Slashdot Mirror
Apple Releases 'Highly Critical' Patch
Toothpick writes "Apple Insider reports that a new security update is available for download from Apple. This addresses issues identified in sudo, Safari, and OpenSSL among others.
The gory details are, predictably, available on the Apple Info site." Commentary from ZDNet is also available.
"Highly critical"??
If you think about it, it's not really highly critical at all, mainly because the odds are that there will be no programs written that exploit these security flaws. If these were Windows flaws then yes, it would be critical as you could bet a virus would be written within the week that exploited them.
I bet you could leave your OSX system unpatched for years without ever really being at risk.
... oh, they did? Before there were any exploits in the wild?
Never mind.Information wants to be anthropomorphized.
Installed yesterday. No problems so far.
http://get.sent.to/apple_security_updates
Some Apple's security updates are available for older releases of Mac OS X such as Panther and Jaguar as well.
http://tinyurl.com/4ny52
Shouldn't that become GNU/Apple? You could have fooled me it was a security report for some GNU/Linux distro.. Well, except for the Safari part..
Time to ask RMS about his opinion on this..
"It's too bad that stupidity isn't painful." - Anton LaVey
So called highly critical patch installed itself yesterday on my iBook.
:-)
For those of us who need it, Apple update takes care of it.
If there was an exploit that meant we should click on "Software Update" instead of waiting for it to cycle round, great but this is just Apple-bashing. Is this a microsofty going "look! other OS's have security updates too" while there are many many exploits in the wild for them?
Anyway it's a day late. This is "internet time", if you can remember that far back
- Paul
I installed it yesterday, but decided to give Software Update a check anyway. for those of you with iPod shuffles, there's a new iPod updater with some bug fixes.
That isn't responsible when the security updates are patches that users of non-proprietry OS's applied upto 1.5 months ago (OpenSSL).
All OS's are going to have their vulnerabilities. Without even looking at number and severity of them, look at the typical response. Apple finds what they also may consider "highly critical" issues (although relatively not), and they are all over it. Someone finds an issue in Linux, and coders all over the world are all over it. Microsoft finds a critical flaw (or more likely is told about it) and it's, "Bah, minor DDoS issue. Nothing to worry about." And we've recently seen how that ended up.
I'm not trying to be flamebait, but c'mon. How low can "Good enough" get?
Ignore anything I said above, I actually agree with everything you believe - mod accordingly.
n/t
nstalled yesterday. No problems so far
I installed updates on a 10.3.9 and a 10.4 machine and it appeared fine til I noticed I can't share files anymore between the two machines. Might be a configuration change though.
"I am the king of the Romans, and am superior to rules of grammar!"
-Sigismund, Holy Roman Emperor (1368-1437)
Huh? What the fuck are you talking about? Highly critical? Why didn't my highly vulnerable mac get attacked for the last five years?
"I tend to think of OS X as Linux with QA and Taste", James Gosling, creator of Java
Apparently the Apple File Sharing had become unchecked after the patch and by rechecking it and rebooting both machines it resolved the issue (oddly enough it wouldn't resolve the issue til they were rebooted)
"I am the king of the Romans, and am superior to rules of grammar!"
-Sigismund, Holy Roman Emperor (1368-1437)
OS X has bugs and security vulnerabilities???? No way!
Actually, I am a HUGE Apple fan. They are pretty timely with their updates. They don't let an exploit linger for long. Neither do most Linux distros.
I tend to wonder though, when it comes to MS Patching stuff like IE, does Microsoft delay because the fix breaks too manyu things? MS has said before that IE can't be fully standards compliant because it would break too many intranets.
Safari is crashing repeatedly, and reproducibly on a PB. I've been pumping Apple reports for two weeks on their crash catcher. Another iBook running Safari is unaffected, running a lower ver of MacOS X.
Take the update at face value, friends.
...Pobody's Nerfect
Nothing sucks like a Vax, nothing blows like a PowerMac G4
http://www.securityfocus.com/news/11359
Look at the numbers. Whoever would have thought that the numbers for MS and Apple would have got this close? Complacency is their, and their users, greatest danger right now. You can see it in most of this thread. Time to wake up.Damn, are you really such a thin-skinned fanboy that any criticism of Apple inherently reflects on your penis size? I've been a Mac evangelist for the past 17 years (and a ][ user before that) but when they screw up I call them on it.
1) Securityfocus is owned by a company with a vested interest in selling anti-virus software to Mac (and PC) users. It does serve a useful purpose, but when the points made are so vague, I consider it more advertising than service.
Say I wanted to market X, and say that I'm a sneaky and underhand individual. I might purchase or support a website dedicated either to X or anti-X and have *some* articles on it that suit my purpose. I wouldn't undermine the integrity of the site (well, much), but I would use it as an authoratitive mouthpiece that mouthed off about *my* preferred direction.
So, ok I'm a cynic, but so far my cynicism has been proved right depressingly often. Sigh.
2) "Looking at the numbers" is no useful guide to pretty much anything to do with security. The phrase works when the numbers themselves are the pertinent facts (eg: a bank-balance sheet). "Humans are obviously not the dominant species on the planet - there are millions more houseflys. Look at the numbers".
The point is that one dose of cancer can kill you, but you may survive fifty or more infections of the common cold without significant harm. The numbers don't tell you the relative importance of the problem, and indeed may just reflect different counting methods or diligence in detection.
Simon.
Physicists get Hadrons!
My brother recently switched to Apple.. We were IM'ing about this update and he said..
"one thing i looove about this thing is that i'm never afraid to update like in windows. i'm not scared that it will be worse off"
Trust is important. How many people haven't updated Windows to SP2 still??
Everyone is entitled to his own opinions, but not his own facts.
I think you need to remember your tags next time, otherwise everyone just takes your post at face value.
"She's furniture with a pulse"
Internet Explorer can't be secured because it would require changing the API. I expected them to do that back in 1997, when it became obvious that backing out the tight integration between the desktop, the browser, and the ActiveX API was the only way to fix the real problem. Obviously I'm naive... having seven (no, eight now) years of spyware and viruses is preferable to abandoning their 'loophole' in the consent decree.
But if they're prepared to stonewall on deep security flaws, why do you expect them to pay attention to compliance with standards that they don't need to comply with because everyone has to support them anyway?
Microsoft: the latest security hole in the HTML control is a buffer overflow in Javascript. They've known about it for months. Nothing happens until a sample exploit is released.
Apple: the latest security hole in Webkit is a buffer overflow in URLs. The first anyone hears of it is a patch through Software Update.
While comparing these things is difficult at best, try (for example) Secunia's relevant product pages:
Advisories (2003-2005) OSX 57 & XP Pro 102
As for vendor patches Apple is at 100%... not bad.
(XP Professional) http://secunia.com/product/22/
and...
(Mac OS X) http://secunia.com/product/96/
Is any system perfect... no (even OpenBSD admits to 1 hole in 8 years), but Apple does make it as painless as possible.
You just don't understand what they mean by critical. I installed this patch and it immediately started complaining about all the junk on my desktop. Then it started berating me for my lack of sensible folder organization. It criticized my choice of web browsers. I turned on iTunes to drown it out and it started giving me a hard time about my musical choices. By the time it started in on my clothes I was sick of it, so I uninstalled the patch. I'll take the data insecurity so as not to put up with the emotional insecurity, but YMMV.
The patch caused no issues for me on any of our four Macs. I'm pleased that (most of the time) Apple patches fairly fast and in high quality.
Now, if they can just make an iPod Nano that doesn't scratch because you breathe on it...
A Passionate Independent Musician
Mostly only apple people read apple.slashdot. We're already all patched up, days before this item came to print. There are no worm, trojans, virii, or etcetera. In short, this isn't news. If this were microsoft it would be news. Because it is Apple, this is not news. As it is only Apple people who read apple.slashdot this shouldn't be taken as a flame: This article on slashdot, and the time of oue lives we wasted reading this is evidence of our superiority. We are superior in our decision making process. We are superior in recognising quality. I would even hazard a guess that, due to the efficiency of our time spent on computers, we are better looking (more leisure time for sport, sunshine, and etcetera). In short - nothing to see here - feel good.
What I like is that Apple is providing public credit for institutions that are pointing out these flaws. Kudos for Apple for this, and double kudos for the third-parties who are assisting the public as a whole.
#-#
Ad Astra Per Aspera
A rough road leads to the stars
If there was an exploit that meant we should click on "Software Update" instead of waiting for it to cycle round, great but this is just Apple-bashing. Is this a microsofty going "look! other OS's have security updates too" while there are many many exploits in the wild for them?
Save that corporate brand wars stuff for someone who cares.
This is about security. People need to be informed; it's how disasters are prevented.
And FYI: not everyone has Software Update turned on. Know why? Because even Apple has been known to issue patches that break things.
Is apple normally slow with updates?
The SUDO flaw was discovered in June 2005 and a patch was released subsequently after...
So 6 months later, Apple decicdes to update their OS? WTF!?!?!
http://www.securityfocus.com/archive/1/402741
Seriously - look at the detailed description, follow the links to the CVE entries. These are old, old vulnerabilities. I think the oldest one in there is about five or six months old.
I love Apple's products, I use Macs myself, but they really have to get their act together on security patching.
And there have been proof of concept exploits for some of these vulnerabilities published quite a while ago.
What is the robbing of a bank, compared to the founding of a bank? -- Bertolt Brecht