toggle

AAPL Stock: 111.78 ( -0.87 )

Printed from http://www.macnn.com

Apple security fixes detailed, ST offers warning

updated 12:15 pm EST, Thu November 20, 2003

Jaguar gets security fixes

Security Tracker (ST) reports on , which included long-awaited security updates for Mac OS X 10.2 Jaguar users (available previously only to Panther users).

"It is reported that the sudo application uses the graphical interface clock instead of the system clock. When sudo is executed via Apple's Terminal.app and then the laptop is placed in sleep mode and subsequently woken up, the laptop may take 10 - 20 seconds to update the graphical clock. As a result, a physically local user can wake up the laptop and execute sudo commands with root privileges without having to authenticate within the 10 - 20 second period." The Security Tracker report indicates that Apple was notified a few weeks ago and is working on a fix.



Apple's 2003-11-19 Jaguar security update for both client and server versions includes the following fixes:


  • Insecure.ws notes that there was long-standing bug in Safari that enabled "cookie theft" by Web sites. It is not know if this has been corrected by the security update.


  • gm4: Fixes CAN-2001-1411 a format string vulnerability in the gm4
    utility. No setuid root programs relied on gm4 and this fix is a
    preventive measure against a possible future exploit.

  • groff: Fixes VU#399883 where the groff component pic contained a
    format-string vulnerability.

  • Mail: Fixes CAN-2003-0881 the Mac OS X Mail application will no longer
    fall back to plain text login when an account is configured to use MD5
    Challenge Response.

  • OpenSSL: Fixes CAN-2003-0851 parsing particular malformed ASN.1
    sequences are now handled in a more secure manner.

  • Personal File Sharing: Fixes CAN-2003-0878 when Personal File Sharing
    is enabled, the slpd daemon can no longer create a root-owned file in
    the /tmp directory to gain elevated privileges.

  • QuickTime for Java: Fixes CAN-2003-0871 a potential vulnerability that
    could allow unauthorized access to a system.

  • zlib: Addresses CAN-2003-0107. While there were no functions in Mac
    OS X that used the vulnerable gzprintf() function, the underlying
    issue in zlib has been fixed to protect any third-party applications
    that may potentially use this library.


The Panther update fixes the following issues:

  • OpenSSL: Fixes CAN-2003-0851 parsing particular malformed ASN.1
    sequences are now handled in a more secure manner.

  • zlib: Addresses CAN-2003-0107. While there were no functions in Mac
    OS X that used the vulnerable gzprintf() function, the underlying
    issue in zlib has been fixed to protect any third-party applications
    that may potentially use this library.




by MacNN Staff

POST TOOLS:

TAGS :

toggle

Comments

  1. MacNN.com Reader

    Joined: Dec 1969

    0

    Oh my God!!

    The yuppies at Starbucks can now sudo rm -rf /* my TiBook when I take an extra long bathroom break!

    I'm switching back to Windows immediately! So much more secure.

  1. MacNN.com Reader

    Joined: Dec 1969

    0

    heh heh

    looking more and more like ....

  1. MacNN.com Reader

    Joined: Dec 1969

    0

    this just in!

    there is a serious bug in all versions of mac os x. apparently, if you enter "sudo" and then your password, you can potentially erase every files on your hard drive!!!

    eek!!!

  1. MacNN.com Reader

    Joined: Dec 1969

    0

    sheesh

    That has to be the most hysterical "secucirty issue" I've ever seen. ONLY
    1. on a laptop
    2. when someone currently has sudo running in the terminal
    3. the laptop is put to sleep while the above is true
    4. for 10-20 SECONDS after it is woken up (before the clock is updated) someone with physical access to the computer can execute code!

    Oh NOOOOOO!!!!!!!

    I've never been so terrified in my life, and....I'm TYPING THIS ON A LAPTOP!!!! Guess maybe I should not leave my laptop lying around unattended while I have a sudo process running in the terminal! Who'da thunk it!

    Contrast to the 43 critical security fixes needed immediately on an install from a year old XP disk....and the fact that there are zillions of ways to execute code on windows.

  1. MacNN.com Reader

    Joined: Dec 1969

    0

    Hyperbole

    a little paranoid?

  1. MacNN.com Reader

    Joined: Dec 1969

    0

    http://www.insecure.ws/ar

    http://www.insecure.ws/article.php?story=20031119022325244

  1. MacNN.com Reader

    Joined: Dec 1969

    0

    Not major, but not good..

    Not a major issue, but an issue none the less. I'm comfortable enough to say that this will effect very few people.

  1. MacNN.com Reader

    Joined: Dec 1969

    0

    Re: sheeesh

    That has to be the most hysterical "secucirty issue" I've ever seen. ONLY
    1. on a laptop

    No, it uses laptop in the example, but any Mac that can be put to sleep is affected.


    2. when someone currently has sudo running in the terminal

    No, just someone has run sudo in the 5 minutes prior to putting the computer to sleep. The system remembers the sudo password for five minutes. Its not related to the terminal (for example, fiddling in the system folder - as mentioned in a previous security issue - uses sudo to authenticate the user before allowing it continue).


    3. the laptop is put to sleep while the above is true
    4. for 10-20 SECONDS after it is woken up (before the clock is updated) someone with physical access to the computer can execute code!


    Not just execute code, but do anything malicious as root, which could also entail starting netinfo and adding a new admin user to the system, installing spyware, deleting important files, etc, etc, etc.

    Its amazing how many people here chatter about MS's lack of security (regardless of how possible or unlikely it can be exploited), but seemingly every Mac security vulnerability is just hysterical ranting.

    Contrast to the 43 critical security fixes needed immediately on an install from a year old XP disk....and the fact that there are zillions of ways to execute code on windows.

    Well, MS puts out patches for each vulnerability it fixes, whereas Apple puts out a group of updates at one time. So, it may look like Apple's only applied 2 security patches in the first month of Panther (isn't 2 kind of a lot?), its really more than two. (The jag update is comparable to 7 Win patches).

    Plus, Apple's OS updates to Jaguar also sometimes contain security fixes, as well as new features and bug fixes, so its hard to tell how many security holes are being filled in.

    And I'm not sure what you mean by 'zillions of ways to execute code'. There ain't more nor less ways than on the mac.

    One of MS's biggest problems is that they turn most stuff on by default, rather than leave it off and let users turn on what they need. OK, another problem is they keep trying to hack security onto existing code that wasn't designed to be secure, rather than redesigning code interfaces with security in mind at the start. And all this is complicated by their demands to try to be as backwards compatibile as possible with everyones 20 year old DOS software, 10 year old Win 3.1 software, 5 year old Win95 software, and 2 year old Win 2000 software. Apple has always phased out old software support over time in favor of better underlying structure. [For example, OS 7 brought 32-bit addressing, but you had a way to turn it off to support older, crappily written 24-bit code (older, well-written 24-bit code worked fin

  1. MacNN.com Reader

    Joined: Dec 1969

    0

    This just in....

    I just found a new security issue with Mac OS X laptops.

    Unattended laptops may be removed by unauthorized local persons.

    Apple needs to fix this ASAP.

  1. MacNN.com Reader

    Joined: Dec 1969

    0

    Main Point

    It requires physical access.

    It's a security issue, but not a major one. They could also walk out with your hard drive if they have physical access.

    Apple should fix this ASAP, but again, don't start blabbering about the sky falling just yet.

    Apple isn't a saint, but at the same time, M$ has security issues that are MONTHS out of date... Numerous systems are vulnerable...

Login Here

Not a member of the MacNN forums? Register now for free.

toggle

Network Headlines

toggle

Most Popular

MacNN Sponsor

Recent Reviews

Dell AD211 Bluetooth speaker

For all of the high-priced, over-engineered Bluetooth speakers in the electronics market, there is still room for mass-market solution ...

VisionTek 128GB USB Pocket SSD

USB flash drives dealt the death blow to both the floppy and Zip drives. While still faster than either of the old removable media, sp ...

Kodak PixPro SL10 Smart Lens Camera

Smartphone imagery still widely varies. Large Megapixel counts don't make for a good image, and the optics in some devices are lackin ...

toggle

Most Commented