Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
OS X Businesses Operating Systems Security Apple

Security Update 2003-08-14 Released 63

Posted by pudge from the if-you-can-read-this-you-are-not-in-nyc dept.
Delta-9 writes "Today, Apple released Security Update 2003-08-14, which 'addresses a potential vulnerability in the fb_realpath() function which could allow a local or remote user to gain unauthorized root privileges to a system.'" It's on Software Update, and will likely soon appear on the support downloads page.
This discussion has been archived. No new comments can be posted.

Security Update 2003-08-14 Released More

Security Update 2003-08-14 Released

Comments Filter:

  • Good work Apple (Score:5, Interesting)

    by wyvern5 ( 565676 ) on Thursday August 14, 2003 @05:46PM (#6700159)
    Nice to see Apple is responding more quickly to security problems. I didn't even hear about this through my regular channels until after I had seen the update in Software Update.

  • Some info about the vulnerability (Score:3, Informative)

    by remahl ( 698283 ) on Thursday August 14, 2003 @05:46PM (#6700162)
    The security update addresses the following vulnerability: http://isec.pl/vulnerabilities/isec-0011-wu-ftpd.t xt Users who haven't activated the FTP server in the Sharing preference pane should not be vulnerable in any way to this bug. Furthermore, FTP servers running with anonymous access, aren't vulnerable either (unless anonymous write access is enabled), since the overflow exploit requires creating deep hierarchies of directories. Only users with regular accounts on the machine can use this bug to gain more privileges on the machine. The advisory claims to have successfully exploited the problem on several Linux i386 platforms, but they "believe that exploitation of other little-endian systems is also possible". Note "litle-endian". This may suggest that the bug is not exploitable in a useful way on big-endian machines (like all Mac's, for example). Or it may simply suggest that they haven't investigated the matter thoroughly on big-endian processors. The advisory was posted some full two weeks ago, meaning that Apple was not as quick to respond as they normally are. Perhaps they were a bit too involved in Panther right now, and had to let this relatively minor insecurity wait a little while.

    • Ok, people. I'm really sorry. (Score:5, Informative)

      by remahl ( 698283 ) on Thursday August 14, 2003 @06:53PM (#6700911)

      It looks like I jumped the gun on this...On several levels...

      First, wu-ftpd is not the ftp server in Mac OS X. lukemftpd is.

      Second, the most relevant advisory is not the quoted one, but this one (which previously appeared on Slashdot): FreeBSD-SA-03:08.realpath [freebsd.org].

      As the name implies, the bug originates from FreeBSD, and potentially leaves a long list of programs vulnerable (listed in the advisory).

      This means that the problem is broader than my original message anticipated. It means that other remote services may be vulnerable, including sftp.

      Thanks to the anonymous user who brought my attention to my (pretty bad) mistake.

      Please spread this information instead of the wrongful information in the parent post. Mod parent down.

    • Re:Some info about the vulnerability (Score:5, Insightful)

      by zpok ( 604055 ) on Thursday August 14, 2003 @08:35PM (#6701853) Homepage
      The advisory was posted some full two weeks ago, meaning that Apple was not as quick to respond as they normally are.

      The East Coast has reverted to the stone age, my Windows machine is insulting me, but there's Apple with another Security Update for a *potential* weakness...

      Damn, you've got to admire their timing ;-)
  • Did anyone notice that the email that went out to the mailing list had a bad signature???
  • As soon as the update finished downloading, I was no longer able to launch Camino, Firebird, or Mozilla. In other words, any Mozilla-based browser. Can anyone else confirm that???

  • Odd Side Effect?! (Score:3, Interesting)

    by juniormaj ( 654084 ) on Thursday August 14, 2003 @11:57PM (#6703021)
    I've posted this elsewhere, also. I know this seems odd, but imagine my surprise. In my home/Documents folder I have a subfolder named "Unstuffed". I have dircted Stuffit to place all of its results in this folder. It's been there for over a year. After running todays security update the subfolder was renamed "Documents", and a file called "Documents.1" was created in the original "Documents" folder. So now, in my home/Documents folder I have a subfolder called "Documents" (with the contents of the old "Unstuffed" folder) and a strange zero k file called "Documents.1". Never seen that happen before.

  • Zoom Zoom! (Score:1, Offtopic)

    by Farley Mullet ( 604326 )

    It's amazing how fast that download went, what with half the computers in the U.S. offline. Slashdot, on the other hand, is crawling for some reason. Could be that most of Ontario still doesn't have power, so there are fewer local links to the backbone.

  • OSX 10.1.5? (Score:3, Interesting)

    by HSpirit ( 519997 ) on Friday August 15, 2003 @07:44AM (#6704442)

    My reading of the issue on the FreeBSD advisory [freebsd.org] is that it is likely 10.1.x is affected by this too.

    Can anyone confirm?

    Is a fix from Apple likely? I would find it very disappointing if Apple have stopped issuing security fixes for this OS - even Microsoft support their previous generation products (Windows 2000 Professional, for example).

    If not, given this affects the (open-source) Darwin core of the OS, is a patch to the affected library/ies a possibility?

    • After examining my 10.1.5 server it appears the standard ftp server is not lukemftpd.

      The advisory states that ftpd is not affected by the bug.

      So at least that deamon isn't vunerable. But others can be. It would be nice to have apple release an update for these systems.

  • Not Panther (Score:3, Informative)

    by Draoi ( 99421 ) <.draiocht. .at. .mac.com.> on Friday August 15, 2003 @12:12PM (#6705940)
    I've just tried running it on Panther DP1 & it doesn't want to install.Better wait, I guess ...

    Furthermore, I just noticed that the installer said; "The installer needs to run a program to determine if it can be installed. Do you want to continue?" - that's a cool security feature!

    Oh, and the update is now up on Apple's downloads page [apple.com]

  • Reboot Reqired (sigh) (Score:4, Interesting)

    by Jeremy Erwin ( 2054 ) on Friday August 15, 2003 @12:13PM (#6705949) Journal
    Another update, another reboot. Sigh.. When is Apple going to stop requiring reboots?
    And they do require them,as I discovered last night. I wanted to install 10.2.0 on another machine. Rather than try to download a whopping 100Megs of updates, I would use the 6 mini updates I already had to upgrade the computer to 10.2.6. And rather than repeat the install-reboot cycle a half dozen times, I would mount the other machine as a Firewire drive on my 10.2.6 machine. No reboots required, right?

    Well, half an hour later, with the 10.2.6 upgrades installed, I boot up. Nothing except a grey screen with an Apple logo. No cyclic symbol. The only way to solve the problem was to reinstall 10.2.0, and upgrade piecemeal, rebooting each time.

    • Re:Reboot Reqired (sigh) (Score:5, Interesting)

      by mkldev ( 219128 ) on Friday August 15, 2003 @02:32PM (#6706925) Homepage
      I tend to ignore the request to reboot and simply force-quit the installer, then continue working until it is convenient to reboot (which may or may not be that day). The only exception is when I'm installing a new device driver. To make the device driver usable, I do a "sudo kill -HUP xxx" where xxx is the PID of kextd.

      In the case of a security update that changes libraries, though, it's prudent to reboot, or at least shut down any daemon processes and restart them.... Anything newly launched will be bound to the new library, but anything already running will continue using the old one, hence any program that uses the buggy function needs to be restarted. A reboot is certainly the easiest way. :-)

    • More often than not, the reboots are *technically* unnecessary. Sometimes the reboots are just to ensure some daemon gets reloaded correctly and by the correct parent process. It could be done with a script, but could easily be foiled by the unknown state of any given user's machine.

      Finally, sometimes reboots are necessary because they are replacing/updating the kernel itself. IANAKE (I am not a kernel engineer), but I have heard that not all kernel alterations can be done without reboot.

      For the record,

    • Another update, another reboot. Sigh.. When is Apple going to stop requiring reboots?

      Yeah, you know what else sucks? I have to turn off my car to work on the engine. Its a huge pain in the ass, you gotta get out and walk around....

      In seriousness, OS X is sooo much better than OS 9 in this regard. Device drivers don't usually need a reboot, just security updates and really low-level stuff... and these are things you want to reboot for, to take advantage of the improvements!

      Besides, if you want to, you

  • Well, I ran this security update this morning, and the XP security updates a few days ago, and now my PowerBook and Compaq refuse to talk to each other. It seems one update or the other broke SMB between the 2 platforms, because it worked fine last week.

    Now, after I try to connect to the XP box, it tries & then won't do it. A few moments later, it gives me that very annoying, very modal dialog box that grays out everything else, and says (in several languages) that I need to reboot. Ugh! Anyone

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close