toggle

AAPL Stock: 497.67 ( -11.79 )

MacNN News

New security vulnerability threatens Tiger

updated 03:20 pm EDT, Thu May 12, 2005

Tiger/QT exploit

A security vulnerability in Mac OS X 10.4 Tiger allows a malicious .mov file to . The exploit, which was discovered by David Remahl in Sweden, takes advantage "compositions," which have access to powerful tools known as "patches." Combining patches that provide advanced system information with patches that load information from the Internet allows an embedded .mov file to leak system details. A temporary workaround includes disabling the QuickTime plug-in and treating Quartz Composer files with suspicion. An alternative workaround involves disabling QTZ support in QuickTime by removing QuartzComposer.rcomponent in the QuickTime section of the system Library.

Leaked information:

Local user name (long and short)

Computer name

Local IP

OS / kernel version

CPU / RAM / GPU configuration

Names (human-readable) of Bonjour services on the local network

Local or system time

Volume of audio input

Lists of images (including pdfs) matching arbitrary spotlight queries

Lists of images (including pdfs) in specific directories (relative to / or ~)

The existence of image and movie files can indicate the existance of certain software packages

by MacNN Staff

(19)

TAGS :

troubleshooting

Share the Article

Facebook Twitter Delious Slash Dot Digg

toggle

Comments

jenmarsh
Fresh-Faced Recruit

Joined: Oct 2003

0

05/12, 03:50pm | report spam | close Reply |
Another exploit please!

Unlike the Dashboard vulnerability, this ones seems a bit more concerning. However, I am once again confident Apple will patch this very fast. They have always been quick to respond, and I doubt this will be any different.

Everytime I see one of these exploits, I think of hearing on the news about a critical Windows XP update that Microsoft released for an exploit that was found six months prior to the fix.

No OS is going to be perfect but at least Apple seems to always be on their toes with Security patches and updates.

van rijn
Fresh-Faced Recruit

Joined: Sep 2002

0

05/12, 03:51pm | report spam | close Reply |
its beginning...

to look a lot like windows with all this security ca ca going on

Grrr
Grizzled Veteran

Joined: Jun 2001

0

05/12, 03:59pm | report spam | close Reply |
Well done..

Another security alert that needn't have been announced in such a way that it pretty much tells unscrupulous people who were not previously aware of it, exactly how to do it!

dave a
Fresh-Faced Recruit

Joined: Jan 2002

0

05/12, 04:08pm | report spam | close Reply |
agreed

They could have been a little less clear on the details, all right.

:dragonflypro:
Senior User

Joined: Sep 2003

0

05/12, 04:37pm | report spam | close Reply |
But is it fatal

The info is leaked, yes. That isn't good.

But, it is fairly innocuous info� it isn't like an apple script co-opting Mail and spamming the 'verse.

Here is hoping it is still addressed in short order.

OS X security flaw = Headlines WIn Security flaws = Little Notice

T

technohedz
Fresh-Faced Recruit

Joined: Jul 2000

0

05/12, 04:38pm | report spam | close Reply |
show and tell

What's with show and tell. If I find a security issue I call apple and tell them. I also log it with apple's bug reporting. That's at the very least. I don't post anything about it in public for a good 2 weeks. Making a website to demo something, like the widget one, or this kind of report is negligent. If you tell people how to circumvent the security of a system and they do it you are responsible for it, regardless of how we define 'responsible'. In short, this kind of stuff (that almost seems orchestrated) will make the people doing wish that I had never been born if they come face to face with me.

technohedz
Fresh-Faced Recruit

Joined: Jul 2000

0

05/12, 04:39pm | report spam | close Reply |
isn't fatal??

Leaked username and password might be considered fatal to some.

crevatis
Fresh-Faced Recruit

Joined: Feb 2005

0

05/12, 04:49pm | report spam | close Reply |
Re: isn't fatal??

Where is there any mention of a leaked password?

tomas316
Fresh-Faced Recruit

Joined: Jan 2002

0

05/12, 04:53pm | report spam | close Reply |
RE:isn't fatal??

Crevatis is right, no mention of passwords anywhere...

Impatient1
Fresh-Faced Recruit

Joined: Oct 2002

0

05/12, 04:55pm | report spam | close Reply |
isn't fatal??

No mention of leaked password at all. It provides basic information about the computer and various user accounts to someone who may be interested in breaking into it. That information would make it easier (than blindly guessing) to target the machine for a break-in but it would still require more effort.

klinux
Senior User

Joined: Jul 2002

0

05/12, 06:30pm | report spam | close Reply |
don't be biased

"OS X security flaw = Headlines WIn Security flaws = Little Notice "

Windows security flaws get plenty of notice and headline too. Please stop acting like you are a victim or something.

resuna
Fresh-Faced Recruit

Joined: Jan 2005

0

05/12, 10:30pm | report spam | close Reply |
Like Windows?

This one is not particularly worrying, because it's not associated with insecure design or policy like the Safari Dashboard install bug is. THAT is Windows-like, just a little, in the same way that an unpaid parking ticket is like grand theft auto. That's not to say, though, that one shouldn't pay ones metaphorical parking tickets...

LouZer
Fresh-Faced Recruit

Joined: Nov 2000

0

05/12, 11:53pm | report spam | close Reply |
Re: isn't fatal

No mention of leaked password at all. It provides basic information about the computer and various user accounts to someone who may be interested in breaking into it. That information would make it easier (than blindly guessing) to target the machine for a break-in but it would still require more effort.

Which is a concern only if your computer is accessible from the outside (i.e. not behind one or more firewalls).

But I agree that it seems that the Apple is paying less and less attention to security. Their different groups seem to be in 'communications blackout". They don't seem to spend any time in the "Wow, great idea. Now let's make sure this is secure and not likely to cause breaches." Like the widget thing. The Finder group decides to set up widgets to auto-install. Not taking into account that if safari tries to open the file, it'll get installed wihtout concern. Now its compositing in quicktime over the internet. Great idea guys.

So, what's next week. Finding out that all data we type into safari gets stored in a specific file that's transmitted over the internet to Apple's web servers unencrypted?

ecrelin
Junior Member

Joined: Oct 2000

0

05/13, 09:02am | report spam | close Reply |
Alert: Sky still secure�

Sketchy "potential" critical information leak discovered, with fix (how much productivity will we lose by disabling composites) and soon permanent fix. Ye of little faith, where is the evidence that Apple is any more or less security concious? This stuff was coded months ago, maybe a year or more just like the dashboard stuff, do you think that security focus is a flavor of the week thing? So far pretty petty stuff, personally I am glad of the scrutiny and have confidence that no major flaws are lurking underneath. Must be you guys do your jobs so well that you never overlook anything, or maybe not and that's why you think the end of the world is around the corner?!? First evil widgets, now composites from h***, let's see, Apple, successful exploits - 0, virus count - 0, Windows successful exploits - happening right now, virus count - nearly 100,000. Hmmmm, it's ok to breath easily, take a prozac and get some sleep, the only communications blackout is apparently between the cognition and reaction sections of your brains.

macjockey
Fresh-Faced Recruit

Joined: Jun 2004

0

05/13, 09:18am | report spam | close Reply |
another workaround

another workaround is to stop watching p*** on the interent

chmod007
Fresh-Faced Recruit

Joined: Apr 2005

0

05/13, 09:23am | report spam | close Reply |
About disclosure

A few people are critical that the disclosure of this problem was so detailed. At least two people independently saw the potential for misuse on the Quartz Composer developer mailing list. There is nothing to say that malicious people have not used this to gain information from unsuspecting users.

By publishing the full details, people can evaluate the risks for themselves and take informed action. Other security researchers can verify my results. People can exercise pressure on the vendor to quickly address the problem since it is out in the open. Finally, it will help third-parties to think an extra round about the features of their apps, so that they do not make the same or similar mistake.

With hand-waving and unsupported claims of "some information disclosure vulnerability in QC", these goals would not have been met.

And if anyone thinks that Windows has _less_ eyes on it (and gets less headlines) for security issues, you really need to take a reality check...If you consider that I, personally, have found a dozen security flaws (6 of which have been disclosed thus far) in less than three months, that indicates that not very many people at all are scrutinizing OS X's security. Yet.

/ Regards, David Remahl

kaleberg
Fresh-Faced Recruit

Joined: Jan 2004

0

05/13, 11:08am | report spam | close Reply |
annoying thing

The annoying thing is that this entire class of problem, malicious external software, has had a solution for over 30 years now. Someone should dig up some of those old papers on protection domains. Obviously, what a piece of software can do should be limited by which domain it comes from. If it wants more privileges, it should have to ask the user nicely.

klinux
Senior User

Joined: Jul 2002

0

05/13, 04:43pm | report spam | close Reply |
ecrelin

Dang ecrelin, that is a long post full of nothing, whenin doubt, drag out the dead horse of virus count of Windows vs OS X.

I mean forget about the fact that many of the virus will not longer work in XP SP 2 or anything or the fact that the major threat now is due to phishing or the fact many of the exploits published are academic rather than happening in the wild.

But heck, forget about what Apple is doing wrong, let's talk about what Windows is doing worse.

technohedz
Fresh-Faced Recruit

Joined: Jul 2000

0

05/14, 08:39am | report spam | close Reply |
ok no password

Yeah, it's only your username and apparently internal id. The rest is almost assumed. Even if it sends information on your machine it isn't difficult to blueprint information once you have an IP. Your external IP is going to be there even if you are behind a router. So, if you take a user w/ a airport base station doing nat and dhcp, the 'exploit' will have the machine blueprint, your login name, and your internal ip. Figuring out the router and what's running on it isn't difficult either. All of that is for the sk's. So if you have services w/ port forwarding from the router you may be in vulnerable, and if you are sitting there w/ a real IP (as opposed to invalid) and you're just hooked up to your 'modem' then you're more vulnerable. Joe gets your ip and username then launches an attack against your password remotely. Even takes a few EASY guesses for a lot of people and suddenly he's in. Of course you'd have to allow him to log in remotely in the first place so there's the protection, but if you need to log in remotely/share then you have to use the fix here. It's not trivial.

Show More Comments

Login Here

toggle

Network Headlines

02/15	Apple upgrades iBookstore with screenshots...
02/15	Congress asks Apple to answer questions...
02/15	FLA head describes Foxconn plants as...
02/15	Apple asks to sue bankrupt Kodak in...
02/15	Apple voluntarily pulls iPads from...

Show All

02/15	Congress asks Apple to answer questions...
02/15	FLA head describes Foxconn plants as...
02/15	Apple asks to sue bankrupt Kodak in...
02/15	Apple voluntarily pulls iPads from...
02/15	Gartner: Apple No 1 vendor in Q4, but...

Show All

02/15	Apple upgrades iBookstore with screenshots...
02/15	Congress asks Apple to answer questions...
02/14	Apple attempting to disrupt Siri hacks...
02/14	Readability iOS app delayed, Android...
02/13	Apple launches 2012 back-to-school...

Show All

02/15	Monster iCarPlay Wireless FM Transmitter...
02/14	Refurb. 16GB iPhone 4, now only $259...
02/13	Refurb. Flip UltraHD Pocket Digital...
02/10	$380 off refurbished 2.8GHz Mac Pro...
02/09	iHome Dual Alarm Clock for Apple iPod...

Show All

toggle

New security vulnerability threatens Tiger

updated 03:20 pm EDT, Thu May 12, 2005

Tiger/QT exploit

Another exploit please!

its beginning...

Well done..

agreed

But is it fatal

show and tell

isn't fatal??

Re: isn't fatal??

RE:isn't fatal??

isn't fatal??

don't be biased

Like Windows?

Re: isn't fatal

Alert: Sky still secure�

another workaround

About disclosure

annoying thing

ecrelin

ok no password

Login Here

Register for our weekly email newsletter:

Connect tools:

Subscribe

to our RSS

Follow us

on Twitter

10 Most Read

10 Most Discussed

MacNN Marketplace

New security vulnerability threatens Tiger

updated 03:20 pm EDT, Thu May 12, 2005

Tiger/QT exploit

Related Articles

Recent Articles

Another exploit please!

its beginning...

Well done..

agreed

But is it fatal

show and tell

isn't fatal??

Re: isn't fatal??

RE:isn't fatal??

isn't fatal??

don't be biased

Like Windows?

Re: isn't fatal

Alert: Sky still secure�

another workaround

About disclosure

annoying thing

ecrelin

ok no password

Login Here

Register for our weekly email newsletter:

Connect tools:

Subscribe

to our RSS

Follow us

on Twitter

10 Most Read

10 Most Discussed

MacNN Marketplace