Apple Issues Patches For 25 Security Holes 241
TheCybernator writes "Apple today released software updates to plug more than two dozen security holes in its Mac OS X operating system and other software. The free patches are available via the Mac's built-in Software Update feature or directly from Apple's Web site.
All told, today's batch fixes some 25 distinct security vulnerabilities, including a dangerous flaw present in the AirPort wireless devices built into a number of Apple computers, including the eMac, the iBook, iMac, Powerbook G3 and G4, and the Power Mac G4. Apple said computers with its AirPort Extreme wireless cards are not affected.
Earlier this month, Apple released a software update to fix a vulnerability in its wireless router, the AirPort Extreme Base Station. That update and instructions on how to apply it are available at the link."
Quick summary to avoid reading TFA (Score:5, Informative)
The remote attacks seem to be coming out of the Kerebros admin daemon distributed by MIT 3 holes. One hole each in libinfo, portmap, ichat.
Why is this news? (Score:5, Informative)
Is it because these issues/vulnerabilities have been outstanding for a long time? Or perhaps Apple does not patch things often?
It's an honest question, my Ubuntu systems at home have frequent patches rolled out and the staff at work are always talking about another update on their Windows desktops.
Isn't Apple the same?
Re:Why is this news? (Score:5, Informative)
10.3.9 also patched (Score:5, Informative)
Re:Quick summary to avoid reading TFA (Score:2, Informative)
Washingtonpost:
Apple [apple.com]:
Forgot to mention its local an exploit? Sounds like FUD spreading to me.
Re:I'd like to propose a tag (Score:3, Informative)
These were bugs, not by design. Apple didn't not specifically intend for them to exist, and has now fixed them.
Re:Why is this news? (Score:2, Informative)
I am no M$ fanboy, but they used to push out patches constantly, but most IT shops do not want that. Generally IT shops like to validate the patches before applying them to their machines to make sure poorly written software does not have issues with a patch.
No on in their right mind would push patches out directly to the corporate computers without testing them. By having the patches come out on the same day every month you allow preparation and planning.
Really Apple is no more secure than Windows, Linux yes Apple no. It all comes down to how you configure it after you get it in any case. I have done plenty of penetration tests on Apple, M$, and several Linux distros. M$ is no where near as bad as it once was.
Re:Why is this news? (Score:4, Informative)
I can only think of one in recent memory. The Hong Kong worm http://www.makingpages.org/pagemaker/virus.html [makingpages.org], aka Autostart 9805, was pretty devasting to the pre-press industry which passed around zip cartridges like they were free. This would have been back in 1998.
Paul
Re:Just the facts (Score:5, Informative)
Re:Cue Apologists (Score:2, Informative)
Which is somewhat different to, say, the
PWN to OWN (Score:2, Informative)
So I wonder if this invalidates the contest. This just revealed vulns that aren't patched on the contest machines.
Windows before 1997 had relatively few viruses too (Score:4, Informative)
Back in the '80s and early '90s the Mac was a fertile breeding ground for viruses, because of the design of the system. Just putting a floppy in the drive was enough to run code. Apple's response to this was to get rid of automatic execution of code fragments on floppies and in resource forks of documents. This was a normal and sane response to a bad design.
If you want to know why it hasn't been the target of a concerted hacker attack, you have to look elsewhere than the "Windows is insecure by design, OS X and Unix isn't" stuff that's become the prevailing consensus.
While the fact that there are more Windows boxes out there, there are several features of Windows that are insecure-by-design that have had a huge impact on Windows security. In particular, the design of Internet Explorer and the integration of the HTML control into the desktop and email programs had an enormous and direct effect on the spread of viruses and worms on Windows machines all out of proportion to their popularity.
Before the release of "Open Desktop", the virus problem on Windows really was managable without antivirus software. Just following good software hygiene was enough to make viruses a rare problem. Afterwards, I found that simply not allowing the use of IE and Outlook and other components that used the HTML control to display untrusted documents was more effective than antivirus software, because it removed the mosty common point of entry of new viruses.
The sane response to this would have been to back out the desktop-browser integration and redesign the system so that the right to run unsandboxed code was SOLELY mediated by the application displaying the document. Microsoft, instead, attempted to come up with tighter and tighter heuristics as to when to allow documents out of the sandbox, which boggled my mind then and still boggles my mind now.
There are other problems in the design of Windows that I've discussed before, but this one should be more than enough to make my point, especially after you handed me such a great counterexample.