Mac OS X Pwn2Own vulnerability patched

Stephen Withers
Thursday, 15 April 2010 09:31

Business IT - Security

Apple has been forced to release another security update for Mac OS X just over two weeks after the last one.

Apple's Security Update 2010-003 delivers a patch for the vulnerability that was used by security researcher Charlie Miller to win a prize in the Pwn2Own competition at the CanSecWest conference last month.

The update improves error checking in Apple Type Services so that a document containing a maliciously crafted embedded font does not cause arbitrary code execution.

Mac OS X 10.6.3 and Security Update 2010-002 were released on March 30, fixing an extensive list of vulnerabilities. That was after Miller's winning exploit had been disclosed.

Mozilla's Firefox browser was also successfully hacked at Pwn2Own, but an update that patched the vulnerability (among other changes) was released on  April 1.

Software Update 2010-003 can be installed most easily through Software Update, and a standalone updater is available via Apple's Support Downloads page.