Slashdot Mirror
Apple Issues Patches For 25 Security Holes
TheCybernator writes "Apple today released software updates to plug more than two dozen security holes in its Mac OS X operating system and other software. The free patches are available via the Mac's built-in Software Update feature or directly from Apple's Web site.
All told, today's batch fixes some 25 distinct security vulnerabilities, including a dangerous flaw present in the AirPort wireless devices built into a number of Apple computers, including the eMac, the iBook, iMac, Powerbook G3 and G4, and the Power Mac G4. Apple said computers with its AirPort Extreme wireless cards are not affected.
Earlier this month, Apple released a software update to fix a vulnerability in its wireless router, the AirPort Extreme Base Station. That update and instructions on how to apply it are available at the link."
Mac: Hi, I'm a mac!
PC: And I'm a PC.
Mac: Steve Jobs just plugged up all my holes
PC: GOODNIGHT! (tapdances off stage)
I don't need no instructions to know how to rock!!!!
those apples commercials tell me they don't have security issues?
The remote attacks seem to be coming out of the Kerebros admin daemon distributed by MIT 3 holes. One hole each in libinfo, portmap, ichat.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
As an Apple 'outsider' I'm not certain why this is news.
Is it because these issues/vulnerabilities have been outstanding for a long time? Or perhaps Apple does not patch things often?
It's an honest question, my Ubuntu systems at home have frequent patches rolled out and the staff at work are always talking about another update on their Windows desktops.
Isn't Apple the same?
Ripping an new rectum in the fabric of spacetime.
Microsoft Issues Holes for 25 Security Patches
Moderator hint: a comment is neither "Flamebait" nor "Troll" if it is true.
Why isn't this listed under "HaHa" as well? Not trolling, as much as wondering what the reasoning of that was for. Bias?
"Please, shut up. Just when I think you can't say anything more stupid, you speak again." -Archie Bunker.
Yeha, that's usually how it happens. Microsoft has holes because the OS supposedly stinks, all other OS's Just patch holes to make their OS even better.
Basically saying, "I'm not screwing the sheep. I'm Merely helping it through the fence."
"Please, shut up. Just when I think you can't say anything more stupid, you speak again." -Archie Bunker.
Apple is providing some patches for 10.3.9 as well. Good to see that they are still providing security related updates for the previous system.
Don't ALL operating systems have holes? I think the only thing different here is that Apple waited until there were a lot found and fixed to release the patch. MS and Apple release patches differently; MS releases them as soon as they can, one at a time usually, while Apple chooses to wait until there are a lot of patches to release it. Not really the best idea, but not the worst for both companies. Not news.
I think you have totally misunderstood what that tag means. It means that the designer specifically designed the device to not do something that is normally expected or wanted, or has been designed in such a way as to annoy the user constantly. In other words, they had to work harder to make sure the device did not work. Typical MS things that are defective by design are DRM, Clippy, and that new security thing in Vista that is so annoying.
These were bugs, not by design. Apple didn't not specifically intend for them to exist, and has now fixed them.
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
If you are in charge of a business's IT department, do you want to go through and thoroughly test new patches every few days, or do one test covering multiple patches? Didn't feedback from big IT shops compel MS to release patches in bigger batches with less frequency (hence the introduction of "Patch Tuesday")?
I don't do IT, so maybe releasing 25 fixes at once can require 25 separate test cycles. Anybody care to enlighten me?
Government's idea of a balanced budget: take money from the right pocket to balance...oh who am I kidding?
Not to be to flameable here, but who says they aren't part of botnets? The various Unix flavours and derivatives are the reason why we know what a rootkit is.
As my CS professor said once, "With Windows, you know it's broken right up front, and that you have to take certain steps right away to fix it. such as slap an AV program on. With the various Unix-based OSes, you have to go over every little detail with a fine-toothed comb, putz around in the code, recompile, and all of that other hassle because they put the Root into Rootkit."
If you ask me, the only botnet secure OS is the one not sitting with an allowed/established connection to the internet to begin with. If it's human-created code, it's vulnerable, period.
@Mindless Drivel: 100% of Twitter posts ever Tweeted.
Heu!!!! how can you say that they are proactive if the patches fixes issue that are already there and they know about it.
proactive is seeing for potential threat in the future and taking steps to correct them before they happen
There are no more proactive than any other company when it comes to bugs and patches.
Sigh. Have you ever worked in the software development industry. There is this thing called "testing" that some people find important. If you work on Kereberos and find a bug and patch it, you then test just it before distributing. If you work at Apple or Redhat where you are shipping an entire OS with a bunch of packages, it is impossible to patch and test those patches in conjunction with all other hardware in the same timeframe because you have multiple things to patch at once. Thus, the only real solution s to do it in bundles, where you stick a group of patches together then QA them all at once. This results in longer delays for some fixes, but it also means the patch is actually tested in conjunction with the other patches so one does not break another. Any responsible vendor uses this method for dealing with bugs.
Once again, the methodology commonly used by Linux distributions in which patches are rolled out as soon as they are ready provides greater security than Microsoft or Apple (who do the very same thing.)Individual developers roll out patches and you could have patched your OS X box from them if you felt it was an emergency for you. As for what Linux vendors do, I don't know of any who roll one-off fixes into the stable branch intended for real use, instead of testing patches in bundles. You don't seem to know what you're talking about.
Vista
OS X
Have you ever been to a turkish prison?
It means that the designer specifically designed the device to not do something that is normally expected or wanted, or has been designed in such a way as to annoy the user constantly. In other words, they had to work harder to make sure the device did not work. Typical MS things that are defective by design are DRM, Clippy, and that new security thing in Vista that is so annoying.
Ah. So you mean like a media player that can't display full screen videos ?
(It would be interesting to see what you thinkg DR, Clippy and UAC are stopping you doing that is "normally expected", as well.)
My work laptop (XP Pro) has developed an aversion to installing Office XP components. I tried to add MS-Access for a special project. In "Add/Remove programs" from the Control Panel it fails silently. From setup.exe on the the CD I get this message: "No valid sequence could be found for the set of patches."
This appears to be related to the Microsoft Windows Installer (msi.dll).
Eventually, I tried to uninstall Office XP and start over. The machine refuses do do this with another silent failure. I considered uninstalling msi, but it warns me that every program on the computer may fail to work if I do so. Microsoft list a large number of registry hacks that might either fix the problem or create a doorstop.
Now I'm looking at starting from a fresh install.
I do not know if the frequency and volume of patches from Microsoft is related, but I am highly suspicious that msi.dll is confused because of this. Microsoft describes Microsoft Windows Installer as "...an installation and configuration service that reduces the total cost of ownership." Not.
Yeah, 'cos patched local privilege escalation vulnerabilities that nobody has bothered to exploit is exactly the same as unpatched remote code-execution vulnerabilities affecting a default installation for which exploits are widely circulated in the wild for nefarious purposes.
If you think the two are the same, it's no wonder you think they're all fanboys.
And yet none of those remotely-vulnerable services are enabled by default. Indeed, of the three, two of them wouldn't get switched on by the vast majority of Mac users.
.ANI vulnerability.
Which is somewhat different to, say, the
Very simple yet suprisingly time consuming :-)
http://blogs.zdnet.com/security/?p=173
So I wonder if this invalidates the contest. This just revealed vulns that aren't patched on the contest machines.
It's worth noting that Mac OS 9, which had no security whatsoever, had almost no (or none? The point is I've never come across one) viruses or worms.
Back in the '80s and early '90s the Mac was a fertile breeding ground for viruses, because of the design of the system. Just putting a floppy in the drive was enough to run code. Apple's response to this was to get rid of automatic execution of code fragments on floppies and in resource forks of documents. This was a normal and sane response to a bad design.
If you want to know why it hasn't been the target of a concerted hacker attack, you have to look elsewhere than the "Windows is insecure by design, OS X and Unix isn't" stuff that's become the prevailing consensus.
While the fact that there are more Windows boxes out there, there are several features of Windows that are insecure-by-design that have had a huge impact on Windows security. In particular, the design of Internet Explorer and the integration of the HTML control into the desktop and email programs had an enormous and direct effect on the spread of viruses and worms on Windows machines all out of proportion to their popularity.
Before the release of "Open Desktop", the virus problem on Windows really was managable without antivirus software. Just following good software hygiene was enough to make viruses a rare problem. Afterwards, I found that simply not allowing the use of IE and Outlook and other components that used the HTML control to display untrusted documents was more effective than antivirus software, because it removed the mosty common point of entry of new viruses.
The sane response to this would have been to back out the desktop-browser integration and redesign the system so that the right to run unsandboxed code was SOLELY mediated by the application displaying the document. Microsoft, instead, attempted to come up with tighter and tighter heuristics as to when to allow documents out of the sandbox, which boggled my mind then and still boggles my mind now.
There are other problems in the design of Windows that I've discussed before, but this one should be more than enough to make my point, especially after you handed me such a great counterexample.