Skype patches Mac OS X flaw
621135
Calling out for an update Skype has released an update for its Mac software following the discovery of a security vulnerability that created a means to compromise Apple PCs running the popular IP telephony application.â¦
634120
Apple's update to Mac OS X 10.4.10 last week is driving some users crazy from a new popping sound.
447903
This Quicktime buffer overflow vulnerability appears to be different from a similar vulnerability  patched by Apple in December 2007.
192259
Skype has been forced to turn off a video-sharing feature in its software because it could be misused to launch a self-copying worm attack against Skype users, security researchers said Tuesday.A bug in the software, which was first reported last Thursday by security researcher Aviv Raff, stems from the way Skype uses an Internet Explorer component to render HTML.Skype&#39;s video-sharing feature allows users to share videos hosted on two sites -- Dailymotion.com and Metacafe.com -- while chatting with other Skype users.Last week Raff showed how attackers could exploit the bug to run unauthorized software on a Skype user&#39;s PC. But on Tuesday, the security researcher said the flaw was more serious than he&#39;d first thought. It can &quot;be triggered by simply visiting a Web site, or clicking on a link from your instant messaging application,&quot; he wrote in a blog posting, &quot;Which basically means that this vulnerability is now wormable.&quot;Skype appeared to have pulled the video feature from its client software on Tuesday as a result of the bug. Users who attempted to click on the &quot;videos&quot; button within a chat window were greeted with a message that the feature was unavailable &quot;because of some security concerns.&quot;&quot;Our brightest engineers are rattling their wrenches to make things all right and bring the beloved videos back. Soon,&quot; the message read. &quot;Sorry about this.&quot;Skpe representatives did not return calls seeking comment. Last week, Skype spokesman Villu Arak confirmed that there was a security problem for Skype 3.5 and 3.6 users who visited the Dailymotion.com Web site, but users were still able to share videos using Metacafe.com.On Tuesday, however, Skype pulled the video feature altogether after being informed of the new problem, Raff said.Because Metacafe had a cross-site scripting flaw, a common type of programming error, Raff was able to run JavaScript on Metacafe.com, which could then be used to run unauthorized software on the victim&#39;s computer. Attackers could then forward a link to the malicious Web page to all of the Skype contacts in the victim&#39;s computer, spreading the infection.For Raff&#39;s attack to work, an attacker would have to post a maliciously encoded video file to either of the Metacafe or Dailymotion Web sites. Metacafe said Tuesday that it&#39;s &quot;highly unlikely&quot; that this kind of malicious video would make it through the site&#39;s content-filtering process.In a statement, the company said it expects Metacafe videos to be available to Skype users as early as Wednesday morning.Raff said that because the attack could lead to a widespread worm outbreak, it would be better for Skype to fix the underlying problem before bringing Metacafe back online.Raff believes that Dailymotion was probably susceptible to this type of attack as well, although he was unable to confirm this after Skype cut off access to the Web site.The problem lies in the fact that Skype uses a Windows Internet Explorer component with inappropriate security settings, researchers say. Instead of processing pages it renders with the more secure &quot;Internet Zone&quot; security setting, Skype uses IE&#39;s &quot;Local Zone&quot; security setting, usually reserved for more trustworthy content.Until Skype engineers make some changes to their software, more of these problems will continue to pop up, Raff said.Another security researcher who has been studying the flaw agreed.&quot;If they keep their Skype client running in the Local Zone of IE, we will see more of these,&quot; said Petko Petkov of GNU Citizen via instant message. &quot;Before killing Metacafe, anyone who owns the server would have been able to own every Skype user on the planet.&quot;
769301
InfoWorld - A programming error in eBay's Skype communications software could give cybercriminals a new way to sneak their malicious software onto a victim's PC.
300799
Skype Technologies SA has launched the beta version of Skype for Mac OS X. The software can be downloaded for free and is available immediately.
633142
(InfoWorld) - Apple Inc. Friday issued security updates to patch four vulnerabilities in Mac OS X and the Safari beta, marking the second time in eight days that the company has had to fix its newest browser, which runs on both Mac and Windows XP and Vista machines. The 2007-006 update for Mac OS X 10.3, "Panther" and 10.4 "Tiger," fixes a pair of problems in Safari -- the production-quality versions bundled with the operating system -- including a memory corruption vulnerability that could end with an attacker in control of the Mac. "Visiting a maliciously crafted Web page may lead to an unexpected application termination or arbitrary code execution," Apple said in its alert. The second bug, and to Apple, the less serious of the two, is a cross-site scripting flaw (XSS) in Safari that could be used by phishing sites to steal usernames and passwords. Apple Friday also updated the Safari beta, first released June 11, to version 3.0.2 for both Mac and Windows. Mac Safari 3.0.2 patches another XSS bug, while the Windows edition fixes that, plus a separate vulnerability that could let an attacker disguise the browser's address bar, perhaps as part of a spoofed site meant to trick users into divulging confidential information, such as bank account passwords. For Mac users, 2007-006 and the Safari update are mutually exclusive. If a Mac user has installed Safari Beta 3, only the Safari update will be offered; users who haven't bothered to try out the beta will see only the standard Mac OS X update. Windows users can update Safari to 3.0.2 by downloading the new version from Apple's site, or by running the optional Apple Software Update utility. The just-patched Safari bugs were credited to a team at Adobe Systems Inc., as well as to researchers at Westnet, an Australian Internet service provider, and Westpoint Ltd., a U.K.-based security company. None were accredited to Dave Maynor, one of several researchers who dug up vulnerabilities within a few hours of Safari 3.0's launch last week. Maynor, who said he had found half-a-dozen bugs straight away, refuses to disclose his findings to Apple, part of a year-long feud that goes back to a wireless hack demo Maynor and another researcher gave at last August's Black Hat security conference. "Due to the cries of 'it doesn't count, it's beta,' we are waiting to release any further information till the browser is released in a final state," Maynor said in an e-mail earlier this week.
282967
Internet communications company Skype has released Skype for Mac 2.0, a beta version of its video calling software for Apple's Mac systems. The new version is intended to streamline video conferencing between PCs and Macs.
713098
The bug fixes kept coming Monday, as Apple shipped critical security updates for its Mac OS X operating system.The latest security updates fix 11&#160;bugs in the Mac operating system, including eight bugs in the recently released Mac OS X 10.5, known as &quot;Leopard.&quot; Apple released the security fixes in conjunction with an 10.5.2 update to Leopard, which includes dozens of other updates.Some of the security flaws are extremely serious, and could be exploited by hackers to run unauthorized software on a victim&#39;s computer, although Apple did not report any incidents of this occurring.The patches include fixes for Safari, Mail, Launch Services, the Mac OS Directory Services, Open Directory and Parental Controls. There are also patches for several Unix components that ship with Apple&#39;s software, including a recently patched flaw in the Samba file-and-print software.&quot;The Samba bug was expected, since all the open-source distributions released fixes a while ago,&quot; said Andrew Storms, nCircle&#39;s director of security operations, via instant message.It&#39;s been a busy time for software developers working on some widely used software products.Apple&#39;s patches come a day before&#160;Microsoft is set to issue a massive set of updates&#160;itself. Last week, the software vendor said it expected to release 12 security updates for a variety of products including critical updates for Windows, Internet Explorer and Office.Last week other&#160;critical patches were also released for Adobe Reader&#160;and Apple&#39;s QuickTime media player.&#160;
744060
Some Skype users were left vulnerable to a possible worm attack Wednesday after company technicians failed to disable a buggy component of the network.Skype&#160;pulled the plug on its &quot;Add Video to Chat&quot; feature&#160;Tuesday after security researcher Aviv Raff reported that it suffered from a serious vulnerability. An attacker could create a self-copying worm program that could be used to&#160;install malicious software on victims&#39; machines&#160;and then go on to infect other Skype users.&quot;Add Video to Chat&quot; lets users pick videos from two sites -- Dailymotion.com and Metacafe.com -- and add them to their Skype chat sessions.Skype blocked access to these sites Tuesday after Raff&#39;s disclosure, effectively disabling the feature.But because of a misconfigured Skype proxy server, some users were still allowed to access the Metacafe videos, leaving them vulnerable to an attack, said Raff, who had been in discussions with Skype engineering staff over this issue.Because Raff has not publicly released his exploit code, the oversight probably doesn&#39;t pose a serious security risk for most Skype users, Raff noted.Skype expects to patch the underlying vulnerability sometime next week, said a spokeswoman for Metacafe. That&#39;s later than previously expected. On Tuesday, Metacafe said that a patch was due early Wednesday morning.Metacafe believes it&#39;s unlikely that an attacker could successfully exploit the flaw in a widespread attack, but with Raff&#39;s proof of concept code, a Skype user has to simply click on a maliciously crafted Web link in order to be infected.According to Raff, Skype uses a Windows Internet Explorer component with an inappropriate security setting. Instead of rendering HTML from the Internet with the more secure &quot;Internet Zone&quot; security setting, Skype uses IE&#39;s &quot;Local Zone&quot; security setting, usually reserved for more trustworthy content.Skype representatives did not return calls seeking comment for this story.
8266
Patch posted Apple has posted a Mac OS X Security Update that patches almost two dozen holes in the Unix-based operating system. The update incorporates fixes for AirPort, Apple Type Services, Finder, Installer, Security Framework, VPN and a raft of other, under-the-hood apps and utilities.â¦
462749
Skype for Windows, Skype for Pocket PC and Skype for Linux -- Skype for Mac OS X is free. Skype users can control their online presence and
663104
Apple has released a new security patch for QuickTime, its eighth update this year for the media player software.The update addresses three critical security holes in QuickTime, including a vulnerability that has been used in attacks by online criminals.The most critical of the flaws lies in QuickTime&#39;s implementation of the Real Time Streaming Protocol (RTSP), used to play audio and video over the Internet. The flaw was made public Nov. 23, and in early December&#160;attackers began exploiting the flaw in online attacks. By tricking victims into visiting a malicious Web site that exploited the flaw, hackers were able to install malicious software on the victims&#39; PCs.To date, these attacks have targeted Windows-based systems, but security experts say that Mac OS X users are also at risk to the vulnerability. Apple issued patches for both Windows and Mac OS X users on Thursday.The second critical vulnerability, which had apparently not been publicly disclosed , has to do with a flaw in the QuickTime Media Link (QTL) file format used by the media player. Security researchers have recently been looking at the way QuickTime works with these files as a potential source of new bugs.Apple also patched a handful of similar bugs in the way that QuickTime handles Adobe&#39;s Flash media format. The most serious of these flaws could let attackers run unauthorized software on the computer, much as the RTSP bug does, Apple said.With security researchers paying special attention to media format bugs, Apple has had to patch QuickTime frequently this year. Some of these updates have come just weeks apart. Apple last patched QuickTime on Nov. 5.&#160;
467342
(InfoWorld) - Apple Computer Inc. has fixed a number of flaws in the software that ships with its personal computers, including a bug in its AirPort wireless drivers that was disclosed earlier this month. The AirPort flaw was disclosed on Nov. 1 by security researcher HD Moore. It affects Proxim Wireless Corp. Orinoco wireless cards used by PowerBook and iMac computers built between 1999 and 2003, he said. These cards, which were branded AirPort by Apple, shipped with eMac, iBook, iMac, PowerBook G3, PowerBook G4 and Power Mac G4 systems, Apple said in a note on the updates , posted Tuesday. The issue does not affect systems that use the AirPort Extreme cards, Apple said. Apple warned that this flaw could be used by an attacker to run unauthorized software on a victim's computer, but Moore's exploit code could only be used to cause a computer to crash, the security researcher said. Security researchers have been paying a lot of attention to wireless device drivers since August, when researchers David Maynor and Jon Ellch reported that they'd discovered a number of significant flaws in wireless drivers, including one that affected Apple's computers. Maynor and Ellch were later criticized because they demonstrated these flaws using a third-party wireless card rather than the one that ships with Apple's MacBook, and because the two hackers have not published the code used in their attack. Nevertheless, Apple patched a number of vulnerabilities in its wireless drivers last September, saying that these were discovered in an internal audit of the company's software. Apple's Tuesday update also fixes several issues in products that ship with OS X, including flaws in the ClamAV antivirus software, Perl, PHP (PHP Hypertext Preprocessor) and Samba. In total, 22 patches were released in this update, named 2007-007 by Apple. Â
444532
Ten security flaws found in Firefox browser, Thunderbird e-mail client.
568721
TechWeb - Security researchers have disclosed flaws in the Mac OS X operating system that allow attackers to crash the computer and possibly hijack it.
339286
Software is designed to allow free video calls between Skype users with Windows or Mac machines.