Apple issues mega-monster security update
'Frighteningly large' release patches nearly 90 bugs in Leopard, Tiger
March 19, 2008 12:00 PM ETComputerworld - Apple Inc. Tuesday issued a record-breaking security update that patched nearly 90 vulnerabilities in both its own code and the third-party applications it bundles with its Tiger and Leopard operating systems.
Security Update 2008-002 plugged 87 holes in the client and server editions of Mac OS X 10.4 and Mac OS 10.5. This single update's total patch count nearly equaled half of all the fixes Apple released in 2007, and easily dwarfed the biggest updates that year, both of which saw 40 or more bugs patched.
"What a dizzy double take," said Andrew Storms, director of security operations at nCircle Network Security Inc. in an e-mail. "Right on the heels of an unprecedented giant Safari fix, we now have a frighteningly large set of updates for OSX 10.4.11 and 10.5.2."
Earlier today, Apple updated its Safari browser for both Mac and Windows, patching 13 vulnerabilities.
The day's much larger security roll-up fixed flaws in 30 different applications or operating system components in Mac OS X, from AFP Client and Apache to the Wiki Server and X11, the Mac's version of the X Window System. "Historically, the third-party applications bundled with OS X have made up a decent majority of these updates," said Storms. "Today's release is no different." By Storms' count, 18 of the 30 components or applications patched were Apple's own. An even dozen were the responsible of others.
Some of the vulnerabilities were specific to Leopard, others to Tiger. The Leopard update quashed bugs in AFP Client, Apache, Application Firewall, ClamAV, CUPS, Emacs, Help Viewer, Image Raw, Kerberos, mDNSResponder, OpenSSH, pax archive, PHP, Podcast Producer, Preview, Printing, System Configuration, UDF, Wiki Server and X11.
Several were found only in Server 10.5. The open-source ClamAV antivirus scanner included with Apple's server operating system received patches for nine bugs, for example. "Multiple vulnerabilities exist in ClamAV 0.90.3 provided with Mac OS X Server v10.5 systems, the most serious of which may lead to arbitrary code execution," read Apple's advisory.
In Tiger, meanwhile, AFP Client, AFP Server, Apache, AppKit, CFNetwork, ClamAV, CoreFoundation, CoreServices, CUPS, curl, Emacs, file, Foundation, Help Viewer, Kerberos, libc, notifyd, OpenSSH, PHP, System Configuration and X11 were patched.
"The majority of the more critical updates from today are found in those third-party applications," said Storms. "Point being, we can't blame Apple for all the security issues in OS X."
Unlike other operating system vendors, Apple doesn't rate the vulnerabilities it patches. A large number of the fixes Tuesday, however, were accompanied by Apple phrasing -- "arbitrary code execution" -- that signals the bug could be used by attackers to infect a Mac with malicious code. In others' ranking systems, vulnerabilities like that are typically classified as "critical" threats.
Security Update 2008-002 can be downloaded manually from the Apple site, or installed using Mac OS X's integrated update service. Depending on the version, the update runs between 50MB and 108MB in size.
Apple
Additional Resources



Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.
White Papers & Webcasts
Share our Strength
Download Now
Lower the Cost and Complexity of a Mobile Workforce through Automation
Download This Resource Now!
Top 10 Things to Know about Data Protection
Download Now
Managing Mobility: Improve Data Security, Compliance and Manageability
Download This Resource Now!
Managing Secure File Transfer to Save Time, Money and IT Resources
Learn how companies are using innovative technology to overcome these challenges and improve user productivity by offloading e-mail attachments and replacing FTP with...
Ponemon Study: The Business Risk of a Lost Laptop
Download Now
Security Convergence Equals Network Security Cost Savings
Listen to IBM Internet Security Systems' take on network security convergence.
Airport Insecurity: The Case of Lost Laptops
Download Now
Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...
