Apple blocks Mac OS X security holes
8266
Patch posted Apple has posted a Mac OS X Security Update that patches almost two dozen holes in the Unix-based operating system. The update incorporates fixes for AirPort, Apple Type Services, Finder, Installer, Security Framework, VPN and a raft of other, under-the-hood apps and utilities.â¦
390760
For the second year running, security researcher Kurt Grutzmacher has found a way to get a free &quot;Platinum&quot; pass to the MacWorld Conference &amp; Expo, being held in San Francisco this week.Thanks to a design flaw in the conference&#39;s Web site, he was able to figure out the special promotional code and award himself a 100 percent discount when purchasing the show&#39;s most expensive pass .The problem was that the site was downloading an encrypted version of the promotional codes to the browser so that it could check for discounts before passing data to MacWorld&#39;s Web server. Site developers may have done this to reduce the time it takes to process conference applications, but in doing so they introduced a serious security vulnerability, Grutzmacher said.Although the promotional codes were encrypted, Grutzmacher used a password-cracking tool called John the Ripper to break the encryption and see the discount codes. &quot;I was very surprised it worked,&quot; he said in an e-mail interview.That&#39;s because it was the same technique that yielded a Platinum pass for the 2007 show . At that time, the show&#39;s promoter, IDG World Expo, &quot;removed all the codes, fixed the site, and said thanks,&quot; Grutzmacher said in a Monday blog posting showing how he cracked the site. &quot;I gave them a few tips (don&#39;t trust user input, don&#39;t give your secret codes to everyone, encryption is not one-way, etc). Did they listen? Nope.&quot;Grutzmacher ran his test in the weeks prior to the show, and the code he obtained stopped working on Jan. 7, he said.Show representatives were not immediately available to comment.The security penetration tester went down to San Francisco&#39;s Moscone Center on Monday to print up his pass, just to see if his trick worked, but he didn&#39;t actually use it to visit the show. &quot;That would be very unethical,&quot; he said.Had he made use of the US$1,895 pass, however, Grutzmacher could have had a free lunch, access to sessions at the conference, entry into the MacWorld party and priority access to Steve Jobs&#39; keynote on Tuesday.&quot;Justin,&quot; a commentator on Grutzmacher&#39;s blog, said he reported a similar bug to IDG in 2003.Grutzmacher said that this is probably not the last we&#39;ll hear of this problem. &quot;I suspect we&#39;ll see this again in 2009,&quot; he said.The MacWorld Conference &amp; Expo is run by IDG Wold Expo, an IDG News Service affiliate.
570759
Blog: This rare, tenth update of an Apple OS includes a networking security patch.
542423
Security firm Secunia has posted an advisory about a potential Mac OS X UDIF Memory Corruption Vulnerability. The original source of the report states that the vulnerability is present on a fully-patched Intel-based Mac.
78443
Flaw in the way the Net phone software handles Web links could enable an attacker to launch arbitrary code on some Macs.
476280
TechWeb - Unlike Microsoft and other vendors, Apple doesn't rank or rate the vulnerabilities it patches, but about two-thirds of the bugs could result in an attacker hijacking an unpatched Mac.
413975
(InfoWorld) - One week afterÂ updating its Mac OS X operating system, Apple has patched a serious flaw it its QuickTime media player. The security update to QuickTime 7.1.6, published Tuesday, fixes two issues in the way QuickTime works on the Java platform. The most serious of these problems could give criminals a way of taking control of an unpatched computer, Apple said in a security alert. "By enticing a user to visit a Web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to arbitrary code execution," the alert states. The second bug is considered to be less critical, but it could allow an attacker to have a look into the Web browser's memory and lead to the disclosure of sensitive information, Apple said. This latest QuickTime update is available for both Mac OS and Windows users. Apple's security team has been busy of late. Last week's Mac OS X patches fixed 17 flaws, several of which were considered to be critical. Apple also fixed a similar QuickTime for Java bug on May 1 after this flaw was used to claim a $10,000 Mac hacking prize at the April's CanSecWest security conference.ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
693145
Apple on Thursday released a Security and AirPort update for Mac OS X that fixes vulnerabilities found in the company&#8217;s wireless drivers. Apple said the issues found were the result of an internal audit of the software drivers and that no known exploits exist for the issues addressed in this update.
583119
Debate rages over whether the Mac operating system is inherently safer than Windows. Part of a series on hot security topics.
690423
A new security update is available for Mac OS X users running the program that's part of iLife 08.
443184
MacCentral - Apple Computer Inc. on Thursday released its December security update. The 12.7MB download consists of several updated components including Apache, AppKit, HIToolbox, Kerberos, Postfix, PSNormalizer, Safari and Terminal.
619128
(InfoWorld) - The anonymous researcher who claims to have crafted a Mac OS X worm said Tuesday that he or she will report his findings to Apple Inc., but added that the Cupertino, Calif. company "has a very long way to go" on security. Identified only as the researcher behind the Information Security Sell Out blog, he or she on Sunday announced that a still-unpatched bug in mDNSResponder, a component of Apple's Bonjour automatic network configuring service, could be exploited by a worm. Apple's May security update, dubbed 2007-005, included a fix for the mDNS bug. "[My worm] is in the same code base, obviously, but that is where the similarity to the recently patched issues ends," said the Info Sec researcher in an e-mail interview. "When Apple fixed the previous issues, they did not take care of the entire code base and there are a lot of bugs there...some are exploitable, like the one I am using, while others are not. But the fact remains that Apple did a horrible job in fixing this package." According to Info Sec, the worm is fully automated and ready to use. "It would be considered a fully weaponized exploit and fully automated," said the researcher. "This is really no different than other worms we have seen [on the Windows platform]. Other than that, I am not able to give any more details." Another researcher, however, questioned whether Info Sec crafted the worm in only a few hours, as claimed. "Writing the exploit in one day...unlikely for anything other than a stack overflow," said Dave Aitel, the chief technology officer at Immunity Inc., the Miami Beach, Fla.-based security company best known for its CANVAS penetration testing ("pentest") software. "So most likely he found a stack overflow in mDNS, which is perfectly possible. It is open source, after all." Info Sec didn't detail the vulnerability, but did emphasize that writing the exploit was a breeze. "The hard part is finding the bug," he or she said. "Once you have found it, it is very easy to exploit. The Bonjour (mDNS) service is UDP [User Datagram Protocol, one of the core Internet protocols] Universal as well, making it even more fun for things like worms." But like other researchers who have grown tired of claims that Mac OS X is more secure than rival operating systems, Info Sec saved a last shot for Apple. Although he/she will report the new-found vulnerability to Apple at some point, there is no timetable for the moment. "I do believe in being responsible and working with vendors," said Info Sec, "but I also feel that some vendors need to be treated like children and learn lessons the hard way. Apple has a very long way to go when dealing with security issues in their products." Aitel leaned a bit the same way. In a posting to his DailyDave mailing list Monday in which he pointed out the Info Sec exploit, Aitel said: "I note that 'Infosecurity Sellout' is claiming there is another bug in mDNS which is wormable. This is obviously untrue, since there are no more remote bugs in OS X." That last line was firmly tongue in cheek, Aitel clarified today in an e-mail. "No, I'm just being funny. OS X is horribly insecure," he said. In an e-mailed statement, Apple spokesman Anuj Nayar rebutted. "Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users," he said.
582193
TechWeb - Apple Computer Inc. has released a patch for 15 Mac OS X flaws, many of them originating from the operating system's open-source components.
410966
MacCentral - Apple Computer Inc. on Thursday released its third security update in recent days. Security Update 2004-09-16 fixes a security issue with Apple's iChat application that allowed Remote iChat participants can send "links" that can start local programs if clicked.
634378
InfoWorld - The bug fixes kept coming Monday, as Apple shipped critical security updates for its Mac OS X operating system.
178838
Unsanity Apple support drones are getting an earful from Mac users who are getting the dreaded Blue Screen of Death while trying to update to the latest and greatest version of OS X. This thread on an official Apple support forum has more than 200 posts left in 25 hours at time of writing. A large percentage of the writers report getting a persistent blue screen that forces them to abort their installation of Leopard.â¦
293497
Windows browser not 'secure from day one' Three days after unleashing a bug-infested beta of its Safari browser on Windows users, Apple has released an update plugging three serious holes that could allow miscreants to commandeer a user's machine.â¦