MacUpdate Weekend Sale

:This weekend MacUpdate has slashed prices on Painter 12 and Painter Lite. Painter 12 retails for $429, but has been reduced by 54% to $199. Painter Lite has seen a 58% price cut from $69 to $29. Hurry, because these deals are only available until May 19th 2013.

toggle

AAPL Stock: 433.26 ( -1.32 )

MacNN News

http://www.macnn.com/articles/03/07/11/os.x/

OS X update will fix screensaver flaw

updated 12:20 pm EDT, Fri July 11, 2003

", 0, 0);

Apple will soon release a that will fix a vulnerability in Mac OS X's screen saver that could let users bypass the password security application, according to Security Supersite. "Security Update 2003-07-14 addresses a potential vulnerability when a password is required upon waking from the Screen Effects feature, which could allow an unauthorized user access to the desktop of the logged in user."

by MacNN Staff

Post tools:

TAGS :

troubleshooting

toggle

Comments

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 12:27pm | report spam | close Reply |
OSX or XP?

With all the security updates, it's starting to feel like Windows.

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 12:39pm | report spam | close Reply |
Ugh... like windows?

Like windows, you have to be kidding... Our system is actually secure... and is quickly updated to resolve problems. Much of the time they are security updates that would effect VERY few mac users (not many people use Apache, SSH, etc. They fix it in CASE you should need to use it. This is the same case. Few real admin types would use the screen saver password. I just log out.

Windows on the other hand will be wide open for attack and only then will you see an update (usually weeks after the original discovery)

This "vulnerability" is a very small issue. It's not like they can access your computer over the internet. You have to have local access to the computer (be in the same room) and a good amount of time to pull it off (5+ mins).

I'm not saying it's a problem, but give Apple a break...

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 12:57pm | report spam | close Reply |
Let's be fair

Oh, just because it does not affect you so you can generalize it to "VERY few"? And as if Windows security update that fixes obscure stuff like the buffer underrun error when clicked on a malformed URL through Windows Media Player is affect tons of people who are just being killed by this problem?

The first poster is right - with all these security updates, once a year OS upgrade for $130, etc. Apple is learning the bad habits of Windows.

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 01:41pm | report spam | close Reply |
RE: Let's be fair

Just to give you a feel of how bad 2000/XP is heres neat bug

http://www.securityfocus.com/archive/1/305382

If you view a busted opentype font your xp/2000 will instantly blue screen of death. If you install than then someone sends you and HTML email that uses that font your xp will blue screen of death. At the bottom of the post you'll find an attachment of a busted font for you to try. This has yet to be fixed

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 01:49pm | report spam | close Reply |
re : Let's be fair

"with all these security updates, once a year OS upgrade for $130, etc. Apple is learning the bad habits of Windows."

How is it a bad habit to release a patch when a flaw is discovered in your software ??? Do you expect any company to release a PERFECT OS, with no flaw whatsoever, that'll never have to be upgraded ? I don't think you spotted this particular bug in OS X before a few days ago when it was discovered, so why would Apple be any different ?

Besides, if you don't want to update, just don't, you can deactivate the patch in the Software Update panel, and never see it again.

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 01:59pm | report spam | close Reply |
You don't get it

Of course secutiry updates for any OS or program is a good thing and should be applied promptly, I am not arguing that.

My point is that since Mac users deride the frequency of Windows releasing security updates - well now we know what that feels like.

Furthermore, for the OS update thing. Only Mac users (and I am one) are happy enough and dying to pay annualy for a point upgrade. Microsoft ONLY wish they can get away with it (yes, I know they cannot).

- Captain Obvious

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 02:15pm | report spam | close Reply |
Re: You don't get it

"Microsoft ONLY wish they can get away with it"

But they seem able to get companies to pay for two Software Assurance periods per update thus making Software Assurance very expensive.

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 03:03pm | report spam | close Reply |
4000 chars..

Ok, the 'security' bug is only pressent if you type in 4000+ chars. How many would use 3+ min. to do that... and even know about it?

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 03:15pm | report spam | close Reply |
Time limit? Nope...

"Ok, the 'security' bug is only pressent if you type in 4000+ chars. How many would use 3+ min. to do that... and even know about it?"

Well, with copy and paste you can crash screen effects in 21 seconds (my personal best :).

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 03:44pm | report spam | close Reply |
Local vs. Remote Exploit

There is a marked difference between local and remote exploits (ones that can be done with a user with physical access to the machine vs. those that anyone with a network connection can access). This is a locally exploitable bug.

Should it be fixed? Sure. Is it a huge deal, no. If I have access to your machine, what stops me from rebooting with a recovery disk and reading everything on your harddrive? Nothing (except possibly a BIOS/OpenFirmware password - which no one uses).

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 04:00pm | report spam | close Reply |
Re: OSX or XP?

Do you actually own XP at home? I do, and the updates come very, very frequently unlike OS X. And unlike OS X, they almost ALWAYS go something like this 'Fix a bug that gives users access to your PC.' It's gives me the impression that Windows is like a strainer, with a million holes through which people can access your PC. I don't get that impression with OS X.

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 04:03pm | report spam | close Reply |
Re: you don't get it

My point is that since Mac users deride the frequency of Windows releasing security updates - well now we know what that feels like.

Yeah, but the frequency of Windows securoty patches is much, much, much higher than on OS X. So much so that its nearly impossible to keep up with them without their troublesome "Software update" feature (which, by the way, defaults to DOWNLOAD the updates and then ask if you want to install it, how stupid-a** is that???).

Furthermore, for the OS update thing. Only Mac users (and I am one) are happy enough and dying to pay annualy for a point upgrade. Microsoft ONLY wish they can get away with it (yes, I know they cannot).

What is it with people and their preconceived notions??? First its the MHz myth. Now its the "version number myth". From what I gather, it seems like few people would have compalined about Jaguar's pricing if Apple just called the thing 10.5 or 11.0. But no, they call it 10.2, and even though its loaded with changes, its degraded as a point upgrade, as if the version number of the software should determine its cost. Hey, Intuit just released Quickbooks 2003, which is a whole big new version, and it had like two new features in it. But being a new version number, its well worth its price, right? Why don't you people stop whining about the cost of a software compared to its version number, and actually look at what's new in the software...

Oh, and you'd think some people would be happy Apple actually gets OS updates out around 18 months apart. Windows users wait 3 years between any real update (and I don't count those "Plus packs" or "Second edition" releases as 'updates').

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 04:19pm | report spam | close Reply |
Finally an on-topic post

How the h*** is this news? No sh*t...Apple is GOING TO RELEASE an update. Is there really anyone who reads Macintosh news that ever doubted that or needs to see this news? Let me know when they ACTUALLY release it. :P

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 05:15pm | report spam | close Reply |
Great...

Another update to f*** up my system like the last security update.

I guess it's time to backup everything!

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 06:10pm | report spam | close Reply |
Impression

Yes, I own XP as well. The Windows security update does give you the impression that Windows has absolutely no security. However, I do not know of any end user (or corporation for that matter) that has been affected by the buffer under/over run error or a malformed URL problems that the updates supposedly fix, do you?

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 06:14pm | report spam | close Reply |
Not like quicken

No point in comparing to Quicken. We are talking about OS here. Sure, forget version numbers, I would be pissed off paying an update (yes, I know I do not have to upgrade) to pay $130 for an OS upgrade regardless of the version #. In the 12 months since I got my iBook, there has been Jaguar and now Panther - so that's $260 in 15 months. No other OS is like this.

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 06:43pm | report spam | close Reply |
No one? Are you sure?

"except possibly a BIOS/OpenFirmware password - which no one uses"

I have some news for you, I USE IT.... so you can't say NO ONE uses it...

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 07:19pm | report spam | close Reply |
*Mission Impossible???*

This struck me as funny:

"You have to have local access to the computer (be in the same room) and a good amount of time to pull it off (5+ mins . . . "

For some reason, I immediately thought of the original M.I. movie, but instead, Bill Grates is lowering himself into a laser-secured room, trying to hack a Mac -- doing the whole balancing on a wire thing. Then his glasses flip off, and set off the alarms. Or something like that (anyone care to add other scenarios to end the scene . . . . . . . . . ?)

:]

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 08:37pm | report spam | close Reply |
Re: Not like quicken

Sure, forget version numbers, I would be pissed off paying an update (yes, I know I do not have to upgrade) to pay $130 for an OS upgrade regardless of the version #. In the 12 months since I got my iBook, there has been Jaguar and now Panther - so that's $260 in 15 months. No other OS is like this.

Well, first, you say 12 months, then 15 months. Make up your mind. Second, Panther ain't out yet, and not expected until the end of the year.

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 08:55pm | report spam | close Reply |
Re: Mission Impossible

Bill Grates is lowering himself into a laser-secured room, trying to hack a Mac -- doing the whole balancing on a wire thing. Then his glasses flip off, and set off the alarms. Or something like that (anyone care to add other scenarios to end the scene . . . . . . . . . ?)

I was thinking more along the lines of his dandruff flaking off and tripping the alarms.

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 09:17pm | report spam | close Reply |
f****** idiots!

Well, first, you say 12 months, then 15 months. Make up your mind. Second, Panther ain't out yet, and not expected until the end of the year.
***
I got my iBook 12 months ago. It was expected (fine, rumored) that g5 will ship with Panther in three months hence 15 months. Of course, we now know Panther may not ship then, still that is two OS upgrades in

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/11, 09:38pm | report spam | close Reply |
Screensaver is a joke

C'mon Apple! Give us back the option to require a password on wake. Especially for us Powerbook users.

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/12, 03:21am | report spam | close Reply |
security

"The Windows security update does give you the impression that Windows has absolutely no security. However, I do not know of any end user (or corporation for that matter) that has been affected by the buffer under/over run error or a malformed URL problems that the updates supposedly fix, do you?"

Yes I do multiple companies who have been affected by those exploits. The fact that your home computer has not been affected is completely NOT surprising. Real crackers do not care to waste their time trying to mess with people's home computers; the payoff simply isn't worth it.

The extremely frequent Windows patches is also a much bigger hassle in the corporate environment where you have hundreds or thousands of PCs that need to be patched every time another security bug is fixed. It is a full time job ensuring that all the systems are kept current and even then we get cracked.

In comparison it would be much easier to maintain a thousand Macs that only get new patches every month or so instead of the Windows systems that get them every week. The Windows patches also typically address bugs that were discovered many months ago and so we spend months being vulnerable without recourse whereas with OS X, Apple has typically released patches within a few weeks or mere days from the bugs being discoverd.

I sincerely wish that I could convince my employers to convert from Windows systems to OS X. It would make my life a whole lot less stressful. Unfortunately they are not too keen on the idea of buying all new hardware in order to run OS X; my hope is that Apple will release OS X for x86. If that were to happen, I believe I could convince them to make the switch to OS X. Then once we are running OS X, it ought to be very simple to sell them on buying G5 hardware in the future. As it is now, I am stuck in a Windows world at work.

At least I get to use my Mac at home though.

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

07/13, 08:07pm | report spam | close Reply |
Oh not again...

Toooooooo Many PeeCee idiots are coming here on these sites, pretending they have anything to do with Macs... I simply hate those people. Just cause they will never know how good it feels to own a Mac and how much nicer and cool people who own macs are. By the way it is a proven fact that they are, so don't even go there, with Apple being the coolest computer company in the world, PeeCee morons have bought an Apple just to be hip... How sad is that??? NOW, before you XP and Gates nerds attack me, I just want to say there are tons of good people out there who own a PC, but because their first computer was a PC, they stick with it. And as long as they understand that they use a computer to work and to do what they want not to think they are apart some fantasy world Gates built, then all I can say is that these people are just as good as those on a mac. We work with macs, and macs work with us. There are always two kinds of people, those who like animaniacs and those who... Don't like animaniacs... And then there are those who watch South Park...

PEACE! After all a computer is a computer nothing more. You haven't built it and you are not related to anyone of those people who invented the companies. So why get so personal... Leave it alone!!!!

If you have a Ferrari, and I have a Porsche, I don't tell you what a S***** car you drive just cause mine is different. But that is what PeeCee nerds do...

MacNN.com Reader
Fresh-Faced Recruit

Joined: Jul 2001

0

01/27, 05:48am | report spam | close Reply |
OOO K

ANimaniacs and southpark. Ill not even touch on that one, but anyways.

"C'mon Apple! Give us back the option to require a password on wake. Especially for us Powerbook users. "

Its called Panther. in the security prefs pane, click the "Require a password to wake this computer from sleep or screen saver" option.

there ya go problem solved.

Show More Comments

Login Here

toggle

Network Headlines

05/17	Mozilla delays plans to block third...
05/17	Yahoo schedules press event for May...
05/17	MacBook Air stock beginning to evaporate...
05/17	'iRadio' announcement may miss WWDC...
05/17	Apple devices officially OK'd for secure...

Show All

05/19	Mini review: Samsung Galaxy S4 with...
05/17	Mozilla delays plans to block third...
05/17	Yahoo schedules press event for May...
05/17	'iRadio' announcement may miss WWDC...
05/17	Apple devices officially OK'd for secure...

Show All

toggle

OS X update will fix screensaver flaw

updated 12:20 pm EDT, Fri July 11, 2003

OSX or XP?

Ugh... like windows?

Let's be fair

RE: Let's be fair

re : Let's be fair

You don't get it

Re: You don't get it

4000 chars..

Time limit? Nope...

Local vs. Remote Exploit

Re: OSX or XP?

Re: you don't get it

Finally an on-topic post

Great...

Impression

Not like quicken

No one? Are you sure?

Mission Impossible???

Re: Not like quicken

Re: Mission Impossible

f****** idiots!

Screensaver is a joke

security

Oh not again...

OOO K

Login Here

Register for our weekly email newsletter:

Connect tools:

Subscribe

to our RSS

Follow us

on Twitter

Most Read

10 Most Discussed

MacNN Marketplace

OS X update will fix screensaver flaw

updated 12:20 pm EDT, Fri July 11, 2003

Related Articles

Recent Articles

OSX or XP?

Ugh... like windows?

Let's be fair

RE: Let's be fair

re : Let's be fair

You don't get it

Re: You don't get it

4000 chars..

Time limit? Nope...

Local vs. Remote Exploit

Re: OSX or XP?

Re: you don't get it

Finally an on-topic post

Great...

Impression

Not like quicken

No one? Are you sure?

*Mission Impossible???*

Re: Not like quicken

Re: Mission Impossible

f****** idiots!

Screensaver is a joke

security

Oh not again...

OOO K

Login Here

Register for our weekly email newsletter:

Connect tools:

Subscribe

to our RSS

Follow us

on Twitter

Most Read

10 Most Discussed

MacNN Marketplace

Mission Impossible???