Apple Issues Patches For 25 Security Holes 241
TheCybernator writes "Apple today released software updates to plug more than two dozen security holes in its Mac OS X operating system and other software. The free patches are available via the Mac's built-in Software Update feature or directly from Apple's Web site.
All told, today's batch fixes some 25 distinct security vulnerabilities, including a dangerous flaw present in the AirPort wireless devices built into a number of Apple computers, including the eMac, the iBook, iMac, Powerbook G3 and G4, and the Power Mac G4. Apple said computers with its AirPort Extreme wireless cards are not affected.
Earlier this month, Apple released a software update to fix a vulnerability in its wireless router, the AirPort Extreme Base Station. That update and instructions on how to apply it are available at the link."
cue doodly piano music (Score:5, Funny)
PC: And I'm a PC.
Mac: Steve Jobs just plugged up all my holes
PC: GOODNIGHT! (tapdances off stage)
Re: (Score:3, Funny)
Re:cue doodly piano music (Score:5, Funny)
First day, Mac approaches PC wearing hospital smock
Mac: What's with the smock PC?
PC: I have to upgrade for Vista. I'm a bit scared
Mac: Okay, be cool. I'll send you flowers in the hospital.
Next day: Robust looking PC stands there smiling while Mac runs up in panic.
Mac: Hide me PC! Hide me!
PC: Why, what's up?
Mac: They want to upgrade me!!
PC: Don't be afraid, look at me! Upgrading is great!
Mac: You don't understand!!!
Three guys run up, one shoots Mac dead while PC stands there stunned. Two of them drag off Mac. Third guy in natty sweater stands beside PC
PC: Who are you?
Mac: I'm Mac.
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:2)
( a Mac fan writes)
Re: (Score:2)
It's not saying much that your machine that you bought in 2000 runs OSX just fine, OSX (OSX server) was released in 1999.
but ... (Score:4, Funny)
Re:but ... (Score:5, Insightful)
The Mac ads clearly referred to all the viruses, worms, spyware, etc. Which are VERY common on Windows PCs, and for whatever reason, are very uncommon on Macs. (I don't really care why they are not prevalent on Macs, I just care that my MacBook Pro is free of exploits, as are my Linux servers.)
Patched bugs are a good thing. Bugs are practically unavoidable. Unpatched bugs, as evidenced by rampant exploits, are the real problem.
Re: (Score:2)
Re: (Score:2)
MAC: Hello, I'm a Mac.
PC: And I'm a PC.
PC: Atchoo! Atchoo! Atchoo!
MAC: Gesundheit! Are you okay?
PC: No I'm not OK. I have that virus that's going around.
MAC: Oh yeah.
PC: In fact, you better stay back. This one's a doozy.
MAC: That's okay I'll be fine.
Just what conclusion do you think Apple wants the public to draw from this? Seems to me like they want people to think that Macs are immune to all viruses..Look
Re: (Score:3, Interesting)
And fortunately, that conclusion is correct. You'll notice that these are all pre-emptive fixes to bugs that apple or white hats have discovered, not emergency patches for ongoing exploitation. I'd hazard a guess that the total number of macs compromised by these issues outside of a testing environment is zero.
I'm sorry that your sister was affected by the one mac virus
Quick summary to avoid reading TFA (Score:5, Informative)
The remote attacks seem to be coming out of the Kerebros admin daemon distributed by MIT 3 holes. One hole each in libinfo, portmap, ichat.
Re:Quick summary to avoid reading TFA (Score:5, Insightful)
That's the beauty of Open Source (from Apple's POV).
When things go well: Hey - look at us! We 'support' OSS by leveraging all that free software.
When things go bad: Oh well - it's MIT's software! Not ours...
Seriously - I for one am really glad that one closed O/S vendorout there lets OSS do the heavy lifting security wise on their products. Apple users are left in a far less leaky boat. Thanks MIT, Thanks FOSS, Thanks Apple!
Re: (Score:2, Redundant)
That MIT developed it is relevant because, some admins might be running a home grown versions or ruggadized versions sold by other specialist vendors. Infact every hole clearly says which module is affected to help you decide whether or not you need to update your system. Wish MSFT also would clearly say what is not affected by the hole.
Re: (Score:2)
You mean like how every MS security bulletin has a list of "Affected Software" and then lists each specific operating system version and service pack?
Re:Quick summary to avoid reading TFA (Score:5, Insightful)
Re: (Score:2)
In the context of Linux distributions if it's packaged it is the distributions problem: without smoking incense here, the ecology of the whole distribution is considered to be at risk if there is a security vulnerability in one of the packages in the distribution. You can then rest assured that if you download software beyond what's offered in the already comprehensive repositories, security audited with each updat
Re: (Score:2)
Re: (Score:2, Informative)
Washingtonpost:
Apple [apple.com]:
Re: (Score:2)
I think The Washington Post is just a little shocked. Especially since the Mac "just works" so there shouldn't be any bugs. Plus since OS X is so secure there should never be any exploits either, remote or local.
Re: (Score:2, Insightful)
I administer a network of 50 systems and the only thing protecting those machines is that I don't allow users to execute downloaded software.
Any program which issued those malformed instructions while claiming to allow the users to punch the monkey or something could install the first OS X backdoor worms, installing them with root privileges then effectively hiding themselves.
This flaw allows exactly the same attack as the P2P "hot_teen_action.mpg.exe" tro
Re: (Score:2)
Re: (Score:2)
Another exploit has any logged in user able to to see the keystrokes of other users thus making key-loggers possible. But that is not the worst part, the embarrassing part is that this was supposedly fixed in an ear
Why is this news? (Score:5, Informative)
Is it because these issues/vulnerabilities have been outstanding for a long time? Or perhaps Apple does not patch things often?
It's an honest question, my Ubuntu systems at home have frequent patches rolled out and the staff at work are always talking about another update on their Windows desktops.
Isn't Apple the same?
Re: (Score:3, Insightful)
Re:Why is this news? (Score:5, Interesting)
Compare this to the dense hole descriptions by MSFT. Almost everything affects everything. Even if the bug in Windows is such that "If you dont user IE you are not vulnerable" they cant/wont say it. Wont say it because it will drive FireFox usage up. Cant say it because IE can be invoked by any part of any code. Similarly when a hole in Windows is found, no one seems to know what/who would be affected. Another reason why they dont describe it better is allegedly their fear that the hackers will use it to attack yet unupdated systems. But most hackers use reverse-engineering tools like BlackIce and deconstruct the patch and know precisely how to attack unpatched systems. On the other hand people who might be persuaded to patch their systems faster if the hole description was more specific and pertinent wait because they cant determine whether they are affected. Add to it MSFT's practice of downplaying the bug severity, no wonder MSFT updates are becoming more of a problem than solution.
Re:Why is this news? (Score:5, Informative)
Re: (Score:3, Interesting)
Microsoft's security fixes seem to fix smaller numbers of bugs per update. Recently, they were mostly updates to the malware removal tool, not security fixes.
Re: (Score:2)
Re: (Score:2)
When somebody says "... Apple updates and patches their system constantly compared to Microsoft" that seems to be a exaggerated way of saying that Apple releases patches far more often than Microsoft. In my experience, the opposite is the case. I asked if I was interpreting the comment the right way, and explained why I was q
Re: (Score:2)
Re: (Score:2, Insightful)
Because Microsoft has a lot more to patch.
Re: (Score:2)
As a user of Linux (although I can't speak for Ubuntu), Mac OS and Windows all I can say is.. ehh.. no.
Re: (Score:2, Informative)
I am no M$ fanboy, but they used to push out patches constantly, but most IT shops do not want that. Generally IT shops like to validate the patches before applying them to their machines to make sure poorly written software does not have issues with a patch.
No on in their right mind would push patches out directly to the corporate computers without testing them. By having the patches come out on the same day every month you allow preparation and planning.
Really
Just the facts (Score:5, Interesting)
Vista [secunia.com]
OS X [secunia.com]
Re:Just the facts (Score:5, Informative)
Re: (Score:3, Insightful)
Re:Why is this news? (Score:4, Informative)
I can only think of one in recent memory. The Hong Kong worm http://www.makingpages.org/pagemaker/virus.html [makingpages.org], aka Autostart 9805, was pretty devasting to the pre-press industry which passed around zip cartridges like they were free. This would have been back in 1998.
Paul
Re: (Score:2)
Re: (Score:2)
Windows before 1997 had relatively few viruses too (Score:4, Informative)
Back in the '80s and early '90s the Mac was a fertile breeding ground for viruses, because of the design of the system. Just putting a floppy in the drive was enough to run code. Apple's response to this was to get rid of automatic execution of code fragments on floppies and in resource forks of documents. This was a normal and sane response to a bad design.
If you want to know why it hasn't been the target of a concerted hacker attack, you have to look elsewhere than the "Windows is insecure by design, OS X and Unix isn't" stuff that's become the prevailing consensus.
While the fact that there are more Windows boxes out there, there are several features of Windows that are insecure-by-design that have had a huge impact on Windows security. In particular, the design of Internet Explorer and the integration of the HTML control into the desktop and email programs had an enormous and direct effect on the spread of viruses and worms on Windows machines all out of proportion to their popularity.
Before the release of "Open Desktop", the virus problem on Windows really was managable without antivirus software. Just following good software hygiene was enough to make viruses a rare problem. Afterwards, I found that simply not allowing the use of IE and Outlook and other components that used the HTML control to display untrusted documents was more effective than antivirus software, because it removed the mosty common point of entry of new viruses.
The sane response to this would have been to back out the desktop-browser integration and redesign the system so that the right to run unsandboxed code was SOLELY mediated by the application displaying the document. Microsoft, instead, attempted to come up with tighter and tighter heuristics as to when to allow documents out of the sandbox, which boggled my mind then and still boggles my mind now.
There are other problems in the design of Windows that I've discussed before, but this one should be more than enough to make my point, especially after you handed me such a great counterexample.
Re: (Score:2)
It's not news, it's Fark... wait, wrong site.
But you're right, this isn't news. Mac OS X has bugs and security holes just like every OS that has ever existed. Apple patches them. It's just that they seem to be able to do it before someone wants to try to exploit them.
Re:I'll tell you what's news: (Score:4, Insightful)
I don't do IT, so maybe releasing 25 fixes at once can require 25 separate test cycles. Anybody care to enlighten me?
Re: (Score:2)
There's an argument to be made either way. You could argue that it would be better to QA a patch rollup because you only have to do one test. But you could also argue that it's better to be able to test the patches separately so you can apply all the patches that don't bend you over.
Re: (Score:2)
the difference between Microsoft's way and Apple's way in this case is that Microsoft actually gives you more information about vulnerabilities and is actually less afraid to make themselves look bad than Apple. Maybe that's because Apple operates on looks, and Microsoft operates on lock-in.
Apple has traditionally been and continues to be somewhat sticky on the subject of disclosure.
Regardless, I
Re: (Score:2)
It all depends on the shop, but in general it does. The larger the company, the more likely you are to stage your roll out after a decent testing cycle...or at least that's been my experience. My experience has been that small shops tend to have more variety in the hardware that's out there, so it'd be tougher to get a really good test cycle built and running anyway. It's easier to test
Re: (Score:2)
-matthew
Re: (Score:2)
Re: (Score:3, Funny)
Here's how it works where I work (IT and Software Engineering):
Very simple yet suprisingly time consuming :-)
Re:I'll tell you what's news: (Score:5, Insightful)
Sigh. Have you ever worked in the software development industry. There is this thing called "testing" that some people find important. If you work on Kereberos and find a bug and patch it, you then test just it before distributing. If you work at Apple or Redhat where you are shipping an entire OS with a bunch of packages, it is impossible to patch and test those patches in conjunction with all other hardware in the same timeframe because you have multiple things to patch at once. Thus, the only real solution s to do it in bundles, where you stick a group of patches together then QA them all at once. This results in longer delays for some fixes, but it also means the patch is actually tested in conjunction with the other patches so one does not break another. Any responsible vendor uses this method for dealing with bugs.
Individual developers roll out patches and you could have patched your OS X box from them if you felt it was an emergency for you. As for what Linux vendors do, I don't know of any who roll one-off fixes into the stable branch intended for real use, instead of testing patches in bundles. You don't seem to know what you're talking about.
Re: (Score:2)
Re: (Score:2)
You and everyone else missed the point entirely. Linux provides you a patch ASAP, and you have a choice as to when to install it, whereas Apple and Microsoft and just about every other vendor releases patches on their schedule.
Microsoft makes early announcement of vulnerabilities in some cases, so you at least know there is a problem and can devise a workaround.
Re: (Score:2)
There were at least 20 viruses for various types of Mac OS prior to OS X, and a whole bunch of worms etc. for different versions of MS Office running on those systems (conceptually similar to the Word / Excel macro malware that targeted Windows Office users). Note that these were all "in the wild" malware that infected people, not the sort of "proof of concept
Re: (Score:2)
In other news... (Score:5, Funny)
Why (Score:2, Insightful)
Re:Why (Score:5, Insightful)
Yes, some Windows folks will see this as a "haha" nelson moment. However, it isn't a haha moment until the headline reads that someone found 25 Apple exploits and released a huge virus to exploit them. And while I am firmly planted in my Windows environment, I will not be interested in laughing at my Apple compadres when or if that happens.
Re: (Score:2)
I'm sure you meant a worm not a virus.
However, if there's ever more than 1 Mac for every 1 million* IP addresses then maybe a worm might surface.
I just hope the worm author does something creative with his captive audience. Perhaps some hilarious messagesm, "right click to continue", "dx9.dll missing, please reinstall" or how about changing all their bookmarks to
Re: (Score:2)
People may pretend that their OS is great and infallible, but they all know better.
Because of the nature of the holes patched (Score:2)
As others have said, no operating system is bullet proof
10.3.9 also patched (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
25 holes? Wow. (Score:2)
Re: (Score:2)
Not news... (Score:2, Insightful)
Re: (Score:2, Insightful)
Re: (Score:2)
But I have seen Apple release critical patches out of cycle if the issue was severe enough.
Apple fixes, are they better documented yet? (Score:2)
And as for the MS ObiWan Kenfanboys, just because MS has a constant
Re: (Score:2)
One problem I have with Apple is that their change logs and what's new on releases and patches are poorly documented if ever.
It is funny to make such a comment in an article about Apple's security fixes. Apple's security fixes are poorly documented, unless you compare them to anyone else on the planet's, then they're pretty darn good. They provide a nice, English description of each item patched along with enough info for a normal human to know if the affects them, credit for finding the vulnerabilities, and links to external references when available. They provide the CVE numbers. What more do you want?
MS Patch management (Score:2, Interesting)
This appears to be related to the Microsoft Windows Installer (msi.dll).
Eventually, I tried to uninstall Office XP and start over. The machine refuses do do this with another silent failure. I consid
Re: (Score:2)
The "defectivebydesign" tag is intended for use whenever discussing DRM and the way that technology can and will be changed to further restrict or disenfranchise you from using content on your own hardware, even if you are otherwise completely in the clear by your rights as a consumer and citizen of your particular country. It's defective, but it was intentionally designed to be that way.
Not that it's not misused occasionally by idiots and zealots, but there you are.
Re: (Score:2)
Personally I ignore all tags and I think it's a waste of time to have the whole tagging system. Either the moderators should tag the article or there should be no tag
Re: (Score:2)
A lot of us like the tagging system.
Re: (Score:2)
How many times have you seen an article tagged with "yes", "no", "maybe" and all other sort of contradictory nonsense. Tags literally mean nothing when this sort of thing happens and they now serve no purpose other than being a kind of high-tech graffiti that
Re: (Score:2)
Re: (Score:2, Insightful)
Basically saying, "I'm not screwing the sheep. I'm Merely helping it through the fence."
Re: (Score:2)
Also, any poll on the subject would be useless. All it would tell us is that CowboyNeal is more popular than Vista.
Re: (Score:2)
Webstats would show what /. users use (Score:2)
Actually I'd like to see more discussions about
Re: (Score:3, Informative)
These were bugs, not by design. Apple didn't not specifically in
Re: (Score:3, Insightful)
It means that the designer specifically designed the device to not do something that is normally expected or wanted, or has been designed in such a way as to annoy the user constantly. In other words, they had to work harder to make sure the device did not work. Typical MS things that are defective by design are DRM, Clippy, and that new security thing in Vista that is so annoying.
Ah. So you mean like a media player that can't display full screen videos ?
(It would be interesting to see what you thinkg D
Re: (Score:2)
Re: (Score:2)
I'll admit it. I used to -really- hate Apple computers. After the IIe, and before OS X, I found nothing I liked about them. I used Windows most
Re: (Score:2)
OT: Re:I'd like to propose a tag (Score:2)
For instance, on any article which poses a question, you can invariably find the tags, "yes," "no," and "maybe." But since they're so often together, they're basically redundant: searching any of them brings up the same articles. Better would be to use the tag, "question." but since all of the questions are titled ASK SLASHDOT, even
Re: (Score:2)
Re: (Score:2)
proactive is seeing for potential threat in the future and taking steps to correct them before they happen
There are no more proactive than any other company when it comes to bugs and patches.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Insightful)
As my CS professor said once, "With Windows, you know it's broken right up front, and that you have to take certain steps right away to fix it. such as slap an AV program on. With the various Unix-based OSes, you have to go over every little detail with a fine-toothed comb, putz around in the code, recompile, and all of that other hassle because they p
Re: (Score:2)
Re: (Score:2)
Yeah, Windows users have to put up with a constant stream of hypocritical double standards by rabid Mac Fanboys on Slashdot...
Re: (Score:2, Insightful)
If you think the two are the same, it's no wonder you think they're all fanboys.
Re: (Score:2)
Let's all be honest - the only "secure" system would be one locked in a room nobody was allowed in ever, and not connected to any other machines. An operating system is just that - nothing magical or special about it.
Re: (Score:2, Informative)
Which is somewhat different to, say, the
clearing throat... (Score:2)