Mac OS open to attack through unpatched Samba
Sharing utility rife with heap-based buffer overflow bugs
Computerworld - Hackers can attack Apple Inc.'s Mac OS X by exploiting an unpatched vulnerability in the open-source Samba file- and print-sharing software that's included with the operating system, Symantec Inc. said Monday.
Samba, which is enabled when Mac users turn on the Windows Sharing feature that allows Microsoft Corp. customers to access files and printers on a Mac network, was pegged with multiple heap-based buffer overflow bugs earlier this month. Exploits have been released by penetration test suppliers Immunity Inc. and the Metasploit Project that target the vulnerabilities on several Linux distributions.
"The DeepSight Threat Analyst Team successfully exploited the heap corruption vulnerability on a fully patched Mac OS X 10.4.9 system running the default Samba 3.0.10 application," said Symantec in an alert to customers of its threat network. "Exploitation differs from what has been demonstrated in public exploits, however it is likely that other researchers would be capable of quickly overcoming the technical quirks associated with the platform."
Although Mac OS X doesn't turn on Samba by default, Macs that share a network with Windows PCs could be at risk, Symantec warned. Because Apple has not released a Samba update since 2005, users must upgrade to the latest, and secure version, themselves.
"Mac OS X users are advised to download and install the latest version of Samba 3.0.25 from the official website," said Symantec. "If this is not possible, the Windows Sharing service should be disabled until Apple issues an official update via the Software Update service."
Related News and Discussion:
- Ken Mingis: Mac users 'unbearably smug' about security?
- Security 'holiday is over' for Mac users, security researchers say
- Samba developers quash serious bug
- Samba guru quits Novell for Google over GPL controversy
- Lucas Mearian: Why the iPhone is a ripoff
- Joyce Carpenter: Mac OS X better than Vista which is better than XP which is better than ...
Read more about Security in Computerworld's Security Topic Center.
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts