Apple keeps critical security fixes to itself
406616
Insecurity through obscurity Apple has released updates for two widely distributed products that harbored a raft of security vulnerabilities, some of which were actively being exploited by miscreants. Unbelievably, the company isn't presenting either as a security fix to mainstream users despite the risk the bugs pose for its millions of users.â¦
766050
As Apple continues to grow its worldwide market share and the company's products find their way into more business environments, attackers are certain to follow and create greater volumes of exploits aimed at vulnerabilities in the company's software, security experts contend.
143560
InfoWorld - Apple may have a jones for secrecy, but that doesn&#39;t mean it can keep its partners quiet.
673126
Apple released its fifth security update of 2007 on Friday, correcting 13 bugs in both client and server versions of its Mac OS X operating system. The most serious security hole could lead to arbitrary code execution or a denial of service attack, although most require local access to the Mac.
449839
PC Magazine - The security update, which aims to fix 12 flaws in the company's Mac operating systems, comes at a time when Apple's security practices have come under an increasing amount of scrutiny.
208854
The problem that I have with some of the iPhone alarmism is that it leaves an impression that enterprise data is highly secure and that there aren't lots of other potentially much larger holes on which to focus.
582193
TechWeb - Apple Computer Inc. has released a patch for 15 Mac OS X flaws, many of them originating from the operating system's open-source components.
690423
A new security update is available for Mac OS X users running the program that's part of iLife 08.
10049
Apple's latest security updates for QuickTime, iPhone and iPod Touch are available for download.
21234
Apple kept its rush of year-end security patches coming Monday, issuing a flurry of fixes for its Mac OS X operating system and the test version of its Safari browser.Monday&#39;s patches included a whopping 31 updates for the Apple operating system. The Mac OS X patches fix components ranging from the Address Book and iChat software to under-the-covers operating system components such as ColorSync, the IO Storage Family, and the Perl, Python and Ruby programming languages.Most of these flaws theoretically could be exploited by attackers to run unauthorized software on the Mac, although some of them had other security implications, such as allowing an attacker to gain access to sensitive information or download files to the computer without authorization.These updates are for the Mac OS X 10.4 and 10.5 operating systems, known as Tiger and Leopard, respectively.Apple also released a minor update to its Safari 3 beta code, which runs on Windows as well as Mac OS X, fixing a cross-site scripting security problem that affects Windows users.The patches come just days after&#160;Apple released a major update to its QuickTime media player and a Java security fix for the Mac OS X 10.4 operating system, code-named Tiger. The QuickTime flaw was particularly serious, as&#160;it had been exploited by online criminals since early December.With hackers and security researchers now paying more attention to Apple&#39;s products, the company&#39;s security team has been working overtime on bug fixes this year. Monday&#39;s patches were Apple&#39;s 35th and 36th security updates this year. In 2006, the company released just 22 sets of patches for its products.
460090
NOVEMBER 11, 2004  - In sharp contrast to last month&#39;s barrage of critical patches, Microsoft Corp. on Tuesday offered up just one &quot;important&quot; fix for users to implement in its scheduled round of security updates for November.
750699
Bundle of fixes includes patch for zero-day Wi-Fi hijack flaw and other bugs, some that could let an attacker commandeer Macs.
664794
Apple unveiled the year's fifth major security update for Mac OS X to patch 17 vulnerabilities.
570759
Blog: This rare, tenth update of an Apple OS includes a networking security patch.
68810
Rare, out-of-cycle Windows patch fixes one flaw, but attacks through other known, yet-to-be-plugged holes continue.
757260
(InfoWorld) - Apple on Thursday unveiled the year's fifth major security update for Mac OS X to patch 17 vulnerabilities, but fewer than one-third of them could lead to hackers injecting their own code into a compromised system. Thursday's release also marked the first time this year that an operating system security update from Apple did not patch a vulnerability disclosed by the January Month of Apple Bugs project. If Apple sorted bugs by a ranking system -- as do other vendors, including Microsoft Corp. -- most of the bugs fixed by Security Update 2007-005 would be rated less than critical. In eight out of the 17, for example, exploits could do no more damage than to generate a denial of service of, or crash, the affected component. Microsoft typically pegs such vulnerabilities as "important" rather than "critical." Only five of the patched vulnerabilities could result in an attacker executing his own code. Among the serious bugs is one in how Mac OS X 10.4, known as Tiger, handles PDF files. "By enticing a user to open a maliciously crafted PDF file, an attacker could trigger the overflow, which may lead to an unexpected application termination or arbitrary code execution," Apple's advisory said. Attacks sporting this strategy, although rare on Macs, are common threats faced by Windows users, who have had to learn -- sometimes unsuccessfully -- to be wary of unexpected file attachments. Another dangerous flaw fixed Thursday exists in the code that maps ports on home networks in iChat, Apple's instant messaging service and software. An attacker need only send a malformed packet to trigger a buffer overflow, which could then be used to add malicious code to the Mac. The hacker, however, must have access to the local network to exploit the bug. Other parts of Mac OS X that were patched Thursday include BIND (Berkeley Internet Name Domain), the de facto standard Domain Name System server software, which was patched against four vulnerabilities; the Ruby CGI library (two vulnerabilities); and Fetchmail (one vulnerability). Although Thursday's update pushed Apple's year-to-date patch total to over 100, there was a bright side: It included fixes for fewer flaws thanÂ last monthÂ (25) and the month before (45). The security update can be downloaded from theÂ Apple siteÂ or using Mac OS X's built-in update service.
504627
The company warns of serious vulnerabilities in its IOS software, releases update.