Forgot your password?
typodupeerror
Security Businesses Apple

Apple Issues Patches For 25 Security Holes 241

Posted by CmdrTaco
from the it's-much-better-now-trust-me dept.
TheCybernator writes "Apple today released software updates to plug more than two dozen security holes in its Mac OS X operating system and other software. The free patches are available via the Mac's built-in Software Update feature or directly from Apple's Web site. All told, today's batch fixes some 25 distinct security vulnerabilities, including a dangerous flaw present in the AirPort wireless devices built into a number of Apple computers, including the eMac, the iBook, iMac, Powerbook G3 and G4, and the Power Mac G4. Apple said computers with its AirPort Extreme wireless cards are not affected. Earlier this month, Apple released a software update to fix a vulnerability in its wireless router, the AirPort Extreme Base Station. That update and instructions on how to apply it are available at the link."
This discussion has been archived. No new comments can be posted.

Apple Issues Patches For 25 Security Holes

Comments Filter:
  • by stratjakt (596332) on Friday April 20, 2007 @08:49AM (#18810961) Journal
    Mac: Hi, I'm a mac!

    PC: And I'm a PC.

    Mac: Steve Jobs just plugged up all my holes

    PC: GOODNIGHT! (tapdances off stage)

    • Re: (Score:3, Funny)

      Mac: Steve Jobs just plugged up all my holes
      Way to go. You've just taken all the Apple fanbois away from their keyboards, as they think about Steve Jobs plugging up their holes.
    • by Bullfish (858648) on Friday April 20, 2007 @10:29AM (#18812187)
      My own take on one of those ads is the upgrade ad...

      First day, Mac approaches PC wearing hospital smock

      Mac: What's with the smock PC?
      PC: I have to upgrade for Vista. I'm a bit scared
      Mac: Okay, be cool. I'll send you flowers in the hospital.

      Next day: Robust looking PC stands there smiling while Mac runs up in panic.

      Mac: Hide me PC! Hide me!
      PC: Why, what's up?
      Mac: They want to upgrade me!!
      PC: Don't be afraid, look at me! Upgrading is great!
      Mac: You don't understand!!!

      Three guys run up, one shoots Mac dead while PC stands there stunned. Two of them drag off Mac. Third guy in natty sweater stands beside PC

      PC: Who are you?
      Mac: I'm Mac.

      • Re: (Score:3, Funny)

        by Bat Country (829565)
        So you're saying the 1984 Macintosh commercial should have been a Logan's Run them instead?
      • I'm an idiot. That's obvious because I just don't get this post, so I've saved you the trouble of responding and calling me an idiot, okay? Now, does this refer to the OS9>OSX migration? Or an incorrect assumption that Mac users buy new computers every time they want to upgrade? I'm currently running Mac OS 10.4.9, the latest release, on a 400mhz G3 iMac that I bought in early 2000, a computer that was released before OSX. It runs very smoothly and as about as fast as any computer with a 400mhz proc
        • by Angostura (703910)
          Did you try upgrading the graphics card, the DVD drive or the processor yet? That's what the parent post was getting act.

          ( a Mac fan writes)
        • The sweater is just a sweater, and yes the joke is about how most Mac owners upgrade.

          It's not saying much that your machine that you bought in 2000 runs OSX just fine, OSX (OSX server) was released in 1999.

  • but ... (Score:4, Funny)

    by Anonymous Coward on Friday April 20, 2007 @08:53AM (#18810997)
    those apples commercials tell me they don't have security issues?
    • Re:but ... (Score:5, Insightful)

      by tji (74570) on Friday April 20, 2007 @09:35AM (#18811457)
      No, there are no OS's without security issues. Even OpenBSD has had a few. Since Mac OS X uses many open standards / open source components, they benefit from the wide deployment, review, and testing that turns up bugs in that code and generates fixes. In closed OS's, the holes are still there, they just cannot be easily analyzed, so it's mostly the highly motivated "black hat" types that discover them and use them for their devious purposes.

      The Mac ads clearly referred to all the viruses, worms, spyware, etc. Which are VERY common on Windows PCs, and for whatever reason, are very uncommon on Macs. (I don't really care why they are not prevalent on Macs, I just care that my MacBook Pro is free of exploits, as are my Linux servers.)

      Patched bugs are a good thing. Bugs are practically unavoidable. Unpatched bugs, as evidenced by rampant exploits, are the real problem.
      • Hey, I've had my TRS-80 around for 25 years without a single trojan, virus or remote exploit infecting it! Most securely designed OS ever! And it had "OS-9" way before Apple!
  • by 140Mandak262Jamuna (970587) on Friday April 20, 2007 @08:53AM (#18810999) Journal
    10 of the 25 are local privilege escalations. A few more require physical access to the machine like loading a malformed disk. Some require authenticated access to the machine. (disk access, clear text password exchange, ftp user privilege escalation, untaring a malformed tar file, opening a malformed help file, etc).

    The remote attacks seem to be coming out of the Kerebros admin daemon distributed by MIT 3 holes. One hole each in libinfo, portmap, ichat.

    • The remote attacks seem to be coming out of the Kerebros admin daemon distributed by MIT 3 holes.

      That's the beauty of Open Source (from Apple's POV).

      When things go well: Hey - look at us! We 'support' OSS by leveraging all that free software.
      When things go bad: Oh well - it's MIT's software! Not ours...

      Seriously - I for one am really glad that one closed O/S vendorout there lets OSS do the heavy lifting security wise on their products. Apple users are left in a far less leaky boat. Thanks MIT, Thanks FOSS, Thanks Apple!
      • Re: (Score:2, Redundant)

        They are not blaming MIT, nor am I but my quick description might leave that impression.

        That MIT developed it is relevant because, some admins might be running a home grown versions or ruggadized versions sold by other specialist vendors. Infact every hole clearly says which module is affected to help you decide whether or not you need to update your system. Wish MSFT also would clearly say what is not affected by the hole.

        • by Afecks (899057)
          Wish MSFT also would clearly say what is not affected by the hole.

          You mean like how every MS security bulletin has a list of "Affected Software" and then lists each specific operating system version and service pack?
      • by ClosedSource (238333) on Friday April 20, 2007 @10:35AM (#18812261)
        Well, some FOSS supporters on Slashdot are known to equivocate about what "Linux" consists of. When trying to compare functionality with other OS's they consider the entire distro, when comparing stability or security the definition shrinks down to only the kernel.
      • by delire (809063)
        So true. Frankly I would be quite anxious use OS X as my primary OS for this reason alone.

        In the context of Linux distributions if it's packaged it is the distributions problem: without smoking incense here, the ecology of the whole distribution is considered to be at risk if there is a security vulnerability in one of the packages in the distribution. You can then rest assured that if you download software beyond what's offered in the already comprehensive repositories, security audited with each updat
      • by geekoid (135745)
        YOu do know that apple has many, many OSS packages they created and support, right?

    • Re: (Score:2, Informative)

      by Fulkkari (603331)

      Washingtonpost:

      including a dangerous flaw present in the AirPort wireless devices built into a number of Apple computers, including the eMac, the iBook, iMac, Powerbook G3 and G4, and the Power Mac G4. Apple said computers with its AirPort Extreme wireless cards are not affected.

      Apple [apple.com]:

      A buffer overflow vulnerability exists in the AirPortDriver module which processes control commands for AirPort. By sending malformed control commands, a local user could trigger the overflow which may lead to arbitrary co

      • by Afecks (899057)
        FUD? I doubt that was the intention.

        I think The Washington Post is just a little shocked. Especially since the Mac "just works" so there shouldn't be any bugs. Plus since OS X is so secure there should never be any exploits either, remote or local.
      • Re: (Score:2, Insightful)

        by Bat Country (829565)
        How is it FUD to call a dangerous flaw dangerous?

        I administer a network of 50 systems and the only thing protecting those machines is that I don't allow users to execute downloaded software.

        Any program which issued those malformed instructions while claiming to allow the users to punch the monkey or something could install the first OS X backdoor worms, installing them with root privileges then effectively hiding themselves.

        This flaw allows exactly the same attack as the P2P "hot_teen_action.mpg.exe" tro
    • by Lars T. (470328)
      I liked the one for the installer:

      By enticing a user to download and install an installer package with a maliciously-crafted file name, an attacker can trigger the vulnerability.
      If you already got somebody to download and install your code, why bother hiding the bad code in the malformed name? Very subtle joke by the Apple techs.
    • by mzs (595629)
      Here is the distressing thing. Five of the exploits are because environment variables were not properly sanitized. How embarrassing is it to not be correctly setting the PATH and IFS environment variables in 2007? Even worse one of them is passing username and password via command line arguments!

      Another exploit has any logged in user able to to see the keystrokes of other users thus making key-loggers possible. But that is not the worst part, the embarrassing part is that this was supposedly fixed in an ear
  • Why is this news? (Score:5, Informative)

    by reality-bytes (119275) on Friday April 20, 2007 @08:53AM (#18811001) Homepage
    As an Apple 'outsider' I'm not certain why this is news.

    Is it because these issues/vulnerabilities have been outstanding for a long time? Or perhaps Apple does not patch things often?

    It's an honest question, my Ubuntu systems at home have frequent patches rolled out and the staff at work are always talking about another update on their Windows desktops.

    Isn't Apple the same?
    • Re: (Score:3, Insightful)

      by falcon5768 (629591)
      ITs not news, but people like to make it new. Just like Ubuntu Apple updates and patches their system constantly compared to Microsoft. But people like to say that means the computer is LESS secure than a windows machine.

      The truth is more Apple is willing and able to patch its software in a timely manner, while Microsoft waits for big chunk updates and service packs to do it.

      • Re:Why is this news? (Score:5, Interesting)

        by 140Mandak262Jamuna (970587) on Friday April 20, 2007 @09:08AM (#18811175) Journal
        Also the vulnerability notes very clearly spell out what is affected. I am not a mac user. Still I could make sense of what is broken, whether or not I am running a vulnerable service, whehter or not I need this update.

        Compare this to the dense hole descriptions by MSFT. Almost everything affects everything. Even if the bug in Windows is such that "If you dont user IE you are not vulnerable" they cant/wont say it. Wont say it because it will drive FireFox usage up. Cant say it because IE can be invoked by any part of any code. Similarly when a hole in Windows is found, no one seems to know what/who would be affected. Another reason why they dont describe it better is allegedly their fear that the hackers will use it to attack yet unupdated systems. But most hackers use reverse-engineering tools like BlackIce and deconstruct the patch and know precisely how to attack unpatched systems. On the other hand people who might be persuaded to patch their systems faster if the hole description was more specific and pertinent wait because they cant determine whether they are affected. Add to it MSFT's practice of downplaying the bug severity, no wonder MSFT updates are becoming more of a problem than solution.

      • Re:Why is this news? (Score:5, Informative)

        by 644bd346996 (1012333) on Friday April 20, 2007 @09:11AM (#18811201)
        Did you really mean to say that Apple releases patches more often than Microsoft? Because that is just plain wrong. I get pestered by Windows update at least twice as often as by OS X Software Update, and I use both operating systems regularly.
        • Re: (Score:3, Interesting)

          by Jeff DeMaagd (2015)
          I think what was meant was that a fix is worked on as soon as possible, but I don't think that's always true. An inability to get Apple's attention on a bug is why that one guy did the Month of Apple Bugs, rightly or wrongly.

          Microsoft's security fixes seem to fix smaller numbers of bugs per update. Recently, they were mostly updates to the malware removal tool, not security fixes.
        • Informative? How is this informative? How often your system checks for updates is entirely up to the user. Please take your straw man down now.
          • All of my systems check for updates every time I turn them on, ie daily. But that doesn't really matter, as long as the systems check significantly more often than updates are released.

            When somebody says "... Apple updates and patches their system constantly compared to Microsoft" that seems to be a exaggerated way of saying that Apple releases patches far more often than Microsoft. In my experience, the opposite is the case. I asked if I was interpreting the comment the right way, and explained why I was q
            • It sure seems like a straw man as you were referring to the frequency of how often your system checks for updates, and not how often updates are released. Seeing the checking frequency is 100% determined by the user, it is a not related in any way to how often updates are released, it IS a strawman argument. Your second post clarified a little better what you meant, but I stand by my inital post as your inital post only refers to how often Windows Update runs a check compared to Apple Software Update.
        • Re: (Score:2, Insightful)

          by Scudsucker (17617)
          Did you really mean to say that Apple releases patches more often than Microsoft? Because that is just plain wrong.

          Because Microsoft has a lot more to patch.
      • by GreggBz (777373)

        Just like Ubuntu Apple updates and patches their system constantly compared to Microsoft.


        As a user of Linux (although I can't speak for Ubuntu), Mac OS and Windows all I can say is.. ehh.. no.

      • Re: (Score:2, Informative)

        by clintre (1078849)
        Actually that is far from the truth.

        I am no M$ fanboy, but they used to push out patches constantly, but most IT shops do not want that. Generally IT shops like to validate the patches before applying them to their machines to make sure poorly written software does not have issues with a patch.

        No on in their right mind would push patches out directly to the corporate computers without testing them. By having the patches come out on the same day every month you allow preparation and planning.

        Really
      • Just the facts (Score:5, Interesting)

        by ad0gg (594412) on Friday April 20, 2007 @10:38AM (#18812301)
        By constantly you mean, every 3 months or so. Some of the holes had been open for over 3 months with a rating of highly critical on secunia. Secunia still list 6 unpatched holes for OSX, highest being moderately critical. Quick comparision to vista which has two unpatched holes which have a rating of not critical.

        Vista [secunia.com]
        OS X [secunia.com]

    • Re: (Score:3, Insightful)

      by squiggleslash (241428) *

      (I tried posting this earlier, but it has disappeared for some reason, weird. Still, gives me the chance to fix some of the language...)

      It wouldn't be but for the fact that there's a dubious assumption that Mac OS X is bulletproof (or close to it) because Windows machines are always being attacked, and, by-and-large, Macs and GNU/Linux are being left alone. The assumption is then combined with the false belief that Mac OS X and GNU/Linux distributions have less significant holes.

      Windows machines suffer

      • Re:Why is this news? (Score:4, Informative)

        by notthepainter (759494) <oblique@@@alum...mit...edu> on Friday April 20, 2007 @10:35AM (#18812267) Homepage

        It's worth noting that Mac OS 9, which had no security whatsoever, had almost no (or none? The point is I've never come across one) viruses or worms.

        I can only think of one in recent memory. The Hong Kong worm http://www.makingpages.org/pagemaker/virus.html [makingpages.org], aka Autostart 9805, was pretty devasting to the pre-press industry which passed around zip cartridges like they were free. This would have been back in 1998.

        Paul

      • I'm guessing at the numbers, but there were something like 50 viruses for classic Mac OS. Most seemed to be the type that would attach themselves to applications or floppies and spread that way. I remember one time coming home from printing something at Kinkos, putting the floppy in my machine, and Symantec Antivirus coming up and reporting that it had removed a virus from the disk. The objective was different, typically they just tended to spread and be annoying; a handful did actual damage. Since this
        • Well, this is why I said Mac OS 9, not merely "Mac OS" which covers a variety of platforms and obsolete ways of running viruses. By the 1999-2002 period, computers primarily communicated on networks, with CDs being the main alternative. In other words, you can compare the state of the world of Mac OS 9 (in terms of the environment it lived in, the clued-upiness of its users, the lessons learnt) to the world of Windows XP, Mac OS X, and GNU/Linux, whereas the original Mac OS 1-4 lived in a relatively innoce

      • It's worth noting that Mac OS 9, which had no security whatsoever, had almost no (or none? The point is I've never come across one) viruses or worms.

        Back in the '80s and early '90s the Mac was a fertile breeding ground for viruses, because of the design of the system. Just putting a floppy in the drive was enough to run code. Apple's response to this was to get rid of automatic execution of code fragments on floppies and in resource forks of documents. This was a normal and sane response to a bad design.

        If you want to know why it hasn't been the target of a concerted hacker attack, you have to look elsewhere than the "Windows is insecure by design, OS X and Unix isn't" stuff that's become the prevailing consensus.

        While the fact that there are more Windows boxes out there, there are several features of Windows that are insecure-by-design that have had a huge impact on Windows security. In particular, the design of Internet Explorer and the integration of the HTML control into the desktop and email programs had an enormous and direct effect on the spread of viruses and worms on Windows machines all out of proportion to their popularity.

        Before the release of "Open Desktop", the virus problem on Windows really was managable without antivirus software. Just following good software hygiene was enough to make viruses a rare problem. Afterwards, I found that simply not allowing the use of IE and Outlook and other components that used the HTML control to display untrusted documents was more effective than antivirus software, because it removed the mosty common point of entry of new viruses.

        The sane response to this would have been to back out the desktop-browser integration and redesign the system so that the right to run unsandboxed code was SOLELY mediated by the application displaying the document. Microsoft, instead, attempted to come up with tighter and tighter heuristics as to when to allow documents out of the sandbox, which boggled my mind then and still boggles my mind now.

        There are other problems in the design of Windows that I've discussed before, but this one should be more than enough to make my point, especially after you handed me such a great counterexample.
    • It's not news, it's Fark... wait, wrong site.

      But you're right, this isn't news. Mac OS X has bugs and security holes just like every OS that has ever existed. Apple patches them. It's just that they seem to be able to do it before someone wants to try to exploit them.

  • by c0d3h4x0r (604141) on Friday April 20, 2007 @08:57AM (#18811063) Homepage Journal
    Microsoft Issues Holes for 25 Security Patches
  • Why (Score:2, Insightful)

    by Mockylock (1087585)
    Why isn't this listed under "HaHa" as well? Not trolling, as much as wondering what the reasoning of that was for. Bias?
    • Re:Why (Score:5, Insightful)

      by aicrules (819392) on Friday April 20, 2007 @09:10AM (#18811195)
      I think because no one really believes that Apple software is completely bulletproof. No software is completely bulletproof. I'm sure someone could find an exploit even for a Hello World program. Windows gets the majority of the "bad press" from flaws because it has a gigantic market share compared to Apple, so the security holes and related patches affect many more people.

      Yes, some Windows folks will see this as a "haha" nelson moment. However, it isn't a haha moment until the headline reads that someone found 25 Apple exploits and released a huge virus to exploit them. And while I am firmly planted in my Windows environment, I will not be interested in laughing at my Apple compadres when or if that happens.
      • by Afecks (899057)
        However, it isn't a haha moment until the headline reads that someone found 25 Apple exploits and released a huge virus to exploit them.

        I'm sure you meant a worm not a virus.

        However, if there's ever more than 1 Mac for every 1 million* IP addresses then maybe a worm might surface.

        I just hope the worm author does something creative with his captive audience. Perhaps some hilarious messagesm, "right click to continue", "dx9.dll missing, please reinstall" or how about changing all their bookmarks to
    • The majority of the security holes patched are ones where you would have to be in a very unusual situation for someone to use them to any real effect. That doesn't lessen the fact that these are holes being patched up mind you. But, if you look closely at what was patched, you'll see a lot of the patches focus on the foundation that OSX is built on(BSD and its respective tools), and most are relatively harmless/hard to use to your advantage flaws.

      As others have said, no operating system is bullet proof
  • 10.3.9 also patched (Score:5, Informative)

    by kybred (795293) on Friday April 20, 2007 @09:22AM (#18811321)
    Apple is providing some patches for 10.3.9 as well. Good to see that they are still providing security related updates for the previous system.
    • by 0racle (667029)
      Until 10.5 is released, 10.3.9 is a supported release. What you just said is like giving MS a hand for releasing patches for XP even though they just released Vista.
      • by toQDuj (806112)
        No, 10.4.x is the current version, the XP-alike. 10.3 would be more windows ME or 2000 perhaps..
        • by 0racle (667029)
          Completely missed it huh. MS has 2 Supported desktop versions of windows currently, Vista and XP. Apple has 2 supported versions currently (only ever has 2), Panther (10.3) and Tiger (10.4). The previous poster said it was good to see Apple patching Panther. Panther is a supported system, it should be expected that Apple continues to patch it. Giving Apple a hand for patching a supported system would be like thanking MS for going to the trouble of patching XP when Vista is the most recent, even though XP is
    • by drinkypoo (153816)
      It's too bad they don't port improvements to the way the system behaves to the previous system. I'm not talking about bringing whole new APIs etc to prior revisions, although that would be responsible, but about backporting fixes to the way the context menus work for example (they are not very well-behaved in 10.3 in general. I finally went to 10.4 a couple weeks ago.)
  • If this was an MS System, we'd now be at SP1.
    • by Lars T. (470328)

      If this was an MS System, we'd now be at SP1.
      Nope, still about 175 missing for the average SP.
  • Not news... (Score:2, Insightful)

    by IwarkChocobos (881084)
    Don't ALL operating systems have holes? I think the only thing different here is that Apple waited until there were a lot found and fixed to release the patch. MS and Apple release patches differently; MS releases them as soon as they can, one at a time usually, while Apple chooses to wait until there are a lot of patches to release it. Not really the best idea, but not the worst for both companies. Not news.
    • Re: (Score:2, Insightful)

      by Ash-Fox (726320)

      MS releases them as soon as they can, one at a time usually
      They usually try to release them once a month.

      while Apple chooses to wait until there are a lot of patches to release it.
      Actually, I've noticed Apple delay updates long enough that a lot come out in the next OS X upgrade.

      Not news.
      Agreed.
      • Actually, I've noticed Apple delay updates long enough that a lot come out in the next OS X upgrade.

        But I have seen Apple release critical patches out of cycle if the issue was severe enough.

  • One problem I have with Apple is that their change logs and what's new on releases and patches are poorly documented if ever. iPod is a good example. I guess you're supposed to apply the 'don't fix it if it ain't broke' approach which is good. But then why does iTunes constantly remind me of available updates? In either case I hope Apple documents their fixes on the computer side a little better. That way I can decide if I need to fix them.

    And as for the MS ObiWan Kenfanboys, just because MS has a constant
    • One problem I have with Apple is that their change logs and what's new on releases and patches are poorly documented if ever.

      It is funny to make such a comment in an article about Apple's security fixes. Apple's security fixes are poorly documented, unless you compare them to anyone else on the planet's, then they're pretty darn good. They provide a nice, English description of each item patched along with enough info for a normal human to know if the affects them, credit for finding the vulnerabilities, and links to external references when available. They provide the CVE numbers. What more do you want?

  • MS Patch management (Score:2, Interesting)

    by Hawat (266650)
    My work laptop (XP Pro) has developed an aversion to installing Office XP components. I tried to add MS-Access for a special project. In "Add/Remove programs" from the Control Panel it fails silently. From setup.exe on the the CD I get this message: "No valid sequence could be found for the set of patches."

    This appears to be related to the Microsoft Windows Installer (msi.dll).

    Eventually, I tried to uninstall Office XP and start over. The machine refuses do do this with another silent failure. I consid

The bugs you have to avoid are the ones that give the user not only the inclination to get on a plane, but also the time. -- Kay Bostic

Working...