Technology news and Jobs 
VIRTUALISATION Apple in a BIND with Security Update 2009-004
VIRTUALISATION Apple in a BIND with Security Update 2009-004 | Apple in a BIND with Security Update 2009-004 |
|
| by Stephen Withers | |
| Thursday, 13 August 2009 | |
  
Featured Whitepaper
5 Best Practices for Smartphone Support
BIND itself was updated at the end of July, so Apple has acted relatively quickly by passing on the update to its customers in two weeks. New versions of open-source components used in Mac OS X have been known to be several months old before Apple packages them into software updates. The strange thing is that this comparatively prompt release is for a component that is not enabled by default in either Mac OS X or Mac OS X Server. This has led to speculation that the underlying problem may be more serious than generally regarded. For example, security vendor Intego noted: "While other sources say it is of low severity, Apple’s choice of issuing this security update now suggests that it might actual [sic] be more serious." Anyway, here's how Apple describes the problem: "A logic issue in the handling of dynamic DNS update messages may cause an assertion to be triggered. By sending a maliciously crafted update message to the BIND DNS server, a remote attacker may be able to interrupt the BIND service. The issue affects servers which are masters for one or more zones, regardless of whether they accept updates. BIND is included with Mac OS X and Mac OS X Server but it is not enabled by default. This update addresses the issue by properly rejecting messages with a record of type 'ANY' where an assertion would previously have been raised." The BIND developers were more concise: "A specially crafted update packet will cause named to exit." Security Update 2009-004 is available for Mac OS X 10.4.11 (separate PowerPC and Intel versions), Mac OS X Server 10.4.11 (a single Universal version), Mac OS X 10.5.8, and Mac OS X Server 10.5.8. The size of the updates varies considerably, in part because they incorporate the content of previous Security Updates. Security Update 2009-004 is available via Software Update or Apple's Support Downloads page. |
Tags
| < Next story in category | Previous story in the category > |
|---|
