Posts tagged Security Update at The Unofficial Apple Weblog (TUAW)

Posts with tag Security Update

Security Update 2008-002 v1.1

Posted Mar 26th 2008 4:59PM by Cory Bohon
Filed under: Software Update, Leopard

Today, Apple released Security Update 2008-002 v1.1 for Leopard client and Leopard server. Software Update gives us the following information about the update:

Security Update 2008-002 is recommended for all users and improves the security of Mac OS X. Previous security updates have been incorporated into this security update.

You can download this update by opening Software Update (Apple menu > Software Update) or by downloading either the client or server installer package from the Apple Support downloads website.

Security Update 2008-002 issues may be cleared up by Rogue Amoeba fix

Posted Mar 19th 2008 2:30PM by Michael Rose
Filed under: Security, Leopard

As many of you have reported, there are a few hiccups for some who have installed the latest Leopard security update. Two of the areas of concern are ssh (no connectivity or a crash) and printing (errors out, documents never finish spooling), with various fixes offered (reinstalling the 10.5.2 combo update, installing a standalone SSH build) and various degrees of success reported.

One emergent common thread for some of the problems is the presence of a Rogue Amoeba audio utility, and the gang in the petri dish have responded with a revised version of the Instant Hijack framework. The new 2.0.3 version aims to address a bug that has been latent since the introduction of Leopard's position-independent executables feature, where certain sensitive processes (like, say, ssh) could be run from a randomized memory address, avoiding attack vectors that depend on targeting a specific vulnerable spot within the code.

Up until the 2008-002 security patches, according to RA, the PIE feature wasn't used for anything yet -- after the update, surprise surprise, ssh is being moved around when it runs. Since Instant Hijack inspects newly launched processes to see if they have audio properties, it tries to look at the ssh instance in memory -- hey, wherdja go? Hence the problem.

If you have been experiencing ssh issues and have Rogue Amoeba apps installed, try the patch and let us know what happens.

[via Daring Fireball + Apple discussions]

Security Update 2008-002 is available

Posted Mar 18th 2008 7:00PM by Dave Caolo
Filed under: OS, Software Update

Fire up Software Update, Mac users. Security Update 2008-002 has been released. According to Apple, this update "...is recommended for all users and improves the security of Mac OS X. Previous security updates have been incorporated into this security update."

So, it improves security. How exciting. As usual, we ask you to report any problems you encounter after installing this update. Good luck, true believers! Note that this update, like the earlier Safari 3.1, requires a reboot.

Thanks to everyone who sent this in!

Update love for the Tiger crowd: Security Update 2008-001

Posted Feb 12th 2008 4:15PM by Michael Rose
Filed under: Software Update, Apple, Security

Want the security goodness of 10.5.2 in a familiar, Tiger-iffic package? You want the new, much improved Security Update 2008-001, available now for client and server versions of 10.4.11. The update includes fixes for URL vulnerabilities in Mail, Terminal and Safari, patches for Parental Controls and X11, and more -- full list after the break.

You can find this update in Software Update or download direct from Apple. Happy patching!

Continue reading Update love for the Tiger crowd: Security Update 2008-001

Security Update 2007-005

Posted May 24th 2007 4:45PM by Erica Sadun
Filed under: Software Update, Security

Apple has just posted its latest security update. This update addresses a boatload of possible vulnerabilities including a number of core unix utilities as well as iChat and VPN. Without further ado, here's a quick rundown of the fixes and the vulnerabilities:

Alias Manager. Impact: Users may be misled into opening a substituted file

BIND. Impact: Multiple vulnerabilities in BIND, the most serious of which is remote denial of service

CoreGraphics. Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution

crontabs. Impact: The daily /tmp cleanup script may lead to a denial of service

fetchmail. Impact: fetchmail password disclosure may be possible

file. Impact: Running the file command on a maliciously crafted file may lead to an unexpected application termination or arbitrary code execution

iChat. Impact: An attacker on the local network may be able to cause a denial of service or arbitrary code execution

mDNSResponder. Impact: An attacker on the local network may be able to cause a denial of service or arbitrary code execution

PPP. Impact: A local user may obtain system privileges

ruby. Impact: Denial of service vulnerabilities in the Ruby CGI library

screen. Impact: Multiple denial of service vulnerabilities in GNU Screen

texinfo. Impact: A vulnerability in texinfo may allow arbitrary files to be overwritten

VPN. Impact: A local user may obtain system privileges

Thanks Tomasz

Revised Security Update 004 and QT CanSecWest fix released

Posted May 1st 2007 6:30PM by Michael Rose
Filed under: Software Update, Security

Those of you in the habit of waiting a week or two to apply Apple's updates may now begin to snicker in satisfaction. A revised version of the 004 security update was released this afternoon, correcting two issues (Airport problems in 10.3.9 and FTP settings on Mac OS X Server). We linked to MacFixit's troubleshooting report for the original update late last week.

Also released: QuickTime 7.1.6, which applies to both Mac OS X and Windows deployments and closes the Java exploit used to win the CanSecWest $10,000 challenge. As expected, researcher Dino Dai Zovi and the Zero Day Initiative/Tipping Point are credited with the discovery of the vulnerability. The ZDI writeup notes that the time from discovery to patch was eight days... not all that bad.

[via MacRumors]

Security Update 2007-004

Posted Apr 19th 2007 5:10PM by Scott McNulty
Filed under: Software Update, Apple, Security

You know what that feeling in the air is? That's right! Apple has released a new security update. Security Update 2007-004. It seems to fix a slew of things, so I would suggest installing it as soon as possible.

It is available for 10.3.9 server, 10.3.9 client, PPC, and Universal flavors.

Security Update 2006-003

Posted May 11th 2006 6:01PM by Scott McNulty
Filed under: OS, Software Update

Apple also released Security Update 2006-003 today (which, if you're counting, is the third such security update for this year). This update includes files for both server and client editions of OS X, as well as files for OS X 10.3.9 through OS X 10.4.6.

This fixes a host of security issues, so I won't list them here but if you are interested check out the tech note.

Update: Brent points out, correctly, that there have been 9 security updates so far this year, however, I was correct in that this is the third OS specific update of the year. Don't you just like it when everyone is right?

Apple releases iTunes, security updates

Posted Mar 1st 2006 5:15PM by Dave Caolo
Filed under: Software Update, Apple

Apple has made both iTunes 6.0.4 and Security Update 2006-001 available via Security Update. According to Apple, iTunes 6.0.4 "...addresses stability and performance issues related to Front Row," and today's security update improves the security of the following components:

apache_mod_php
automount
Bom
Directory Services
iChat
IPSec
LaunchServices
LibSystem
loginwindow
Mail
rsync
Safari
Syndication

Go and get 'em, folks.

Update: Reader Bob points out that iPhoto has also been updated. It's now at version 6.0.2, which, according to Apple, "...resolves several minor issues with playing shared slideshows in Front Row." Thanks, Bob!

#	Blogger	Posts	Cmts
1	Cory Bohon	45	5
2	Dave Caolo	43	0
3	Mat Lu	34	4
4	Michael Rose	29	19
5	Scott McNulty	28	1
6	Erica Sadun	28	0
7	Brett Terpstra	22	0
8	Mike Schramm	19	4
9	Robert Palmer	10	19
10	Steven Sande	9	7
11	Christina Warren	6	17
12	Joshua Ellis	6	4
13	Nik Fletcher	2	1
14	Chris Ullrich	2	1
15	Jason Clarke	1	1
16	Lisa Hoover	1	1
17	Victor Agreda, Jr.	1	3

New games this week: We Ski edition? 'Lips' and 'Ninja Blade' also revealed, speculate away! Banjo-Kazooie 3 screens flood the net	Comic Life Magiq: heroic comic-building app from Plasq Silverback brings advanced usability testing to the Mac TinEye image search engine launches public beta
Pixelmator 1.2 "Draftsman" in the wild SingTel confirms iPhone for Singapore, India, the Philippines and Australia AppleScript: download YouTube videos	Microsoft integrates instant messaging with onlineTV viewing Why the CEO-superstar athlete pay metaphor is wrong 16 double-your-money stocks, 8 ways to make a million & 10 real estate markets set for steeper losses - Today in Money 5/12
Even more Banjo-Kazooie 3 screenshots surface Viva Piñata and Scene It? sequels are real! Bid on Ken Levine autographed copy of BioShock	Toyota responds to Ford's new initial quality ads eBay Find of the Day: The Jerrari Details: Audi's new supercharged 3.0-liter V6

Security Update 2008-002 v1.1

Security Update 2008-002 issues may be cleared up by Rogue Amoeba fix

Security Update 2008-002 is available

Update love for the Tiger crowd: Security Update 2008-001

Security Update 2007-005

Revised Security Update 004 and QT CanSecWest fix released

Security Update 2007-004

Security Update 2006-003

Apple releases iTunes, security updates

TUAW Features

RESOURCES

RSS NEWSFEEDS

Sponsored Links

The Unofficial Apple Weblog (TUAW) bloggers (30 days)

Featured Galleries

Twitter Updates

Most Commented On (7 days)

Recent Comments

More Apple Analysis

More from AOL Money and Finance

Weblogs, Inc. Network