toggle

AAPL Stock: 530.38 ( + 0.26 )

Apple security fixes detailed, ST offers warning

updated 12:15 pm EST, Thu November 20, 2003

Jaguar gets security fixes


Security Tracker (ST) reports on , which included long-awaited security updates for Mac OS X 10.2 Jaguar users (available previously only to Panther users).

"It is reported that the sudo application uses the graphical interface clock instead of the system clock. When sudo is executed via Apple's Terminal.app and then the laptop is placed in sleep mode and subsequently woken up, the laptop may take 10 - 20 seconds to update the graphical clock. As a result, a physically local user can wake up the laptop and execute sudo commands with root privileges without having to authenticate within the 10 - 20 second period." The Security Tracker report indicates that Apple was notified a few weeks ago and is working on a fix.



Apple's 2003-11-19 Jaguar security update for both client and server versions includes the following fixes:


  • Insecure.ws notes that there was long-standing bug in Safari that enabled "cookie theft" by Web sites. It is not know if this has been corrected by the security update.


  • gm4: Fixes CAN-2001-1411 a format string vulnerability in the gm4
    utility. No setuid root programs relied on gm4 and this fix is a
    preventive measure against a possible future exploit.

  • groff: Fixes VU#399883 where the groff component pic contained a
    format-string vulnerability.

  • Mail: Fixes CAN-2003-0881 the Mac OS X Mail application will no longer
    fall back to plain text login when an account is configured to use MD5
    Challenge Response.

  • OpenSSL: Fixes CAN-2003-0851 parsing particular malformed ASN.1
    sequences are now handled in a more secure manner.

  • Personal File Sharing: Fixes CAN-2003-0878 when Personal File Sharing
    is enabled, the slpd daemon can no longer create a root-owned file in
    the /tmp directory to gain elevated privileges.

  • QuickTime for Java: Fixes CAN-2003-0871 a potential vulnerability that
    could allow unauthorized access to a system.

  • zlib: Addresses CAN-2003-0107. While there were no functions in Mac
    OS X that used the vulnerable gzprintf() function, the underlying
    issue in zlib has been fixed to protect any third-party applications
    that may potentially use this library.


The Panther update fixes the following issues:

  • OpenSSL: Fixes CAN-2003-0851 parsing particular malformed ASN.1
    sequences are now handled in a more secure manner.

  • zlib: Addresses CAN-2003-0107. While there were no functions in Mac
    OS X that used the vulnerable gzprintf() function, the underlying
    issue in zlib has been fixed to protect any third-party applications
    that may potentially use this library.


by MacNN Staff

print
email
(14)

TAGS :

 troubleshooting

Related Articles

Recent Articles

toggle

Comments

  1. MacNN.com Reader

    Fresh-Faced Recruit

    Joined: Jul 2001

    0
    11/20, 12:34pm | report spam | Reply |

    Oh my God!!

    The yuppies at Starbucks can now sudo rm -rf /* my TiBook when I take an extra long bathroom break!

    I'm switching back to Windows immediately! So much more secure.

  1. MacNN.com Reader

    Fresh-Faced Recruit

    Joined: Jul 2001

    0
    11/20, 12:38pm | report spam | Reply |

    heh heh

    looking more and more like ....

  1. MacNN.com Reader

    Fresh-Faced Recruit

    Joined: Jul 2001

    0
    11/20, 12:59pm | report spam | Reply |

    this just in!

    there is a serious bug in all versions of mac os x. apparently, if you enter "sudo" and then your password, you can potentially erase every files on your hard drive!!!

    eek!!!

  1. MacNN.com Reader

    Fresh-Faced Recruit

    Joined: Jul 2001

    0
    11/20, 01:16pm | report spam | Reply |

    sheesh

    That has to be the most hysterical "secucirty issue" I've ever seen. ONLY
    1. on a laptop
    2. when someone currently has sudo running in the terminal
    3. the laptop is put to sleep while the above is true
    4. for 10-20 SECONDS after it is woken up (before the clock is updated) someone with physical access to the computer can execute code!

    Oh NOOOOOO!!!!!!!

    I've never been so terrified in my life, and....I'm TYPING THIS ON A LAPTOP!!!! Guess maybe I should not leave my laptop lying around unattended while I have a sudo process running in the terminal! Who'da thunk it!

    Contrast to the 43 critical security fixes needed immediately on an install from a year old XP disk....and the fact that there are zillions of ways to execute code on windows.

  1. MacNN.com Reader

    Fresh-Faced Recruit

    Joined: Jul 2001

    0
    11/20, 01:31pm | report spam | Reply |

    Hyperbole

    a little paranoid?

  1. MacNN.com Reader

    Fresh-Faced Recruit

    Joined: Jul 2001

    0
    11/20, 01:55pm | report spam | Reply |

    http://www.insecure.ws/ar

    http://www.insecure.ws/article.php?story=20031119022325244

  1. MacNN.com Reader

    Fresh-Faced Recruit

    Joined: Jul 2001

    0
    11/20, 02:46pm | report spam | Reply |

    Not major, but not good..

    Not a major issue, but an issue none the less. I'm comfortable enough to say that this will effect very few people.

  1. MacNN.com Reader

    Fresh-Faced Recruit

    Joined: Jul 2001

    0
    11/20, 02:53pm | report spam | Reply |

    Re: sheeesh

    That has to be the most hysterical "secucirty issue" I've ever seen. ONLY
    1. on a laptop

    No, it uses laptop in the example, but any Mac that can be put to sleep is affected.


    2. when someone currently has sudo running in the terminal
    No, just someone has run sudo in the 5 minutes prior to putting the computer to sleep. The system remembers the sudo password for five minutes. Its not related to the terminal (for example, fiddling in the system folder - as mentioned in a previous security issue - uses sudo to authenticate the user before allowing it continue).


    3. the laptop is put to sleep while the above is true
    4. for 10-20 SECONDS after it is woken up (before the clock is updated) someone with physical access to the computer can execute code!


    Not just execute code, but do anything malicious as root, which could also entail starting netinfo and adding a new admin user to the system, installing spyware, deleting important files, etc, etc, etc.

    Its amazing how many people here chatter about MS's lack of security (regardless of how possible or unlikely it can be exploited), but seemingly every Mac security vulnerability is just hysterical ranting.

    Contrast to the 43 critical security fixes needed immediately on an install from a year old XP disk....and the fact that there are zillions of ways to execute code on windows.

    Well, MS puts out patches for each vulnerability it fixes, whereas Apple puts out a group of updates at one time. So, it may look like Apple's only applied 2 security patches in the first month of Panther (isn't 2 kind of a lot?), its really more than two. (The jag update is comparable to 7 Win patches).

    Plus, Apple's OS updates to Jaguar also sometimes contain security fixes, as well as new features and bug fixes, so its hard to tell how many security holes are being filled in.

    And I'm not sure what you mean by 'zillions of ways to execute code'. There ain't more nor less ways than on the mac.

    One of MS's biggest problems is that they turn most stuff on by default, rather than leave it off and let users turn on what they need. OK, another problem is they keep trying to hack security onto existing code that wasn't designed to be secure, rather than redesigning code interfaces with security in mind at the start. And all this is complicated by their demands to try to be as backwards compatibile as possible with everyones 20 year old DOS software, 10 year old Win 3.1 software, 5 year old Win95 software, and 2 year old Win 2000 software. Apple has always phased out old software support over time in favor of better underlying structure. [For example, OS 7 brought 32-bit addressing, but you had a way to turn it off to support older, crappily written 24-bit code (older, well-written 24-bit code worked fin

  1. MacNN.com Reader

    Fresh-Faced Recruit

    Joined: Jul 2001

    0
    11/20, 02:59pm | report spam | Reply |

    This just in....

    I just found a new security issue with Mac OS X laptops.

    Unattended laptops may be removed by unauthorized local persons.

    Apple needs to fix this ASAP.

  1. MacNN.com Reader

    Fresh-Faced Recruit

    Joined: Jul 2001

    0
    11/20, 03:01pm | report spam | Reply |

    Main Point

    It requires physical access.

    It's a security issue, but not a major one. They could also walk out with your hard drive if they have physical access.

    Apple should fix this ASAP, but again, don't start blabbering about the sky falling just yet.

    Apple isn't a saint, but at the same time, M$ has security issues that are MONTHS out of date... Numerous systems are vulnerable...

Show More Comments

Login Here

Not a member of the MacNN forums? Register now for free.

 
close
Photo
toggle

Network Headlines

toggle

Most Popular

MacNN Sponsor

Recent Reviews

iHome iW2 AirPlay speaker

iHome generally isn't known as a luxury brand when it comes to audio, but it is prolific -- the company's docks and speakers are every ...

Logitech Ultrathin Keyboard Cover

One of the iPad's main weaknesses has always been productivity. It's not a question of apps; while it has taken a little time for a na ...

Logitech UE Air Speaker

If maybe a little more slowly than Apple would like, AirPlay is becoming a staple of the wireless speaker market for iOS devices. The ...

toggle

Most Commented

 

Popular News