Apple Mega Patch Plugs 20 Mac OS X Holes

[Nomad559]

Apple Mega Patch Plugs 20 Mac OS X Holes

Apple Computer late Tuesday released an update to fix a whopping 20 security flaws in its flagship Mac OS X and warned that the most serious bugs could lead to remote code execution attacks.

Apple Computer Inc.'s Security Update 2005-005 includes patches for Mac OS X v10.3.9 and Mac OS X Server v10.3.9. It covers a wide range of vulnerabilities that could be exploited by remote or local attackers to execute arbitrary commands, trigger a denial-of-service condition or obtain elevated privileges.

The mega update comes just two weeks after the Cupertino, Calif.-based computer maker shipped patches for a range of potentially serious kernel and browser flaws. Since April 18, Apple has posted fixes for 28 Mac OS X vulnerabilities.

The latest update includes fixes for a buffer overflow in the Apache htdigest program and an integer overflow in the handling of TIFF files that could permit arbitrary code execution.


http://secunia.com

[benburch]

1. Nice "spin". Not.

Should be Headlined; "Apple reacts to security vulnerabilities 30X faster than Microsoft - Updates software long before hackers could act."

[REP]

2. On The Nose

Apple actually gives a damn about its software and its users. Odd concept, isn't it?

[benburch]

15. Yes, quite odd.

There are some vulnerabilities that have been in Windows for years that still are not closed properly. One of them is called "Outlook".

[ET Awful]

3. Nice spin on your part. So let's see . . .

Someone discovers security flaws, Microsoft releases a patch, they discover a different one, Microsoft releases a patch.

Someone discovers a security flaw, Apple does nothing until 20 of them pile up then releases one patch to cover them all.

I'd rather have a patch for each flaw as it's discovered than have them take their time until 20 are discovered.

[Omphaloskepsis]

4. Did anyone get hurt while waiting for the mega-pack from Apple?

They might have been discovered inside Apple. And they might want to test them before releasing patches that break patches and need to be patched in the future to prevent opening holes in other patches.

[Nomad559]

6. Maybe

Apple should have tested Tiger a little longer before releasing It.

Freezes during shutdown or startup
http://www.macfixit.com/article.php?story=20050501224359738

http://www.macfixit.com/article.php?story=20050503073111604


Symantec report says more hackers targeting Mac OS X
http://www.gxo.com/more.php?id=554_0_1_0_M14

[REP]

5. Uh huh. Like That Open Port Problem Micro Rushed To Fix

:rofl:

[benburch]

14. Umm...

Microsoft takes MONTHS to release a patch. And totally fails to patch many holes. (There are some they do not have a means of closing, folks.)

None of these vulnerabilities were much older than late March.

[ET Awful]

16. Aren't you the same person that was saying that Macs were

invulnerable to attacks that executed unwanted code because of the very structure of the OS? I'm pretty sure it was you or one of your brethren.

[benburch]

17. No, what I was saying was...

that BSD derived operating systems like MacOS-X where the majority of applications are open source are extraordinarily hard to infect because vulnerabilities are closed so quickly after they are found. As a result, even a successful virus cannot find enough vectors to reproduce and spread. If there is a fault with the core operating system, it is a fault that hundreds of eyes have looked for and failed to see.

Whereas the only people who ever see Microsoft's code are (with minor exceptions) Microsoft. Having myself written cutting edge drivers for Windows, I know for a fact that Windows has a lot of undocumented and untested stuff in it and that even Microsoft is sometimes at a loss as to what a particular API is supposed to do, exactly. It is code like that that is a fertile ground for hackers, and they find new holes much more quickly than they get closed.

So, the difference is that MacOS X and other *nix clones are remarkably well engineered and documented, with thousands of people looking at the code to find and fix bugs. Microsoft Windows, while having a very solid core in NT, has promulgated feature rich undocumented APIs driven by marketing and by internal needs at Microsoft without regard to the security consequences of these components when used by an unfriendly programmer.

[lateo]

7. All OS' will have holes in them.

I "is" odd that Apple waited until they released a single update to fix 20 of them...and some of them the most serious ones.

They could learn a lesson from MS here.

[chenGOD]

8. It could be that they just found all 20 in a short period

while doing some extensive testing?

MS only updates once a month, the article blurb there said Apple's last patch release was April 18th, and it's now only May 4th...

I have both a Mac and a Windows based machine at home...they both work well....

[Nomad559]

10. April 18th

Apple did not release any patches on the 18th.

Apple Support Downloads
http://www.apple.com/support/downloads

[chenGOD]

12. ah my mistake , I misread the article...and misspoke...

they have released 28 patches since April 18th...

[Ellen Forradalom]

9. Stop the MS/Apple flame war, already

The previous poster is correct--all OSes have holes. And it makes sense that as Mac OS X becomes more prevalent, it becomes a more inviting target for hackers.

As long as the OS vendors stay on top of this stuff. That's all I say.

[Redstone]

11. Which those of us who still use good old System 9 can blithely ignore.

Dock? We don't need no esteenking Dock!

Redstone

[chenGOD]

13. My G3 still runs 8.6...:)

Works great....