Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
OS 9 Businesses Operating Systems Security Apple

Security Updates Released for Panther and Jaguar 75

Posted by pudge from the what-happens-if-everyone-reboots-at-once? dept.
ZackSchil writes "Apple has released security updates for both Mac OS X 10.3.1 and, as promised, 10.2.8. The update to 10.3.1 updates OpenSSL and zlib's gzprintf() function. In addition to those updates, the 10.2.8 update contains changes to gm4, groff, Mail w/CRAM-MD5 authentication, Personal File Sharing, and QuickTime for Java. Run Software Update for more information and to install the updates."
This discussion has been archived. No new comments can be posted.

Security Updates Released for Panther and Jaguar More

Security Updates Released for Panther and Jaguar

Comments Filter:
  • I've already installed Security Update 2003-11-19 and QuitTime for Java Update v2.0. No problems so far. Great to see Apple keeping their promise and supporting Jaguar.

  • seems to work (Score:2, Informative)

    by for_usenet ( 550217 )
    I tried the update to 10.2.8, and all seems to be well. Thanks to Apple for keeping the older OS's secure. Now if they'd only let us use 3rd party drives with their Disc-recording software in 10.3, it would be golden !! ;-)

    • Re:seems to work (Score:4, Interesting)

      by HTH NE1 ( 675604 ) on Thursday November 20, 2003 @01:35PM (#7521163)
      Now if they'd only let us use 3rd party drives with their Disc-recording software in 10.3, it would be golden !!

      Not all third-party drives are reliable. I can't burn DVD-Rs with DVD Studio Pro 2 on my DVD-R/-RAM drive because the drive reports its two burn speeds as 1x and 64x (as relayed by Toast). DSP2 presumes to use the highest speed, 64x, with no control to tell it otherwise. It then hangs. I have to have DSP2 create a disk image file instead and then burn that with Toast.

      But at least I got it to run on an underpowered non-AGP Mac. (Blue & White G3 upgraded with 550 MHz G4.)

      • Re:seems to work (Score:3, Interesting)

        by bill_mcgonigle ( 4333 ) *
        Yeah, but they don't support a significant number of drives that do not have such failures.

        Patchburn works great on Jaguar for most people. The drive descriptions file in 10.3 is xml-based instead of binary, but after editing the XML file (probably correctly) it still doesn't recognize my drive, so there must still be another step to get the OS to recognize the changes (compile it?).

        Anybody know?
    • It used to be (according to things that I have read on the 'net) that as long as you installed an IDE/ATA DVD recorder internally, then iDVD would use it. Is this no longer the case?

    • Re:seems to work (Score:4, Interesting)

      by for_usenet ( 550217 ) on Thursday November 20, 2003 @01:51PM (#7521332)
      The reason why I mentioned this is some of us would still like the choice of being able to experiment with 3rd party drives. I have the same model Toshiba DVD-ROM/CD-RW drive that Apple uses on its iBooks. However, when I installed it, all of the OS software claimed it was "unsupported." Seems like Apple used a different firmware version.

      However, using the PatchBurn software, I was able to modify some of the system files to get the drive to be recognized by all of the system software (iTunes, Disc Copy, etc). With 10.3, if the drive is no longer supported out of the box, I am SOL, at least till someone else hacks the Disc Recording Framework. I am not asking Apple to give support for all these drives, just to let us be able to try them out for ourselves, and not close up the OS entirely.
      • In panther Apple uses XML files to store data about supported drives. All you have to do is open up something like, say, toast and look at what the drive reports itself as, then dig in /Library/Frameworks/DiscRecording.framework and find the proper XML file and add a new .

        I know this sounds really complicated, but there is an easy how-to guide at www.xlr8yourmac.com. Most drives are supported, but the software doesn't believe so because of a slightly different firmware version or something silly like that.
    • They would, but there are licensing issues involved. I'm not exactly sure how it all works, but the MPEG4 codec has something to do with it.

  • Just downloaded and..... (Score:5, Informative)

    by ihatewinXP ( 638000 ) on Thursday November 20, 2003 @01:21PM (#7521040)
    Everything still works. I havent seen any killer bugs popping up on macfixit or versiontracker either. Also note that the QT Java update is included - fixed one broken site for me that Panther QT had knocked out.

    Oh and a bluetooth update, but my Sony Ericsson already works flawlessly (and still does post-update).

    And yes, it does require a restart for all of you running the "Show Off" uptime screen saver.
  • I hope that ome of these patches fixes my lockup issues in 10.2.8

  • This just in: THE SKY DIDN'T FALL (Score:4, Insightful)

    by mattbot 5000 ( 645961 ) on Thursday November 20, 2003 @01:52PM (#7521342) Homepage
    Where are all the people who were crying last week about Apple not supporting Jaguar? Huh?!? WHAT DO YOU HAVE TO SAY FOR YOURSELVES NOW!!!

    Go ahead and mod me +1 Flamebait, just RECOGNIZE that you people are the FISH that took the bait last week!

    So high and mighty with your mod points.

  • On a related note (Score:2, Informative)

    by Tengoo ( 446300 )
    I haven't seen this mentioned yet so I'll pass this tidbit along.
    SecurityTracker has information on a new sudo vulnerability. [securitytracker.com] Only laptops are affected.

    • Re:On a related note (Score:2, Informative)

      by Anonymous Coward
      This is a pretty serious issue, but there are a couple of more practical workarounds than the ones mentioned in the link, until the problem is fixed (if this security update doesn't fix it)

      Users running Panther can also set the "Require password to wake this computer from sleep or screen saver" option in the Security preference pane.

      Jaguar users can grab the program sleepwatcher and make it issue the 'sudo -k' command on sleep.

      Remember though, if someone can get unsupervised access to your laptop, they c
    • This is such a non-issue. First, it requires an authenticated sudo event (e.g. someone typed in their sudoers allowed password), the laptop to be put to sleep, then someone to run another sudo command immediately after the system wakes up. This is NOT a critical vulnerability by any standard.

    • Wow. Maybe they'll finally get around to fixing the clock update routine. It's been bugging me since 10.0.

  • via terminal (Score:5, Insightful)

    by djupedal ( 584558 ) on Thursday November 20, 2003 @02:38PM (#7521868)
    [Zen:~] bmt% softwareupdate -l
    Software Update Tool
    Copyright 2002-2003 Apple Computer, Inc.

    Software Update found the following new or updated software:
    ! SecurityUpd2003-11-19-1.0
    Security Update 2003-11-19, 1.0, 1360K [required] [restart]
    [Zen:~] bmt%
  • ~/ $ sudo softwareupdate -i -r

  • 10.3 broke the network gui - fixed soon? (Score:4, Interesting)

    by gobbo ( 567674 ) on Thursday November 20, 2003 @03:00PM (#7522129) Journal
    Panther breaks the networking GUI that was pretty good in Jaguar. Now, servers you've connected to through browsing in the Finder don't show up on the desktop, and if they're an SMB share, can't be ejected without throwing your powerbook through a window, er, restarting. To get an icon on your desktop that represents a mounted server, you have to know and type in its IP address and protocol, or its precise network name --browsing doesn't work.

    The Apple Discussion boards are buzzing with this one. The GUI implementation is horribly confusing to newbies especially, but bad enough for those of us who know what smb:// or afp:// or DHCP actually is. They must be getting a ton of feedback from us aggravated types.

    Until this is fixed, no-one I know here at the university will be advised to upgrade to 10.3, despite the many juicy new features and optimization.
    • what the hell are you talking about?
      i went to the finder, hit cmd-K, typed in smb://myserver/share, and it instantly mounted on my desktop. i clicked the eject button in the finder's new sidebar and it unmounted just fine.
      • "i went to the finder, hit cmd-K, typed in smb://myserver/share, and it instantly mounted on my desktop. i clicked the eject button in the finder's new sidebar and it unmounted just fine."

        RTFP. That's exactly what I'm talking about. You have to type in the smb address, presuming you know it (OK for me, not my newbie interns or tweedy colleagues). Then you'll get the icon showing a mounted share, and an eject button. But that isn't browsing, is it? It's a command line approach with a simple entry form, why
    • Whatever. I turned off desktop icons for my local drives. The new Finder window is good enough that putting drives on your desktop is pointless clutter for anybody other than OS9 zealots who just can't bring themselves to let go of their Old School ways.

      (FYI: What gests displayed on the desktop can be controlled via the Preferences in the Finder menu.)

      • I actually felt the same way until Panther.

        Now with Expose, it's nice to have instant click'n'drag access to any drive with F11.

      • Re:10.3 broke the network gui - fixed soon? (Score:4, Informative)

        by gobbo ( 567674 ) on Thursday November 20, 2003 @04:27PM (#7522928) Journal
        Even if mounted servers don't show on the desktop (one of my user configs obsoletes the desktop anyway, so I personally can understand where you're coming from), they still don't show in the Finder window sidepanel that lists drives and favorites etc. if you've connected using the Network icon. That means no feedback about mounted shares, and no eject button, and even worse behaviour like Finder locking up when you unplug.

        I'd say having to ask someone or look up, then type in ip addresses and protocols is more Old School than (cmd-K, let's see, oh there it is, arrow-right arrow-down-down-down, return key), don't you think? I have more important things to think about than
        smb://obscure-27.someadmincruft.weird-9.domain.con
        and the like.

        Axiom:
        Discovery is better done in the interface than in meatspace.

        Now go and describe how to use this setup to someone who reads Habermas and McLuhan all day and night, and just wants to get to their damn files, or who thinks that Windows was always called XP and Britney is cool.
        [/rant]
    • I"ve found one way to take care of it, at least with a Linux-running Samba server on the other end -- kill the server's smbd process corresponding to that connection. I tried that and then clicked on an item in my SMB-mounted shared folder and the mac was suddenly like "hey there's nothing here anymore." Of course you pretty much have to be root on the other box, so this is only useful for sysadmins and those of us who have personal LANs. I'd have never noticed this flaw if it weren't for these posts her
    • I haven't been able to mount an NFS export on panther yet, first it didn't work, then it completely crashed and burned.. Anyone's tried that on Panther?

  • Low interest in this item? (Score:3, Insightful)

    by AtariAmarok ( 451306 ) on Thursday November 20, 2003 @03:48PM (#7522603)
    Sheesh. There sure is a low amount if interest in this news item. It must have to do with the security reputation of the Apple OS.

    Why bother to put up another new electric fence around Fort Knox :)

  • Siegfried and Roy? (Score:4, Funny)

    by AtariAmarok ( 451306 ) on Thursday November 20, 2003 @03:51PM (#7522631)
    Now they put out "Security Updates for Panther and Jaguar". It's just a little late to save Roy from that pain in the neck, but it's a step in the right direction! Make those big cats safer.

  • OpenSSL? (Score:3, Interesting)

    by dema ( 103780 ) on Thursday November 20, 2003 @03:57PM (#7522695) Homepage
    I ran the update today, and it appears (naive?) that my OpenSSL was not updated. While the date seems accurate, the version is not the suggested update. I know I read somewhere yesterday (I can't find the link again today) that the fix was to update to 0.9.6j, although this is the output on my "updated" g4 with jag:

    [akira:~] dema% openssl version
    OpenSSL 0.9.6i Feb 19 2003

    Any ideas what's up with that?
    • Well, I ran the update today too, and here's the output on my powerbook:

      [powerbookg4:~] user% openssl version
      OpenSSL 0.9.7b 10 Apr 2003
      [powerbookg4:~] user%

      (This is on Panther)

    • Re:OpenSSL? (Score:2, Informative)

      by Frequency Domain ( 601421 )
      All three of the machines which I updated today report identical results, a newer version than yours:
      shiva:~ freq$ openssl version

      OpenSSL 0.9.7b 10 Apr 2003

      Is it possible you installed your own copy, say in /usr/local/bin, and then forgot about it? Try running "which openssl", and see if it reports something other than /usr/bin/openssl. Alternatively, explicitly run the system's openssl: "/usr/bin/openssl version".

      • Only one is in /usr/bin. But I believe the updates are different for Panther and Jag anyway. As a friend of mine updated a Panther machine to that same version you have, but his Jaguar machine also returned the version I got. So maybe (as suggested by an AC in this thread) Apple just patched the current version in jag's case. I suppose I should be looking at technical docs at Apple for the answer to that. Thanks for the tip though. (:

    • Fink? (Score:2, Informative)

      by grocer ( 718489 )
      I did the same thing on my iBook and get the same output:

      [Adam-Laptop:/usr/bin] user% openssl version
      OpenSSL 0.9.7a Feb 19 2003
      [Adam-Laptop:/usr/bin] user%

      Now, the weird thing is there is openssl command in /usr/bin/ but when I run "which openssl" I get "/sw/bin/openssl" and running "/usr/bin/openssl version" returns "Command not found."

      Now I have to ask why is this?
      • Well, if you look closely ours actually aren't the same. Your iBook has 0.9.7a, while my mirrordoor has 0.9.6i. My guess is that fink has installed the very newest version of it on your iBook, so the Apple update saw it was already updated, and did nothing. I would check and see if /usr/bin/openssl is a symlink to /sw/bin/openssl. The command would be "ls -l /usr/bin | grep openssl" (if you didn't know).
        • okay, I was totally braindead...I have A) Jaguar and B) everybody else's Panther output...

          It doesn't look like a symbolic link to me...but I can't find the version of the /usr/bin copy...

          [Adam-Laptop:~] usr% ls -l /usr/bin | grep openssl
          -rwxr-xr-x 1 root wheel 935292 Sep 14 20:21 openssl
          [Adam-Laptop:~] user% ls -l /sw/bin | grep openssl
          -rwxr-xr-x 1 root admin 1314372 Oct 31 23:44 openssl
          [Adam-Laptop:~] user%
  • Note this update also brings Safari up to 1.1.1 (100.1); not sure what changed (still no mention of changes to Safari at the kbase page [apple.com]).
  • Does anyone know if this will help with a Pen Drive problem. Everytime I put my in my new Emac it takes 3 trys to get it to work then it wont even let me put anything in it. The finder just freezes. Pen drive worked on an IMac with 10.2.8

Slashdot Top Deals

Top Ten Things Overheard At The ANSI C Draft Committee Meetings: (5) All right, who's the wiseguy who stuck this trigraph stuff in here?

Close