGPLed (the one RMS doesn't really like). If it had been GPLed, Apple wouldn't have touched it with a barge pole.
Thanks, I just salvaged a 40gig hdd, I'll give OpenBSD a try over the weekend..
(btw, Nice site you have.)
"It's too bad that stupidity isn't painful." - Anton LaVey
You know you can replace all of them (right down to init) with a static Busybox (built with uclib if you like) and till have a working system?
-Nature of vulnerability leaks out to world as a whole
Just curious...in your sequence, who leaks the vulnerability? Microsoft employees? Or white hats gone bad?
They already do
After having a contractor who is technically very good, and has been working in this business longer than me, stand there and argue why he should be an exception to my "No Outlook" policy WHILE I'M CLEANING OUT HIS COMPUTER THAT WAS INFECTED THROUGH AN OUTLOOK HOLE... I reckon that there's some fundamental difference between "average computer users" (no matter how skilled) and people like myself myself that goes far beyond experience and training and into some kind of "Zen" thing... I don't know.
There is nothing worse than a sysadmin who forgets his place. I personally prefer Thunderbird or Opera, but I understand from other people that it's not nearly enough for serious business users. Install the latest, fully patched version of Outlook, educate users, run virus filters on your mail server and let your users do their jobs while you do yours. In the worst case, you can setup that guy with a Mac Mini running Mail.app or Entourage.
What I like is that Apple is providing public credit for institutions that are pointing out these flaws. Kudos for Apple for this, and double kudos for the third-parties who are assisting the public as a whole.
#-#
Ad Astra Per Aspera
A rough road leads to the stars
There is nothing worse than a sysadmin who forgets his place.
I agree, more on that later...
I personally prefer Thunderbird or Opera, but I understand from other people that it's not nearly enough for serious business users.
I'm sorry, but "I understand from other people" doesn't cut it. Also, a system administrator's place is implementing and where appropriate guiding business policy, not simply doing what "I understand from other people" is the best solution.
I had to make a business case for this ban. I had to compare the features of Outlook with the alternatives, the costs, and convince my CEO that this was a good idea. I didn't just sit down and say "we're not going to use Outlook".
I got the ban approved and moved the few people using Outlook and the MANY people using Internet Explorer over to Netscape Mail, Eudora, and other applications. Shortly afterwards the first of the big email worms that exploited the active content hole hit. EVERY OTHER DIVISION OF THE COMPANY came to a standstill while they battled these worms, even the ones with clueful admins and excellent antivirus policies. All we saw was an increase in junk mail from the infected messages, particularly from other parts of the company.
These events were repeated over and over again. I implemented tools on our own webserver to fill in the gaps, and we just crusied along virus-free until the Head System Administrator forcibly integrated the networks and put us in the same mail and security domain... against the wishes of our division's CEO. That week the company got hit with another worm and that was the first time in six years that we had to stop everything and deal with a network meltdown. And that experience has been repeated over and over again.
Oh, and my users begged me to find a way to let them keep using Thunderbird, Mozilla, Eudora, or even "elm" instead of putting up with the centralized virus-checked super-functional "I understand from other people" is the leading corporate mail system. Because they much preferred something that worked to all the bells and whistles.
So don't get on my case about the place of a system administrator, bucko. The place of a system administrator is to make his users effective and the network and computer environment as transparent as possible. That doesn't necessarily mean letting them do whatever they want to, and "I understand from other people" isn't going to convince me... but you're welcome to talk to my boss about it.
Because you're not important enough... yet
If there was an exploit that meant we should click on "Software Update" instead of waiting for it to cycle round, great but this is just Apple-bashing. Is this a microsofty going "look! other OS's have security updates too" while there are many many exploits in the wild for them?
Save that corporate brand wars stuff for someone who cares.
This is about security. People need to be informed; it's how disasters are prevented.
And FYI: not everyone has Software Update turned on. Know why? Because even Apple has been known to issue patches that break things.
I guess it sucks to be you. We have a virus/suspicious attachment filter on the server, Norton Antivirus on standard base image and latest Windows updates. However, 99% of users use Outlook. Outlook Express or IE. Very occasionally, a bugger sneaks in and pollutes a corporate mailing list with a couple of junk messages, but it's not a problem that in any way affects our productivity.
If you are a system administrator, your e-mail/calendar/web access needs are drastically different from your users, so "understand from other people" is a necessity. You are doing a horrible job if 95% of users are happy and virus free, but 5% can not get their work done because they are unable to access an IE-only website or don't have access to a distributed calendar, to do lists and other collaboration tools. Those people have some function in the company and could very well bring it to standstill. If you want, install Firefox and Thunderbird by default, make IE and Outlook available for people who need the features and prepare countermeasures to deal with worms.
You are doing a horrible job if 95% of users are happy and virus free, but 5% can not get their work done because they are unable to access an IE-only website or don't have access to a distributed calendar, to do lists and other collaboration tools.
I'm sorry, but it's just not true that 5% or 1% or any% of users actually need Outlook more than everyone else, and you can just give Outlook to those and keep everyone else on whatever mail interface they want. To make these things useful you need everyone to be using them. For example, a distributed calendar that only 5% of the people used would be pointless. The calendar that I implemented in scripts works for 100% of the users on any browser, and scales up very nicely thank you. The same is true of the other web-based tools I implemented or purchased. It's only old-school legacy software like Exchange that forces you to use mail as the transport and interface for web services, because they evolved from software designed for primitive networks that pretty much only did email.
Anyway, it sounds like you're arguing that I should force the 95% of the people who don't want Outlook to put up with it instead of the mail software of their choice, for the sake of some tiny subset of that 5% who are somehow magically incapable of using a web browser for calendering. How is THAT more responsive to user's needs?
And there certainly aren't 5% of websites that require IE. And despite actively seeking out users and polling them for sites they have trouble with I've found precisely zero business-related sites outside the New Corporate Intranet that require it. Virtually all the IE-only sites are games or movie traler/video clip sites, and if your users have a business related reason to play Luminous or Diamond Drop or whatever I want to work there.
For example, a distributed calendar that only 5% of the people used would be pointless. The calendar that I implemented in scripts works for 100% of the users on any browser, and scales up very nicely thank you.
I am glad that your PHP calendar works so well on PDAs, cell phones and notebooks without network connectivity. But other companies where executives do travel and make appointments on the go might ask non-Outlook users to use web interface for calendar. I assume you know that Exchange is not the only choice of server here.
And there certainly aren't 5% of websites that require IE.
MSDN, Windows Update, American Express... In addition, how does your company get customers outside slashdot if your own web designers are not testing their stuff with IE?
Is apple normally slow with updates?
The SUDO flaw was discovered in June 2005 and a patch was released subsequently after...
So 6 months later, Apple decicdes to update their OS? WTF!?!?!
http://www.securityfocus.com/archive/1/402741
There are roughly forty zillion applications for loading appointments into Palm Desktop, and we use those. Notebooks without network connectivity are pretty much useless for so many other reasons that it doesn't much matter that they need it for appointments.
MSDN and Windows Update are special cases, and you know that... and Windows Update runs the HTML control for its access even if you pick another default browser, so that's a non-issue.
In addition, how does your company get customers outside slashdot if your own web designers are not testing their stuff with IE?
Man, every damn message you've posted is full of all kinds of bad assumptions.
I'm in the real-time control systems business. Bugs in our software can kill people quicker than you can say "high voltage". Our customer's systems, you should be glad to know, don't even have internet access by policy, and are not only behind the corporate firewall they have their own firewall protecting them from the untrusted corporate network, and even then they're careful what protocols they run between systems.
Seriously - look at the detailed description, follow the links to the CVE entries. These are old, old vulnerabilities. I think the oldest one in there is about five or six months old.
I love Apple's products, I use Macs myself, but they really have to get their act together on security patching.
And there have been proof of concept exploits for some of these vulnerabilities published quite a while ago.
What is the robbing of a bank, compared to the founding of a bank? -- Bertolt Brecht