Apple Issues Patches For 25 Security Holes

TheCybernator writes "Apple today released software updates to plug more than two dozen security holes in its Mac OS X operating system and other software. The free patches are available via the Mac's built-in Software Update feature or directly from Apple's Web site. All told, today's batch fixes some 25 distinct security vulnerabilities, including a dangerous flaw present in the AirPort wireless devices built into a number of Apple computers, including the eMac, the iBook, iMac, Powerbook G3 and G4, and the Power Mac G4. Apple said computers with its AirPort Extreme wireless cards are not affected. Earlier this month, Apple released a software update to fix a vulnerability in its wireless router, the AirPort Extreme Base Station. That update and instructions on how to apply it are available at the link."

cue doodly piano music

[stratjakt (596332)]

Mac: Hi, I'm a mac!

PC: And I'm a PC.

Mac: Steve Jobs just plugged up all my holes

PC: GOODNIGHT! (tapdances off stage)

Re:

[CowTipperGore (1081903)]

Mac: Steve Jobs just plugged up all my holes

Way to go. You've just taken all the Apple fanbois away from their keyboards, as they think about Steve Jobs plugging up their holes.

Re:cue doodly piano music

[Bullfish (858648)]

My own take on one of those ads is the upgrade ad...

First day, Mac approaches PC wearing hospital smock

Mac: What's with the smock PC?
PC: I have to upgrade for Vista. I'm a bit scared
Mac: Okay, be cool. I'll send you flowers in the hospital.

Next day: Robust looking PC stands there smiling while Mac runs up in panic.

Mac: Hide me PC! Hide me!
PC: Why, what's up?
Mac: They want to upgrade me!!
PC: Don't be afraid, look at me! Upgrading is great!
Mac: You don't understand!!!

Three guys run up, one shoots Mac dead while PC stands there stunned. Two of them drag off Mac. Third guy in natty sweater stands beside PC

PC: Who are you?
Mac: I'm Mac.

Re:

[Bat Country (829565)]

So you're saying the 1984 Macintosh commercial should have been a Logan's Run them instead?

but ...

[by Anonymous Coward]

those apples commercials tell me they don't have security issues?

Re:but ...

[tji (74570)]

No, there are no OS's without security issues. Even OpenBSD has had a few. Since Mac OS X uses many open standards / open source components, they benefit from the wide deployment, review, and testing that turns up bugs in that code and generates fixes. In closed OS's, the holes are still there, they just cannot be easily analyzed, so it's mostly the highly motivated "black hat" types that discover them and use them for their devious purposes.

The Mac ads clearly referred to all the viruses, worms, spyware, etc. Which are VERY common on Windows PCs, and for whatever reason, are very uncommon on Macs. (I don't really care why they are not prevalent on Macs, I just care that my MacBook Pro is free of exploits, as are my Linux servers.)

Patched bugs are a good thing. Bugs are practically unavoidable. Unpatched bugs, as evidenced by rampant exploits, are the real problem.

Re:

[Onan (25162)]

I'd say the conclusion they'd like you to reach is that macs are so much less susceptible to viruses that they don't require worrying about.

And fortunately, that conclusion is correct. You'll notice that these are all pre-emptive fixes to bugs that apple or white hats have discovered, not emergency patches for ongoing exploitation. I'd hazard a guess that the total number of macs compromised by these issues outside of a testing environment is zero.

I'm sorry that your sister was affected by the one mac virus

Quick summary to avoid reading TFA

[140Mandak262Jamuna (970587)]

10 of the 25 are local privilege escalations. A few more require physical access to the machine like loading a malformed disk. Some require authenticated access to the machine. (disk access, clear text password exchange, ftp user privilege escalation, untaring a malformed tar file, opening a malformed help file, etc).

The remote attacks seem to be coming out of the Kerebros admin daemon distributed by MIT 3 holes. One hole each in libinfo, portmap, ichat.

Re:Quick summary to avoid reading TFA

[Whiney Mac Fanboy (963289)]

The remote attacks seem to be coming out of the Kerebros admin daemon distributed by MIT 3 holes.

That's the beauty of Open Source (from Apple's POV).

When things go well: Hey - look at us! We 'support' OSS by leveraging all that free software.
When things go bad: Oh well - it's MIT's software! Not ours...

Seriously - I for one am really glad that one closed O/S vendorout there lets OSS do the heavy lifting security wise on their products. Apple users are left in a far less leaky boat. Thanks MIT, Thanks FOSS, Thanks Apple!

Re:

[140Mandak262Jamuna (970587)]

They are not blaming MIT, nor am I but my quick description might leave that impression.

That MIT developed it is relevant because, some admins might be running a home grown versions or ruggadized versions sold by other specialist vendors. Infact every hole clearly says which module is affected to help you decide whether or not you need to update your system. Wish MSFT also would clearly say what is not affected by the hole.

Re:

[Afecks (899057)]

Wish MSFT also would clearly say what is not affected by the hole.

You mean like how every MS security bulletin has a list of "Affected Software" and then lists each specific operating system version and service pack?

Re:Quick summary to avoid reading TFA

[ClosedSource (238333)]

Well, some FOSS supporters on Slashdot are known to equivocate about what "Linux" consists of. When trying to compare functionality with other OS's they consider the entire distro, when comparing stability or security the definition shrinks down to only the kernel.

Re:

[Fulkkari (603331)]

Washingtonpost:

including a dangerous flaw present in the AirPort wireless devices built into a number of Apple computers, including the eMac, the iBook, iMac, Powerbook G3 and G4, and the Power Mac G4. Apple said computers with its AirPort Extreme wireless cards are not affected.

Apple [apple.com]:

A buffer overflow vulnerability exists in the AirPortDriver module which processes control commands for AirPort. By sending malformed control commands, a local user could trigger the overflow which may lead to arbitrary co

Why is this news?

[reality-bytes (119275)]

As an Apple 'outsider' I'm not certain why this is news.

Is it because these issues/vulnerabilities have been outstanding for a long time? Or perhaps Apple does not patch things often?

It's an honest question, my Ubuntu systems at home have frequent patches rolled out and the staff at work are always talking about another update on their Windows desktops.

Isn't Apple the same?

Re:

[falcon5768 (629591)]

ITs not news, but people like to make it new. Just like Ubuntu Apple updates and patches their system constantly compared to Microsoft. But people like to say that means the computer is LESS secure than a windows machine.

The truth is more Apple is willing and able to patch its software in a timely manner, while Microsoft waits for big chunk updates and service packs to do it.

Re:Why is this news?

[140Mandak262Jamuna (970587)]

Also the vulnerability notes very clearly spell out what is affected. I am not a mac user. Still I could make sense of what is broken, whether or not I am running a vulnerable service, whehter or not I need this update.

Compare this to the dense hole descriptions by MSFT. Almost everything affects everything. Even if the bug in Windows is such that "If you dont user IE you are not vulnerable" they cant/wont say it. Wont say it because it will drive FireFox usage up. Cant say it because IE can be invoked by any part of any code. Similarly when a hole in Windows is found, no one seems to know what/who would be affected. Another reason why they dont describe it better is allegedly their fear that the hackers will use it to attack yet unupdated systems. But most hackers use reverse-engineering tools like BlackIce and deconstruct the patch and know precisely how to attack unpatched systems. On the other hand people who might be persuaded to patch their systems faster if the hole description was more specific and pertinent wait because they cant determine whether they are affected. Add to it MSFT's practice of downplaying the bug severity, no wonder MSFT updates are becoming more of a problem than solution.

Re:Why is this news?

[644bd346996 (1012333)]

Did you really mean to say that Apple releases patches more often than Microsoft? Because that is just plain wrong. I get pestered by Windows update at least twice as often as by OS X Software Update, and I use both operating systems regularly.

Re:

[Jeff DeMaagd (2015)]

I think what was meant was that a fix is worked on as soon as possible, but I don't think that's always true. An inability to get Apple's attention on a bug is why that one guy did the Month of Apple Bugs, rightly or wrongly.

Microsoft's security fixes seem to fix smaller numbers of bugs per update. Recently, they were mostly updates to the malware removal tool, not security fixes.

Re:

[GreggBz (777373)]

Just like Ubuntu Apple updates and patches their system constantly compared to Microsoft.

As a user of Linux (although I can't speak for Ubuntu), Mac OS and Windows all I can say is.. ehh.. no.

Re:

[clintre (1078849)]

Actually that is far from the truth.

I am no M$ fanboy, but they used to push out patches constantly, but most IT shops do not want that. Generally IT shops like to validate the patches before applying them to their machines to make sure poorly written software does not have issues with a patch.

No on in their right mind would push patches out directly to the corporate computers without testing them. By having the patches come out on the same day every month you allow preparation and planning.

Really

Just the facts

[ad0gg (594412)]

By constantly you mean, every 3 months or so. Some of the holes had been open for over 3 months with a rating of highly critical on secunia. Secunia still list 6 unpatched holes for OSX, highest being moderately critical. Quick comparision to vista which has two unpatched holes which have a rating of not critical.

Vista [secunia.com]
OS X [secunia.com]

Re:Just the facts

[larkost (79011)]

One thing to note: the one bug that Secunia is rating as "moderately critical" is on FTP, and it is not enabled by default.

Re:

[squiggleslash (241428)]

(I tried posting this earlier, but it has disappeared for some reason, weird. Still, gives me the chance to fix some of the language...)

It wouldn't be but for the fact that there's a dubious assumption that Mac OS X is bulletproof (or close to it) because Windows machines are always being attacked, and, by-and-large, Macs and GNU/Linux are being left alone. The assumption is then combined with the false belief that Mac OS X and GNU/Linux distributions have less significant holes.

Windows machines suffer

Re:Why is this news?

[notthepainter (759494)]

It's worth noting that Mac OS 9, which had no security whatsoever, had almost no (or none? The point is I've never come across one) viruses or worms.

I can only think of one in recent memory. The Hong Kong worm http://www.makingpages.org/pagemaker/virus.html [makingpages.org], aka Autostart 9805, was pretty devasting to the pre-press industry which passed around zip cartridges like they were free. This would have been back in 1998.

Paul

Windows before 1997 had relatively few viruses too

[argent (18001)]

It's worth noting that Mac OS 9, which had no security whatsoever, had almost no (or none? The point is I've never come across one) viruses or worms.

Back in the '80s and early '90s the Mac was a fertile breeding ground for viruses, because of the design of the system. Just putting a floppy in the drive was enough to run code. Apple's response to this was to get rid of automatic execution of code fragments on floppies and in resource forks of documents. This was a normal and sane response to a bad design.

If you want to know why it hasn't been the target of a concerted hacker attack, you have to look elsewhere than the "Windows is insecure by design, OS X and Unix isn't" stuff that's become the prevailing consensus.

While the fact that there are more Windows boxes out there, there are several features of Windows that are insecure-by-design that have had a huge impact on Windows security. In particular, the design of Internet Explorer and the integration of the HTML control into the desktop and email programs had an enormous and direct effect on the spread of viruses and worms on Windows machines all out of proportion to their popularity.

Before the release of "Open Desktop", the virus problem on Windows really was managable without antivirus software. Just following good software hygiene was enough to make viruses a rare problem. Afterwards, I found that simply not allowing the use of IE and Outlook and other components that used the HTML control to display untrusted documents was more effective than antivirus software, because it removed the mosty common point of entry of new viruses.

The sane response to this would have been to back out the desktop-browser integration and redesign the system so that the right to run unsandboxed code was SOLELY mediated by the application displaying the document. Microsoft, instead, attempted to come up with tighter and tighter heuristics as to when to allow documents out of the sandbox, which boggled my mind then and still boggles my mind now.

There are other problems in the design of Windows that I've discussed before, but this one should be more than enough to make my point, especially after you handed me such a great counterexample.

Re:

[Paulrothrock (685079)]

It's not news, it's Fark... wait, wrong site.

But you're right, this isn't news. Mac OS X has bugs and security holes just like every OS that has ever existed. Apple patches them. It's just that they seem to be able to do it before someone wants to try to exploit them.

Re:I'll tell you what's news:

[frdmfghtr (603968)]

If you are in charge of a business's IT department, do you want to go through and thoroughly test new patches every few days, or do one test covering multiple patches? Didn't feedback from big IT shops compel MS to release patches in bigger batches with less frequency (hence the introduction of "Patch Tuesday")?

I don't do IT, so maybe releasing 25 fixes at once can require 25 separate test cycles. Anybody care to enlighten me?

Re:

[mkiwi (585287)]

I don't do IT, so maybe releasing 25 fixes at once can require 25 separate test cycles. Anybody care to enlighten me?

Here's how it works where I work (IT and Software Engineering):

1. Run MS auto update.
2. See what breaks.
3. Reinstall programs that are broken.
4. Pray the user's outlook database is not larger than 2GB.
5. ???
6. ??????
7. Whew. Only 300 more computers to go.

Very simple yet suprisingly time consuming :-)

Re:I'll tell you what's news:

[99BottlesOfBeerInMyF (813746)]

They rolled out these patches all at once. But the patches were almost certainly not done all at the same time. That's right, Apple has deliberately left you (and me! although I only have one mac to deal with and it's not my primary machine) vulnerable so that they could roll out a bunch of patches at the same time instead of one at a time.

Sigh. Have you ever worked in the software development industry. There is this thing called "testing" that some people find important. If you work on Kereberos and find a bug and patch it, you then test just it before distributing. If you work at Apple or Redhat where you are shipping an entire OS with a bunch of packages, it is impossible to patch and test those patches in conjunction with all other hardware in the same timeframe because you have multiple things to patch at once. Thus, the only real solution s to do it in bundles, where you stick a group of patches together then QA them all at once. This results in longer delays for some fixes, but it also means the patch is actually tested in conjunction with the other patches so one does not break another. Any responsible vendor uses this method for dealing with bugs.

Once again, the methodology commonly used by Linux distributions in which patches are rolled out as soon as they are ready provides greater security than Microsoft or Apple (who do the very same thing.)

Individual developers roll out patches and you could have patched your OS X box from them if you felt it was an emergency for you. As for what Linux vendors do, I don't know of any who roll one-off fixes into the stable branch intended for real use, instead of testing patches in bundles. You don't seem to know what you're talking about.

In other news...

[c0d3h4x0r (604141)]

Microsoft Issues Holes for 25 Security Patches

Why

[Mockylock (1087585)]

Why isn't this listed under "HaHa" as well? Not trolling, as much as wondering what the reasoning of that was for. Bias?

Re:Why

[aicrules (819392)]

I think because no one really believes that Apple software is completely bulletproof. No software is completely bulletproof. I'm sure someone could find an exploit even for a Hello World program. Windows gets the majority of the "bad press" from flaws because it has a gigantic market share compared to Apple, so the security holes and related patches affect many more people.

Yes, some Windows folks will see this as a "haha" nelson moment. However, it isn't a haha moment until the headline reads that someone found 25 Apple exploits and released a huge virus to exploit them. And while I am firmly planted in my Windows environment, I will not be interested in laughing at my Apple compadres when or if that happens.

Because of the nature of the holes patched

[Solr_Flare (844465)]

The majority of the security holes patched are ones where you would have to be in a very unusual situation for someone to use them to any real effect. That doesn't lessen the fact that these are holes being patched up mind you. But, if you look closely at what was patched, you'll see a lot of the patches focus on the foundation that OSX is built on(BSD and its respective tools), and most are relatively harmless/hard to use to your advantage flaws.

As others have said, no operating system is bullet proof

10.3.9 also patched

[kybred (795293)]

Apple is providing some patches for 10.3.9 as well. Good to see that they are still providing security related updates for the previous system.

Re:

[0racle (667029)]

Until 10.5 is released, 10.3.9 is a supported release. What you just said is like giving MS a hand for releasing patches for XP even though they just released Vista.

Re:

[toQDuj (806112)]

No, 10.4.x is the current version, the XP-alike. 10.3 would be more windows ME or 2000 perhaps..

Re:

[drinkypoo (153816)]

It's too bad they don't port improvements to the way the system behaves to the previous system. I'm not talking about bringing whole new APIs etc to prior revisions, although that would be responsible, but about backporting fixes to the way the context menus work for example (they are not very well-behaved in 10.3 in general. I finally went to 10.4 a couple weeks ago.)

25 holes? Wow.

[Opportunist (166417)]

If this was an MS System, we'd now be at SP1.

Not news...

[IwarkChocobos (881084)]

Don't ALL operating systems have holes? I think the only thing different here is that Apple waited until there were a lot found and fixed to release the patch. MS and Apple release patches differently; MS releases them as soon as they can, one at a time usually, while Apple chooses to wait until there are a lot of patches to release it. Not really the best idea, but not the worst for both companies. Not news.

Re:

[Ash-Fox (726320)]

MS releases them as soon as they can, one at a time usually

They usually try to release them once a month.

while Apple chooses to wait until there are a lot of patches to release it.

Actually, I've noticed Apple delay updates long enough that a lot come out in the next OS X upgrade.

Not news.

Agreed.

Re:

[Speare (84249)]

The "defectivebydesign" tag is intended for use whenever discussing DRM and the way that technology can and will be changed to further restrict or disenfranchise you from using content on your own hardware, even if you are otherwise completely in the clear by your rights as a consumer and citizen of your particular country. It's defective, but it was intentionally designed to be that way.

Not that it's not misused occasionally by idiots and zealots, but there you are.

Re:

[Graff (532189)]

This is why the whole tags system is worthless. The article has already been placed into one or more sections and has thus been "tagged" by the administrators. You have the title and the article itself to get more information about the article. Having user-applied tags is superfluous and can be misleading - either by accident or on purpose.

Personally I ignore all tags and I think it's a waste of time to have the whole tagging system. Either the moderators should tag the article or there should be no tag

Re:

[elrous0 (869638)]

If it's not hurting you, why do you care?

A lot of us like the tagging system.

Re:

[Mockylock (1087585)]

Yeha, that's usually how it happens. Microsoft has holes because the OS supposedly stinks, all other OS's Just patch holes to make their OS even better.

Basically saying, "I'm not screwing the sheep. I'm Merely helping it through the fence."

Re:

[Aladrin (926209)]

I think you have totally misunderstood what that tag means. It means that the designer specifically designed the device to not do something that is normally expected or wanted, or has been designed in such a way as to annoy the user constantly. In other words, they had to work harder to make sure the device did not work. Typical MS things that are defective by design are DRM, Clippy, and that new security thing in Vista that is so annoying.

These were bugs, not by design. Apple didn't not specifically in

Re:

[drsmithy (35869)]

It means that the designer specifically designed the device to not do something that is normally expected or wanted, or has been designed in such a way as to annoy the user constantly. In other words, they had to work harder to make sure the device did not work. Typical MS things that are defective by design are DRM, Clippy, and that new security thing in Vista that is so annoying.

Ah. So you mean like a media player that can't display full screen videos ?

(It would be interesting to see what you thinkg D

Re:

[Lars T. (470328)]

Linux does it, and the guy who found the bug is of course the first to do so.

Re:

[Chris whatever (980992)]

Heu!!!! how can you say that they are proactive if the patches fixes issue that are already there and they know about it.

proactive is seeing for potential threat in the future and taking steps to correct them before they happen

There are no more proactive than any other company when it comes to bugs and patches.

Re:

[thejynxed (831517)]

Not to be to flameable here, but who says they aren't part of botnets? The various Unix flavours and derivatives are the reason why we know what a rootkit is.

As my CS professor said once, "With Windows, you know it's broken right up front, and that you have to take certain steps right away to fix it. such as slap an AV program on. With the various Unix-based OSes, you have to go over every little detail with a fine-toothed comb, putz around in the code, recompile, and all of that other hassle because they p

Re:

[Lars T. (470328)]

Because you'll get a bigger botnet if you write the hacks for windows. Same reason there's not much virus/malware/etc on the non-windows OS's.

That's your answer to somebody who says that most botnets don't use any "hacks"?