Slashdot Mirror
Apple Patches Wireless Drivers
Frank writes "Apple quietly released a pair of patches today to its wireless drivers. The patches (one for PowerPC, one for Intel) address distinct buffer overflow vulnerabilities found during an internal audit in response to the claim that fuzzing the drivers resulted in an exploitable failure."
For those that like details, here is more specific information on the patch: About the security content of AirPort Update 2006-001 and Security Update 2006-005.
Apple quietly released a pair of patches today to its wireless drivers.
What, you expect them to loudly release a pair of patches? "Hey, everybody, our products have a flaw which allows them to be wirelessly rooted in under a minute! Better apply this patch!!!1!!one!"
Somehow I don't think that would go over too well on Wall Street.
The theory of relativity doesn't work right in Arkansas.
Brian Krebs, at the Washington Post, has some additional background information and comments in his "SecurityFix" blog.
I'll let MacWorld say it for me:i ndex.php:
From http://www.macworld.com/news/2006/09/21/wireless/
Apple on Thursday released a Security and AirPort update for Mac OS X that fixes vulnerabilities found in the company's wireless drivers. Apple said the issues found were the result of an internal audit of the software drivers and that no known exploits exist for the issues addressed in this update.
...
Apple has maintained that SecureWorks has provided no proof that Mac drivers are vulnerable in any way.
"They did not supply us with any information to allow us to identify a specific problem, so we initiated an internal audit," Apple spokesman, Anuj Nayar, told Macworld. "Today's update preemptively strengthens our drivers against potential vulnerabilities, and while it addresses issues found internally by Apple, we are open to hearing from security researchers on how to improve security on the Mac."
IIRC, a few weeks ago they were adamant that there was no flaw. Seems even darling companies can make mistakes too.
Engineering is the art of compromise.
We complain when Microsoft quietly releases patches, why would we ever expect less of Apple?
Because Linux' security-fixes (about weekly since the flawed AOL-desktop-OS 2.6.* kernel-series) are always loudly announced, right?
Fucking hipocrisy.
It was probably Ringo...didn't he open a hair salon after the break up?
Fucking hipocrisy
Welcome to Slashdot.
It just sounds exactly the sort of thing politicians do, deny there is ever any problem, quietly legistlate, and then when it comes to an election they can say how wonderful they are at the problem they identified and fixed themselves.
;)
I wonder if Steve is planning on running
I get panics on my MBP, in the same few memory locations, when loading the wifi heavily. For instance, using scp or nfs will trigger a panic within a few minutes. This only happens when the wifi is on; ethernet works fine. I've been waiting to take it in for repair until such a time as Apple A) acknowledges all the other problems (heat, whine) I want fixed on this POS, and B) I can stand to do without my beloved POS for a week or so.
"Apple quietly released..."
It's in Security Update where every other update goes, and a spokesperson even talked with MacWorld about it. What's quiet about the release?
"Sufferin' succotash."
Whadya know? There IS an AirPort update in my Software Update thingy.
"Apple never told me that...I had to hear it from Slashdot."
Sugapablo
I have a Core 2 Duo laptop with the Intel Wireless chipset. Yesterday I pulled down a "Critical" patch and installed it. It think both Apple and Dell are using the same Intel chipsets, so this is apparently an Intel fix.
Apple has no control over what other people say, including these security "experts." Or are you claiming that Apple has some sort of mysterious mind control it will keep to prevent release of the info? ;-)
David
Luckily not enough people actually use Macs to make exploits worth using.
The one complaint I have about OS X is the way it handles wireless networks. I can't save the password on the keyring unless the the SSID is being broadcast. What the hell is up with that? With XP, it just works. (Kills me to say that, but it's true.) Hopefully they'll fix it in the next version, but I'm guessing they would rather make it easy for AirPort and a pain for linksys.
I know disabling SSID broadcast doesn't really give you much security, but I live in a townhouse. Why make it easy?
Am I crazy?
To a degree yes. You, nor anyone else in the world is willing to pay what it costs for a fully secure system. It costs money, but more than that it costs time, and people don't want to wait. It is possible to design perfect and bug free software with no defects or attack vectors, but the costs and time associated with it would put it out of the price range of even the most succesful of corporations. And in the end, it would be worthless because it would be outdated by the time you released it. So people want it now, which means not testing for some of the more fringe cases. They also want it cheaper which means leaving out more testing. Witness the computers of today vs the ones of yesteryear. Many computers years ago were built to last, in part because they were expensive enough that a company needed to make them a good investment. These days no one has the stomach to pay for a $5,000 personal computer, even if it means better build quality. They want the latest, the greatest, and they want it now. Software is the same way. We want the latest and the greatest and we want it now, to hell with perfection we can iron the bugs out later.
T Money
World Domination with a plastic spoon since 1984
Liar, liar, pants on fire.
This is, obviously, Apple's Enterprise-grade Security and Communications teams in action. Bravo!
Scott
"Hokey religions and ancient weapons are no match for a good blaster at your side, kid."
"The use-mention distinction" is not "enforced here."
"The use-mention distinction" is not "enforced here."
So let's say you accomplish near-perfection in your code, and you have 1 bug in the entire program. Now, put that program on an operating system, made up of thousands of other binaries, each with only *1* bug in them. Individually, each one of those binaries is nearly perfect. Taken all together, you have a buggy, quirky, unpredictable system of interactions. So do you not release your software until everybody else in the universe also gets theirs right?
Or do you just do the reasonable thing -- release it when it's "okay" so people can use it, and continue improving it via some patching or update process?
You know, I wish I could type perfect code every time, and sometimes I get lucky, but like many, I do rely on feedback from my software. If I misplace a semicolon, the compiler will tell me, and usually it will tell me which line it's on.
This is important. The compiler telling me "Error on line 176: Expected semicolon" or something similar, even if the actual semicolon should go on line 159, is a hell of a lot better than "Whoops! Error SOMEWHERE in your 10k lines of code. Have fun!"
So, someone telling them "Security bug in your wireless driver" is a hell of a lot easier than trying to audit every single line they ever produce, from Xnu to iTunes and everything in between.
And I do agree with you, sort of. Most of these kinds of problems should not happen, and there are, in fact, people who will develop perfectly secure, perfectly stable software for you -- for about twice the cost. So now the question becomes: Pay twice as much for your shiny new MacBook? Or download a patch every couple months? This patch was 1.5 megs, so I'm leaning heavily towards the patch.
Don't thank God, thank a doctor!
This reminds me of the old aphorism:
Every program contains at least one bug; and every program contains at least one redundant line of code. Therefore: logically, all programs can be reduced to one line that doesn't work.
CVE-2006-3508 Available for: Mac OS X v10.4.7, Mac OS X Server v10.4.7
Impact: Attackers on the wireless network may cause system crashes, privilege elevation, or arbitrary code execution
Description: A heap buffer overflow exists in the AirPort wireless driver's handling of scan cache updates. An attacker in local proximity may be able to trigger the overflow by injecting a maliciously-crafted frame into the wireless network. This could lead to a system crash, privilege elevation, or arbitrary code execution with system privileges. This issue affects Intel-based Mac mini, MacBook, and MacBook Pro computers equipped with wireless. Power Mac, PowerBook, iBook, iMac, Mac Pro, Xserve, and PowerPC-based Mac mini computers are not affected. This update addresses the issue by performing additional validation of wireless frames. There is no known exploit for this issue. This issue does not affect systems prior to Mac OS X v10.4.
CVE-ID: CVE-2006-3509
Available for: Mac OS X v10.4.7, Mac OS X Server v10.4.7 Impact: Depending upon third-party wireless software in use, attackers on the wireless network may cause crashes or arbitrary code execution
Description: An integer overflow exists in the Airport wireless driver's API for third-party wireless software. This could lead to a buffer overflow in such applications dependent upon API usage. No applications are known to be affected at this time. If an application is affected, then an attacker in local proximity may be able to trigger an overflow by injecting a maliciously-crafted frame into the wireless network. This may cause crashes or lead to arbitrary code execution with the privileges of the user running the application. This issue affects Intel-based Mac mini, MacBook, and MacBook Pro computers equipped with wireless. Power Mac, PowerBook, iBook, iMac, Mac Pro, Xserve, and PowerPC-based Mac mini computers are not affected. This update addresses the issues by performing additional validation of wireless frames. There is no known exploit for this issue. This issue does not affect systems prior to Mac OS X v10.4.
Does Hipocrisy have a sister?
Cause I've been fucking Hypocrisy for years now.
Just thought they might be related.
Cause of the names you know.
[Fuck Beta]
o0t!
Speaking as someone who did five years at Apple, the company certainly does audit stuff before it's released -- particularly network and filesystem code. Patches and bugfixes also tend to get code-reviewed right inside the bug report by several people outside of the core group with good security experience, and reviewed again before they make it into a release. The main problem is that there are so many lines of code and only a finite amount of time, and the more subtle problems take longer to detect. There is a cost-to-profit tradeoff after a certain point.
It's like microwave popcorn. You nuke it and in the first few minutes you can get almost all of the kernels (exploits) popped. Then the rate of popping slows down. After a while, you simply have to stop or else you'll burn right through your profit (of warm, yummy popped corn).
And that's just not worth it. No matter what there will always be a few hiding way down in the bottom of the bag. You can burn through the whole thing and still never pop them all.
...they've probably had a fix for a month but have spent the rest of the time scrambling the executable so you can't "bindiff" them to figure out what has been changed.
Microsoft won't release a patch for a flaw they find themselves until someone else finds it because of the bindiff risk. They typically just fix it in the next OS, which you can't bindiff anyway because they're too different.
Melissa
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
As always, daringfireball.net has an interesting article on this. And The Macalope chimes in, too, with a link to an article by Glenn Fleishman. Enjoy.
There is. Now pay :-)
Meh. That was a publicity stunt. Doesn't make the articles any less interesting (or any less true :-)
Me like me new patches, Yarg!!!
iPatch
The release date being so close to Talk Like a Pirate Day is purely coincidental.
They have Atheros' cards. Completely different beasts really.
Where is that guy who'd die defending what I had to say when I need him?
Good analogy!
"No one likes working in a hamster wheel, and your shop smells of cedar shavings from here." - TaleSpinner
12% of new laptop sales isn't enough people?
The "market share" dog don't hunt, coward.
I really like that analogy. Now if you can just put it in terms of cars...
If you mod me down, I shall become more powerful than you could possibly imagine.
Companies skimp on these nickel & dime items because it's better for their bottom line.
Audio products are a great example of hardware that can be improved by replacing some capacitors and/or resistors with higher quality or differently specced parts.
[Fuck Beta]
o0t!
I'm just glad Apple is actually finding bugs in their own code and fixing them in a reasonable period of time.
I bought a Macbook Pro recently, and it does still have its share of problems. First of all, it's a new platform for Apple so it's almost bound to have a few issues that they didn't predict. Just because OSX has really been running for years on Intel platform, doesn't mean it's optimized for it yet.
This wireless patch deals with a couple of issues they've found. I installed the patch last night, and I sincerely hope that it does fix the "beachball of death" wireless issue that seems to have hit a fair number of MBP owners myself included. The wireless is pretty damned good, the antenna in the machine is significantly better than my other Dell laptop. However, it's not perfect, and it's known to cause problems in the right (wrong?) circumstances. I can't nail down precisely what those circumstances are, but it will freeze Finder with SBOD problems. Thankfully, EscapePod comes to the rescue for me or it would be that big fat power button of death for my MBP.
I reiterate... I am a Mac owner and I'm proud to say that Apple is at least proactively fixing their code. Secureworks identified one problem, Apple fixed three. That speaks volumes to me about how serious Apple are about squashing bugs.
So . . . now that Apple has patched the code, why doesn't secureworks demonstrate their exploit with an unpatched Apple MacBook? Can they? It seems an easy test. If they have an exploit, show it. The code is fixed.
Stop. You are misinformed. The second item in the announcement, CVE-2006-3509, is for the Atheros driver. The third is for Apple's API on the same computers. We don't know if an exploit exists, and we don't know where the flaw might be if it does exist. We don't even know if it's patched, because Apple has said SecureWorks was not working with them. So, rather than recklessly speculate with the incomplete information available to us, let's see what Maynor and Ellch have to say about their possible exploit:
"This video presentation at Black Hat demonstrates vulnerabilities found in wireless device drivers. Although an Apple MacBook was used as the demo platform, it was exploited through a third-party wireless device driver - not the original wireless device driver that ships with the MacBook."
Still no exploit... still waiting for one...
Controlling complexity is the essence of computer programming. -Brian Kernigan
Apparently, my microwave uses the Microsoft method of bug popping. It goes directly from warm fluffy profit with some unpopped bugs to scorched, terrible tasting profit with the same number of bugs. Then it just tells me to shut up and enjoy anyway because nobody ever got fired for eating Microsoft.
Culture is more than commerce
Name me one Linux kernel problem that was actually exploited. *crickets chirping*
Please, for the good of Humanity, vote Obama.
As an aside, the team that writes the flight-control software for the space shuttle -- who arguably have some of the highest quality standards in the world of software -- demand an average of about one bug per thousand lines of code at the unit-test stage. First, most bugs show up at the boundary where two different subsystems interact, and it's more cost-effective to find those during the integration stage than at unit-test time.
More importantly, though, if they hit a patch where they consistently fail to find any bugs, they audit their testing procedures to make sure they aren't missing anything.
Yep, sure enough, my weekly system update got the AirPort patch.
"The use-mention distinction" is not "enforced here."
Up and running, and ridiculously crackable. Seriously, it takes seconds to get into your network, and there are LOTS of script kiddie tools available. Do yourself the favor and upgrade to WPA. Where I lived last year there weren't even more than 5 computers in reach of my D-Link (working-class district, almost no computers) and even there I had someone in my network when I still used WEP. I didn't care too much as it was clear who it was, and putting the goatse.exe on his Windoze box and printing out some of his p0rn while he was at work was great fun. But where I live now (downtown), I wouldn't touch WEP with a ten foot pole.
Who is General Failure and why is he reading my hard disk?