utilities/system updates
03/01/2006, 5:30pm, EST
Wednesday, March 1st
Apple fixes Safari, other exploits
Apple today released Security Update 2006-001 for both Mac OS X Panther and Mac OS X Tiger, which is recommended for all users and improves Safari by fixng four different security issues, including the 'extremely critical' Mac OS X zero-day exploit and three other exploits that could enable arbitrary code execution by a malicious user. It also fixes 13 other bugs in the following components: apache_mod_php, automount, Bom, Directory Services, iChat, IPSec, LaunchServices, LibSystem, loginwindow, Mail, rsync, and Syndication. Apple also said that its AES-128 encrypted FileVault disk images are now created with more restrictive operating system permissions and that improved iChat security by using Download Validation to warn of unknown or unsafe file types during file transfers--in part to protect against the recently reported Leap.A worm.
The update fixes multiple security issues in PHP, the popular web programming language included with the Apache webserver installation. The latest version is installed, but turned off in default installations of Mac OS X. The an automount issue that could cause the systems to become unresponsive, or possibly allow arbitrary code delivered from the file servers to run on the target system.
Apple also notes that the update more securely stores passwords: "The passwd program is vulnerable to temporary file attacks. This could lead to privilege elevation. This update addresses the issue by anticipating a hostile environment and by creating temporary files securely."
Filed under: software
, 
, 9
, 
, 
, 
, 
, 
Top
subscribe to comments
for this article
Granted none of them could cause harm in their current forms, but the concepts they were trying to display were solid enough to warrant a quick response.
And a quick response we got.
It is also fair to point out, these were possible exploits, not actual exploits.
Most windows holes re patched prior to their announcement and info, let alone before exploits are released. The problem with windows is that, with so many users, there's a whole segment that never runs the update feature.
I'm sure OS X has the same percentage of non-updaters. Esp if they are NOT admins, where they'll never know there's an update until the admin logs in.
Oh, and most macs are NOT used in professional networking environments, and most users are, in fact, admins (apple's default setup - hey, just like Windows!). Users would have to know what they're doing, read non-included manuals and on-line help to just know that they might want to consider setting up a limited account.
I had no issues doing the update on this Mac mini.
Tom