Filed under: Software Update, Security
Apple Security fix includes BIND update
Yesterday, shortly after I read TidBITS' post on securing the DNS flaw that Apple had ignored for a while, Apple released a security fix which finally took care of the situation. This comes 3 weeks after the security industry began taking matters into their own hands. This fix does overwrite the files updated in the TidBITs post on manually correcting the issue, mentioned above.
In Apple's notes on the update, they mention fixes for:
- Open Scripting Architecture, which addresses the ARDAgent issue which allowed Trojan Horses and non-administrator users to gain root access
- The aforementioned BIND issue which allowed for DNS poisoning (allowing malicious websites to forge their identity)
- A CarbonCore stack buffer overflow which allowed for arbitrary code execution
- A CoreGraphics memory corruption issue and a CoreGraphics PDF weakness, both allowing for arbitrary code execution
- A Data Detectors issue which could be exploited for [DOS](http://en.wikipedia.org/wiki/Denial-of-service_attack) attacks
- A Repair Permissions/emacs exploit in Disk Utility
- An LDAP weakness
- An OpenSSL weakness
- Multiple PHP vulnerabilities
- A flaw in QuickLook's handling of maliciously crafted Microsoft Office files
- An issue with rsync's handling of symbolic links
Some of those had been reported, some I hadn't heard about previously, but I'm certainly feeling more secure this morning.
[via Macworld]
![TUAW [Cafepress]](http://www.blogsmithmedia.com/www.tuaw.com/media/tuaw-cafepress-promo.png)
Reader Comments (Page 1 of 1)
Max Gilchuk said 10:53AM on 8-01-2008
Just want to see if anyone else experience any issues after installing this update. After i had installed and restarted, every single one of my apps crashed while starting up... I couldn't open anything. It wasn't until I restarted again, that my apps became functional again.
Reply
StanleyCup99 said 11:31AM on 8-01-2008
It does say 'Restart will be required'...
Max Gilchuk said 12:57PM on 8-01-2008
No my apps we're crashing AFTER the initial re-start, I had to restart twice before my apps regained functionality...
Stu said 2:21PM on 8-01-2008
My iMac G5 logs itself out as soon as a log in after installing the update. Repaired permissions, no joy. Managed to get it to start in safe boot mode.
Reply
William said 3:25PM on 8-01-2008
How come TUAW hasn't posted the story about how Apple's DNS patch doesn't actually patch the DNS flaw that it was supposed to patch? I submitted the story earlier this morning, as I'm sure other people have also...the story has been floating around the Internet for several hours now too, so it seems odd that TUAW hasn't come across it themselves either.
Reply