Patches keep coming: Apple fixes OS X security bugs
634378
InfoWorld - The bug fixes kept coming Monday, as Apple shipped critical security updates for its Mac OS X operating system.
459309
Macs still have fewer bugs than Windows PCs, but Apple moves to plug security holes before problems crop up.
21234
Apple kept its rush of year-end security patches coming Monday, issuing a flurry of fixes for its Mac OS X operating system and the test version of its Safari browser.Monday&#39;s patches included a whopping 31 updates for the Apple operating system. The Mac OS X patches fix components ranging from the Address Book and iChat software to under-the-covers operating system components such as ColorSync, the IO Storage Family, and the Perl, Python and Ruby programming languages.Most of these flaws theoretically could be exploited by attackers to run unauthorized software on the Mac, although some of them had other security implications, such as allowing an attacker to gain access to sensitive information or download files to the computer without authorization.These updates are for the Mac OS X 10.4 and 10.5 operating systems, known as Tiger and Leopard, respectively.Apple also released a minor update to its Safari 3 beta code, which runs on Windows as well as Mac OS X, fixing a cross-site scripting security problem that affects Windows users.The patches come just days after&#160;Apple released a major update to its QuickTime media player and a Java security fix for the Mac OS X 10.4 operating system, code-named Tiger. The QuickTime flaw was particularly serious, as&#160;it had been exploited by online criminals since early December.With hackers and security researchers now paying more attention to Apple&#39;s products, the company&#39;s security team has been working overtime on bug fixes this year. Monday&#39;s patches were Apple&#39;s 35th and 36th security updates this year. In 2006, the company released just 22 sets of patches for its products.
594089
InfoWorld - Apple has released its first security updates of the new year, fixing bugs in its QuickTime media player and iPhone and iPod touch devices.
259181
In early October Apple released a small series of patches for Mac OS X version 10.2 and later. Most of the fixes in this group blocked possible denial-of-service problems that are, to date, theoretical.
364789
Patching time again Apple has posted Mac OS X 10.4.8, offering the operating system upgrade for both client and server, and for PowerPC- and Intel-based Macs. The patch incorporates a stack of tweaks, including all of Apple's most recent security updates. You can download the update using the OS' own Software Update utility or from Apple's website.â¦
757864
Apple on Tuesday released its seventh security update this year for Mac OS X, correcting 22 vulnerabilities in total - 18 of which affect the company's latest 10.4.8 version of Tiger. Among the list of fixes is a buffer overflow in the Airport drivers, and four updates to the system's Security Framework.
247413
OS security fix is being rolled out to users who have enabled Automatic Updates.
250588
Apple fixes a critical bug in its QuickTime media player software that had been worrying security experts for nearly a month.
353081
Blog: Recently patched browser from Apple springs another leak.
582193
TechWeb - Apple Computer Inc. has released a patch for 15 Mac OS X flaws, many of them originating from the operating system's open-source components.
629732
Apple has released its first security updates of the new year, fixing bugs in its QuickTime media player and iPhone and iPod touch devices.As with previous updates, the iPhone 1.1.3 software patch sent those who had installed the unauthorized Jailbreak software -- used to run third-party applications on the iPhone -- scrambling to get their phones up and running. That&#39;s because Apple&#39;s updates have so far always rendered Jailbreak unusable, forcing users to go through a complex re-installation process.According to the Unofficial Apple Weblog, it is possible to run third-party software following this latest update, but the process is complex. A simpler Jailbreak 1.1.3 script is expected to be posted eventually at the iPhone Wiki, which is the hub of much iPhone hacking.The iPhone update fixes two flaws in the Safari browser, including a critical bug that could be exploited to run unauthorized software on the device. A third bug could let an unauthorized user bypass Passcode Lock and launch iPhone applications. The iPod touch is susceptible to the Safari bugs, Apple said.These updates will be rolled out to customers over the next week via the devices&#39; iTunes update mechanism.The QuickTime 7.4 update fixes four critical flaws in the software that could be exploited by attackers to crash the media player or even run unauthorized software on a victim&#39;s computer. The update is available for both the Windows and Mac OS X operating systems.However, the software does not fix a serious flaw in the player that was disclosed over the weekend.Security experts are particularly concerned over this flaw because attack code showing how it can be exploited has also been published. Apple is still working to fix the vulnerability, which has to do with QuickTime&#39;s use of the Real-Time Streaming Protocol.
402174
(InfoWorld) - Apple Computer will soon be a member of the "month of bugs" club. On Jan. 1, two security researchers will begin publishing details of a flood of security vulnerabilities in Apple's products.Â Their planÂ is to disclose one bug per day for the entire month, they said Tuesday. The project is being launched by an independent security researcher, Kevin Finisterre, and a hacker known as LMH, who declined to reveal his identity. Some of the bugs "might represent a significant risk," LMH said in an e-mail interview. "Others have a lower impact on security. We are trying to develop working exploits for every issue we find." The two hackers plan to disclose bugs in the Mac OS X kernel as well as in software such as Safari, iTunes, iPhoto and QuickTime, LMH said. Some of the bugs will also affect versions of Apple's software designed to run on Microsoft Corp.'s Windows operating system, he added. LMH was one of the brains behind the recent Month of Kernel Bugs project, which exposed flaws at the core of several different operating systems. It was inspired by an earlier effort, called the Month of Browser Bugs, which was kicked off in July. This latest Apple project is being launched to raise awareness of security vulnerabilities in Apple's products and to "stomp smugness," Finisterre said via e-mail. While the Macintosh is generally considered to be more secure than the Windows PC, many security researchers believe that this reputation is not attributable to any superior security practices on the part of Apple. They say attackers have been deterred by the Mac OS X's more secure Unix kernel and the product's less widespread adoption. Apple enthusiasts and security researchers have been at odds since last August, when David Maynor and Jon Ellch claimed to have discovered a flaw that affected Apple's wireless device drivers. They played a video at the Black Hat conference demonstrating how this flaw could be used to run unauthorized code on a MacBook. However, their claims have been slammed because the demonstration used a third-party wireless card rather than the one that ships with the MacBook, and because the two hackers still have not published the code used in their attack. LMH said the Apple community's negative response to Maynor and Ellch's claims played a role in the decision to launch the Month of Apple bugs. "I was shocked with the reaction of some so-called 'Apple fans,'" he said. "I can't understand why some people react badly to disclosure of issues in their system of choice. ... That helps to improve its security." A similar effort to disclose flaws in Oracle's software had to be abandoned before it was ever launched last month. The man behind the Week of Oracle bugs, Cesar Cerrudo, of Argeniss Information Security, said he pulled the plug when it became clear that the project could damage the relationship between one of his customers and Oracle. "This customer realized that they could have had serious business problems, so they changed their mind and asked to cancel it," he said via instant message on Tuesday. LMH said he didn't expect any legal problems from Apple. "I keep talking to a guy from the Apple security team and I'm willing to help whenever necessary," he said. "I'm far away from any illegal activity." Apple, for its part, did not seem to be upset with the project. "WeÂ always welcome feedback on how to improve security on the Mac," said Anuj Nayar, an Apple spokesman. Â
193189
Update for Mac OS X includes a number of fixes for zero-day vulnerabilities released as part of two high-profile bug-hunting campaigns.
766479
Apple released firmware updates for many of its Mac hardware systems today.
410966
MacCentral - Apple Computer Inc. on Thursday released its third security update in recent days. Security Update 2004-09-16 fixes a security issue with Apple's iChat application that allowed Remote iChat participants can send "links" that can start local programs if clicked.
241113
TechWeb - Apple updates Mac OS X 10.4 to patch 15 vulnerabilities in the operating system and bundled software that can let attackers run malicious code.