Slashdot Mirror
Apple Pushes First Automated OS X Security Update
PC Magazine reports (as does Ars Technica) that Apple this week has pushed its first automated security update, to address critical flaws relating to Network Time Protocol:
The flaws were revealed last week by the Department of Homeland Security and the Carnegie Mellon University Software Engineering Institute—the latter of which identified a number of potentially affected vendors, including FreeBSD Project, NTP Project, OmniTI, and Watchguard Technologies, Inc.
A number of versions of the NTP Project "allow attackers to overflow several buffers in a way that may allow malicious code to be executed," the Carnegie Mellon/DHS security bulletin said. ... The company's typical security patches come through Apple's regular software update system, and often require users to move through a series of steps before installing. This week's update, however, marks Cupertino's first implementation of its automated system, despite having introduced the function two years ago, Reuters said.
...while "automatic", it does not install automatically unless you've enabled automatic software updates. If you haven't, it takes the same form regular updates do: a little dialog pops up in the corner of the desktop alerting you about the update, asking what you want to do.
This is a major bug in NTPd, so if you're using it on Linux, you'll want to patch it too (or switch to openNTP which isn't affected). The big problem is that it can be exploited with a single (specially crafted) UDP packet, so it's easy for malicious actors to probe lots of machines with very little overhead.
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
Is that what that is?! I just saw a pop-up telling me an OS X update applied when I returned to my desk. Curious, I checked the updates and didn't seen anything new installed today. I figured it was some malware clickbait popup that came and went from inactivity on my end.
Life is not for the lazy.
They only update back to Mountain Lion.
I am Slashdot. Are you Slashdot as well?
Yes, the automatic updating is a controllable setting, and to contrast one detail against Window: In my 9 years of using OS X, it has never done an automatic REBOOT during OS update, no matter if I've had automatic updates enabled or not.
You can turn this off in system preferences > app store
"If any question why we died, Tell them because our fathers lied."
http: //support.ntp.org/bin/view/Main/SecurityNotice
Buffer overflow in ctl_putdata()
References: Sec 2668 / CVE - 2014 - 9295 / VU #852879
Versions: All NTP4 releases before 4.2.8
CVSS: (AV:N/AC:L/Au:N/C:P/I:P/A:P) Base Score: 7.5
Date Resolved: Stable (4.2.8) 18 Dec 2014
Summary: A remote attacker can send a carefully crafted packet that can overflow a stack buffer and potentially allow malicious code to be executed with the privilege level of the ntpd process.
Mitigation - any of:
Upgrade to 4.2.8, or later, from the NTP Project Download Page or the NTP Public Services Project Download Page.
Put restrict ... noquery in your ntp.conf file, for non-trusted senders.
Credit: This vulnerability was discovered by Stephen Roettger of the Google Security Team. w
How many times have we seen people who set their updates to Automatic in a Windows environment get in trouble when an update mangles their system? I know people who say, "I always get every update as soon as they come out" then bitch when an update did something to their system.
Can this auto-update be turned off or changed to manual?
Yes, but the system is opt-in, not opt-out. I always wait for a few days before updating, just to see if there are any problems reported. This helped me to miss out on some doozies. Thankfully, I saw the report on the latest Microsoft update before running it on my work machine.
Taking guns away from the 99% gives the 1% 100% of the power.
If you do manual updates you can wait to see if anything is broken before installing them. There is never a need to be the first one to get an update. Let some other poor sucker suffer the slings and arrows of breakage.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
t has never done an automatic REBOOT during OS update
Lol.. that just means it replaced the files on disk.
You've been running with the vulnerable libraries/executable loaded in memory until you restarted the OS or whatever program loaded those files.
At least on the machines in our household (Mountain Lion and Mavericks), NTPD was restarted as part of the update process, without an OS reboot.
I don't have automatic updates installed. I like to decide on the when. It installed and just notified me of the installation. Worked as intended.