Apple Releases Security Update for Mac OS X
449839
PC Magazine - The security update, which aims to fix 12 flaws in the company's Mac operating systems, comes at a time when Apple's security practices have come under an increasing amount of scrutiny.
601095
Apple on Monday put out new releases of iTunes and QuickTime for both Mac OS X and Windows, adding support for the company's Apple TV product in the former and patching 8 serious security holes in the latter.
489727
Apple touts eleven specific features it says will make Leopard secure.
22583
Switch to manual Apple has released an updated version of its popular QuickTime media playback software that fixes eight security vulnerabilities.â¦
378096
Apple Computer last week released a security patch for its Mac OS X iChat instant messaging client, which contains a flaw that hackers could use to takeover a person&#39;s computer.
278896
Apple issued security updates to patch four vulnerabilities in Mac OS X and the Safari beta.
757864
Apple on Tuesday released its seventh security update this year for Mac OS X, correcting 22 vulnerabilities in total - 18 of which affect the company's latest 10.4.8 version of Tiger. Among the list of fixes is a buffer overflow in the Airport drivers, and four updates to the system's Security Framework.
288126
Apple Remote Desktop has been updated adding support for Mac OS X Leopard, as well as several new features.
660602
The security features introduced in Apple&#39;s Leopard operating system need work. That&#39;s according to security experts who have been putting the new version of Mac OS X through its paces since&#160;the upgrade was introduced&#160;last Friday.Leopard introduces a number of important security features to the Mac, but they are often implemented incompletely, leaving users vulnerable to attack, said Thomas Ptacek, a researcher at Matasano Security, who Monday wrote a detailed assessment of Leopard&#39;s security.&quot;They&#39;ve done a really good job of robbing Microsoft advocates of their talking points,&quot; he said. But, &quot;I don&#39;t see anything that they&#39;ve done out of the box, where it&#39;s really any more resistant to attack than Tiger was,&quot; he added, referring to the previous update to Apple&#39;s operating system.According to Ptacek, two of Apple&#39;s key security enhancements -- Sandboxing and Library Randomization -- are great ideas that are imperfectly applied within Leopard.Take Library Randomization. It&#39;s a new feature that&#39;s supposed to make it hard for some of the most commonly used computer attacks like buffer overflows, where the attacker takes advantage of a software bug to place code somewhere in the computer&#39;s memory where he knows it will be run. Microsoft developed a similar technology for Vista, called Address Space Load Randomization. Library Randomization makes it much harder, if not impossible, for the attacker to know where to place this code, reducing the risk of attack.The problem is that Apple did not randomize all of the parts of the operating system that it should have, according to Ptacek. In particular, Apple&#39;s Dynamic Link Library has not been randomized.Security researcher Dino Dai Zovi said he&#39;s used this library in several of the Mac exploits he&#39;s written over the past few years. He has taken advantage of the fact that this library is not randomized, he agreed with Ptacek&#39;s assessment that this feature, as it&#39;s implemented in Leopard, would simply make things a little more difficult for attackers.Sandboxing is another feature that could ultimately make Mac OS X more secure. Sandboxing restricts software running on Mac OS so that even if it&#39;s hacked, it can&#39;t do things that it shouldn&#39;t, such as add new software to the computer. The problem is that Apple hasn&#39;t sandboxed many of the most commonly attacked applications such as the browser, mail client, or instant messaging software, Ptacek said.And the programs that have been sandboxed have not been walled off as thoroughly as they should be, he added.For example, the Quick Look file viewer has been sandboxed, but only to restrict network access. The software can still be misused to write malicious files where they will be automatically launched, Dai Zovi said. &quot;Most of the things that were sandboxed were network services,&quot; he said. &quot;Increasingly these days IM, e-mail and Web surfing are where most of the attacks are coming from, not directly on your network.&quot;Independent consultant Rich Mogull said that his biggest problem was with the Leopard firewall, which he said suffered from a confusing interface that made it very difficult to control access to individual services on the Mac. &quot;It was very complicated and very hard to get the right settings,&quot; he said.Worse, when he installed Leopard, he found himself suddenly without a firewall. &quot;It turned off my firewall when I upgraded, despite that being a default setting.&quot; he said.Like Ptacek and Dai Zovi, Mogull said he had been expecting more from Apple with the Leopard release, but he agreed that the new security features were a step in the right direction. &quot;I think that Apple has started down the right path but they are not as far as they communicated that they would be,&quot; he said. &quot;The firewall is the big negative; they really messed that up.&quot;Apple declined to comment in detail on its new security features. Company spokesman Anuj Nayar said via e-mail that &quot;Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users.&quot;Ptacek said that it is great that Apple has begun adding these security features even when the Mac has not been the target of a widespread worm or virus outbreak. &quot;I&#39;m impressed that when they didn&#39;t have to do it, they went after low-level features that no one will understand,&quot; he said. &quot;I like the direction they&#39;re headed. I&#39;m just saying that they&#39;ve got a long way to go to catch up with Microsoft.&quot;&#160;
259181
In early October Apple released a small series of patches for Mac OS X version 10.2 and later. Most of the fixes in this group blocked possible denial-of-service problems that are, to date, theoretical.
443184
MacCentral - Apple Computer Inc. on Thursday released its December security update. The 12.7MB download consists of several updated components including Apache, AppKit, HIToolbox, Kerberos, Postfix, PSNormalizer, Safari and Terminal.
576268
The bug fixes kept coming Monday, as Apple shipped critical security updates for its Mac OS X operating system.
640592
PC Magazine - The update addresses at least nine high-risk vulnerabilities affecting Windows, Mac and Linux machines.
241113
TechWeb - Apple updates Mac OS X 10.4 to patch 15 vulnerabilities in the operating system and bundled software that can let attackers run malicious code.
230996
Blog: Microsoft revises one of its critical security bulletins from patch Tuesday, now including a fix for Microsoft Office 2004 for the Mac.
68126
Apple has posted a software update specifically for MacBook Pro laptops running at 2.2GHz and 2.4GHz.
489441
Apple gave Apple Developer Connection members a mostly complete version of its latest OS last Friday. Is Apple getting close to unchaining Mac OS X 10.5 Leopard?