Security fixes include online content, image files

Apple on Monday released Security Update 2009-006 for Leopard and Snow Leopard operating systems, including Server and Client editions. The update addresses a number of vulnerabilities, including an issue that could have allowed disk images using FAT filesystems to execute arbitrary code. Memory handling has also been improved with DirectoryService to prevent remote attacks.

Other Mac OS X security fixes relate to embedded fonts, NUL characters in SSL certificates, PDF file handling, TIFF images, H.264 files, HTTP headers, QuickTime, Spotlight, and more.

For Mac OS X Server systems, the update addresses a vulnerability that could have allowed attackers to use FTP to create directories on a system and terminate applications or run arbitrary code. The Event Monitor has also been tweaked to prevent remote attackers from connecting to the SSH server and causing denial-of-service issues as log data is processed. The Adaptive Firewall now detects SSH login attempts using invalid user names, helping to protect against brute force or dictionary attacks.

Security Update 2009-006 is available for all systems running Mac OS X 10.5.8 or higher. Apple on Monday also released Mac OS X 10.6.2, which contains many of the same security fixes as the Leopard update. [Client Download - 143MB] [Server Download - 231MB]

by MacNN Staff