Slashdot Mirror
Apple Pushes First Automated OS X Security Update
PC Magazine reports (as does Ars Technica) that Apple this week has pushed its first automated security update, to address critical flaws relating to Network Time Protocol:
The flaws were revealed last week by the Department of Homeland Security and the Carnegie Mellon University Software Engineering Institute—the latter of which identified a number of potentially affected vendors, including FreeBSD Project, NTP Project, OmniTI, and Watchguard Technologies, Inc.
A number of versions of the NTP Project "allow attackers to overflow several buffers in a way that may allow malicious code to be executed," the Carnegie Mellon/DHS security bulletin said. ... The company's typical security patches come through Apple's regular software update system, and often require users to move through a series of steps before installing. This week's update, however, marks Cupertino's first implementation of its automated system, despite having introduced the function two years ago, Reuters said.
...while "automatic", it does not install automatically unless you've enabled automatic software updates. If you haven't, it takes the same form regular updates do: a little dialog pops up in the corner of the desktop alerting you about the update, asking what you want to do.
This is a major bug in NTPd, so if you're using it on Linux, you'll want to patch it too (or switch to openNTP which isn't affected). The big problem is that it can be exploited with a single (specially crafted) UDP packet, so it's easy for malicious actors to probe lots of machines with very little overhead.
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
What else can they "push"...
"If any question why we died, Tell them because our fathers lied."
How many times have we seen people who set their updates to Automatic in a Windows environment get in trouble when an update mangles their system? I know people who say, "I always get every update as soon as they come out" then bitch when an update did something to their system.
Can this auto-update be turned off or changed to manual?
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Is that what that is?! I just saw a pop-up telling me an OS X update applied when I returned to my desk. Curious, I checked the updates and didn't seen anything new installed today. I figured it was some malware clickbait popup that came and went from inactivity on my end.
Life is not for the lazy.
They only update back to Mountain Lion.
I am Slashdot. Are you Slashdot as well?
You can turn this off in system preferences > app store
"If any question why we died, Tell them because our fathers lied."
http: //support.ntp.org/bin/view/Main/SecurityNotice
Buffer overflow in ctl_putdata()
References: Sec 2668 / CVE - 2014 - 9295 / VU #852879
Versions: All NTP4 releases before 4.2.8
CVSS: (AV:N/AC:L/Au:N/C:P/I:P/A:P) Base Score: 7.5
Date Resolved: Stable (4.2.8) 18 Dec 2014
Summary: A remote attacker can send a carefully crafted packet that can overflow a stack buffer and potentially allow malicious code to be executed with the privilege level of the ntpd process.
Mitigation - any of:
Upgrade to 4.2.8, or later, from the NTP Project Download Page or the NTP Public Services Project Download Page.
Put restrict ... noquery in your ntp.conf file, for non-trusted senders.
Credit: This vulnerability was discovered by Stephen Roettger of the Google Security Team. w
Your mom off the bridge, bitch.
Though it can be disabled, the folks at Apple seem to have been VERY conservative about which updates they mark as "automatic" - only this one update in two years. All other updates have been released as needing user approval first.
So by having it on, you are NOT subjecting yourself to the same level of crap as Windows users who automatically install all sorts of random updates every single month. You're only getting the most critical updates, one small update every couple of years.
I came in to work this morning, my last (half) day of work before leaving for a two week vacation, to find that my Mac had automatically handled done this update. I very nearly skipped this last half-day of work. Had I done that, and had "allow automatic updates" turned off, my machine would have been been vulnerable for two weeks until I came back. I'm glad this one was automatically installed, while al of the other lower-priority updates have always awaited my approval.
.
The trouble is the the ntp.org project seems to be more concerned about adding every last neat new feature, and less concerned about the quality of the software they push upon the world.
It's the openssl fiasco all over again.
Fuck forums sliders
a large number of people cant install 10.10.1 as it stops at "about 4 minutes remaining" and just sits there for days. Apple refuses to acknowlege the problem or offer a solution.
Do not look at laser with remaining good eye.
In my time in IT, that's what I've seen. There was an update to the 3com 905 drivers back in the day that BSOD's systems, since then there have been more rigorous driver testing. After that there was the recent Windows 7 update that had a problem on some systems. We didn't see any issues on any of our some 400 Windows 7 systems, but I did verify it was real. MS rolled it back with another automated patch.
Oh and I suppose XP SP3 though that wasn't automatic, and the only systems it "broke" were ones with Malware infections so I hardly count that.
So... ya... Personally, I'll take an issue ever decade or so in trade for having a system that it up to date. However, if you'd rather not patch your stuff go ahead, just don't do it on my network, I'll block you.
Is my MacBook really running an ntp daemon? Huh, yes it is:
$ ps ax | grep ntp /usr/sbin/ntpd -c /private/etc/ntp-restrict.conf -n -g -p /var/run/ntpd.pid -f /var/db/ntp.drift
32950 ?? Ss 0:00.26
How about that. When I first read this, I kinda figured it only applied to OS X server, and that on a normal Mac there would just be a periodic script that updates the clock via ntpdate. But it makes sense to have a daemon running, clock has to be accurate on wake to access network shares and the like.
Had I done that, and had "allow automatic updates" turned off, my machine would have been been vulnerable for two weeks until I came back. I'm glad this one was automatically installed, while al of the other lower-priority updates have always awaited my approval.
I would imagine that the timing of this is one reason why it was pushed this way. As you point out, a lot of machines would be unattended until after New Year's and would be patched until then.
Windows has patch tuesday...welcome to having a popular OS.
I haven't updated to 10.10 yet, because they demand my credit card information for the "free" update; I refuse to put it into their system, even temporarily.
I suppose this thread is as as close as I'll get... Anyone else have high CPU displaying Slashdot on Safari?
I usually keep /. open all day in a tab, but lately I've occasionally been getting /. tabs burning through all of my CPU on some tabs, according to ActivityMonitor. I assume it has something to do with the new ads, since it's intermittent, but it's been difficult to flag exactly which ad content has been causing this. Just updated to Safari 8.0.2 this morning, and it's still occurring.
Usually use Safari instead of Chrome since the battery life is supposedly better, but certainly not with this issue :P But at this point, I'd sooner stop keeping /. open than change browsers. :/
I don't have automatic updates installed. I like to decide on the when. It installed and just notified me of the installation. Worked as intended.
Vulnerabilities are low, I read that the update is about a component of the OS which relates to network time protocol (NTP), which is used for synchronizing clocks on computer systems...So updates need not matter..
Stay out out my damn computer! If you can modify my computer for this, what's stopping you from removing ebooks from my library? Just provide the updates & I'll install them myself.