Apple fixes Safari, other exploits
updated 05:30 pm EST, Wed March 1, 2006
Apple Security Update
Apple today released Security Update 2006-001 for both Mac OS X Panther and Mac OS X Tiger, which is recommended for all users and improves Safari by fixng four different security issues, including the 'extremely critical' Mac OS X zero-day exploit and three other exploits that could enable arbitrary code execution by a malicious user. It also fixes 13 other bugs in the following components: apache_mod_php, automount, Bom, Directory Services, iChat, IPSec, LaunchServices, LibSystem, loginwindow, Mail, rsync, and Syndication. Apple also said that its AES-128 encrypted FileVault disk images are now created with more restrictive operating system permissions and that improved iChat security by using Download Validation to warn of unknown or unsafe file types during file transfers--in part to protect against the recently reported Leap.A worm.
The update fixes multiple security issues in PHP, the popular web programming language included with the Apache webserver installation. The latest version is installed, but turned off in default installations of Mac OS X. The an automount issue that could cause the systems to become unresponsive, or possibly allow arbitrary code delivered from the file servers to run on the target system.
Apple also notes that the update more securely stores passwords: "The passwd program is vulnerable to temporary file attacks. This could lead to privilege elevation. This update addresses the issue by anticipating a hostile environment and by creating temporary files securely."










It's nice to see . . .
03/01, 06:05pm reply
Apple jump on these security issues so quickly. As Mac users, security is something which we have not had to worry all that much about, and then all of a sudden, last week saw 3 new potential exploits.
Granted none of them could cause harm in their current forms, but the concepts they were trying to display were solid enough to warrant a quick response.
And a quick response we got.
e:leaf
Fresh-Faced Recruit
Joined: Mar 2006
Not so fast...
03/01, 06:20pm reply
These issues have been around a long time and Apple has been openly criticized for taking so long to fix them. This criticism increased last week, probably spurring some action from Apple. Finally. So sorry, but your post is the total opposite of what's been happening. It seems Apple only fixes thing when people jump up and down about them.
e2Sync
Fresh-Faced Recruit
Joined: Feb 2005
Consider The Alternative
03/01, 07:27pm reply
Whatever. At least Apple responds with an update BEFORE it's users are negatively impacted by threats. Too bad we can't say the same for that other company that makes a major OS used by millions of people.
MacnTX
Fresh-Faced Recruit
Joined: Apr 2004
Get Your facts Straight
03/01, 07:39pm reply
Two Three weeks ago, some "security" company exposed two supposed major possible security exploits in Apple's OS. Two Three weeks later Apple responded by fixing the exploits. That is pretty good response time.
It is also fair to point out, these were possible exploits, not actual exploits.
Terrin
Fresh-Faced Recruit
Joined: Jan 2006
umm...
03/01, 09:11pm reply
All of these "exploits" needed Admin access. In a professional networking environment, the end users are NOT admins and cannot be affected by most of these eploits. End users do not run PHP, as an example. Apple didn't see them as critical needs till some idiot decided to blast them for it. So, KUDOS APPLE for making them shut up. Now get back to making the OS LEAN and not BLOATED!
ibugv4
Fresh-Faced Recruit
Joined: Jun 2003
well now my G5 is secure.
03/02, 12:20am reply
The security of the dead... did the automatic update, and it killed my primary HD. Havn't narrowed down exactly whats wrong but after the restart the partition OSX10.4.5 was on became unmountable as did a backup OS partition I had on that drive. My other HD is ok but the system can't get past trying to mount the drives. Option lets me select a CD boot but I am really hosed. - Will update if I learn more.
paladin2664
Fresh-Faced Recruit
Joined: Mar 2006
Re: consider the alternat
03/02, 12:41pm reply
Whatever. At least Apple responds with an update BEFORE it's users are negatively impacted by threats. Too bad we can't say the same for that other company that makes a major OS used by millions of people.
Most windows holes re patched prior to their announcement and info, let alone before exploits are released. The problem with windows is that, with so many users, there's a whole segment that never runs the update feature.
I'm sure OS X has the same percentage of non-updaters. Esp if they are NOT admins, where they'll never know there's an update until the admin logs in.
Oh, and most macs are NOT used in professional networking environments, and most users are, in fact, admins (apple's default setup - hey, just like Windows!). Users would have to know what they're doing, read non-included manuals and on-line help to just know that they might want to consider setting up a limited account.
testudo
Fresh-Faced Recruit
Joined: Aug 2001
Update on Update Problems
03/02, 01:25pm reply
I just spoke with 2 inidividuals who have had similar HardDrive problems directly after the patch. in one case same as mine a total loss of directory structure, in the other directory failures and constant pinwheel and crashing of applications.
paladin2664
Fresh-Faced Recruit
Joined: Mar 2006
At least they...
03/02, 05:52pm reply
...don't take forever to patch their OS unlike SOME companies, coughMICROSOFTcough....
I had no issues doing the update on this Mac mini.
Tom
TomR
Forum Regular
Joined: Aug 2000