 |
 Stephen Withers turns his gaze on the world of Apple, with
detours into other aspects of IT and communications as they catch his
attention. |
Technology news and Jobs 
Our Blogs Core Dump Extensive security update for Mac OS X
Our Blogs Core Dump Extensive security update for Mac OS X | Extensive security update for Mac OS X |
|
| by Stephen Withers | |
| Wednesday, 19 March 2008 | |
|
Similarly, the ClamAV antivirus software that is part of Mac OS X Server is brought up to version 0.92.1, the latest stable release which debuted in June 2007. Apple has been criticised in the past for failing to provide its customers with up-to-date versions of open source projects that are packed with its operating system. CUPS, the Common Unix Printing System now owned and maintained by Apple, is updated to version 1.3.6, released in mid February. Addressed vulnerabilities could be used for denial of service attacks or the execution of arbitrary code with system privileges. The version of PHP (Mac OS X Server only) is updated to 4.4.8, which was released in early January. The update also includes patches for the curl, file and pax commands, Emacs, Kerberos, notifyd, OpenSSH and X11. Software components developed by Apple that are affected by the security update include AFP (arbitrary code execution, authentication bypass), AppKit (remotely-triggered arbitrary code execution), CFNetwork (spoofing by malicious proxy servers), CoreFoundation (privilege escalation), CoreServices (misclassification of .ief files as 'safe'), Foundation (privilege escalation, arbitrary code execution), Help Viewer (arbitrary AppleScript execution), Image Raw (arbitrary code execution triggered by malicious DNG files), mDNSResponder (arbitrary code execution), Podcast Producer (password exposure), Preview (weak encryption of PDF files), Printing (disclosure of login credentials), System Configuration (arbitrary code execution with system privileges), UDF (malicious disk images may cause system shutdown), and Wiki Server (path traversal may allow arbitrary code execution). That's quite a shopping list! Since exploits often quickly follow the disclosure of vulnerabilities (which is why it is so important for us that Apple keeps up with updates from external projects), it seems sensible to apply the update reasonably promptly. The update is available for desktop and server versions of Mac OS X 10.4.11 and 10.5.2. It can be installed via Software Update or downloaded from Apple's web site.
|
Tags
| < Next story in category | Previous story in the category > |
|---|
