Apple issues mega-monster security update
'Frighteningly large' release patches nearly 90 bugs in Leopard, Tiger
Computerworld - Apple Inc. Tuesday issued a record-breaking security update that patched nearly 90 vulnerabilities in both its own code and the third-party applications it bundles with its Tiger and Leopard operating systems.
Security Update 2008-002 plugged 87 holes in the client and server editions of Mac OS X 10.4 and Mac OS 10.5. This single update's total patch count nearly equaled half of all the fixes Apple released in 2007, and easily dwarfed the biggest updates that year, both of which saw 40 or more bugs patched.
"What a dizzy double take," said Andrew Storms, director of security operations at nCircle Network Security Inc. in an e-mail. "Right on the heels of an unprecedented giant Safari fix, we now have a frighteningly large set of updates for OSX 10.4.11 and 10.5.2."
The day's much larger security roll-up fixed flaws in 30 different applications or operating system components in Mac OS X, from AFP Client and Apache to the Wiki Server and X11, the Mac's version of the X Window System. "Historically, the third-party applications bundled with OS X have made up a decent majority of these updates," said Storms. "Today's release is no different." By Storms' count, 18 of the 30 components or applications patched were Apple's own. An even dozen were the responsible of others.
Some of the vulnerabilities were specific to Leopard, others to Tiger. The Leopard update quashed bugs in AFP Client, Apache, Application Firewall, ClamAV, CUPS, Emacs, Help Viewer, Image Raw, Kerberos, mDNSResponder, OpenSSH, pax archive, PHP, Podcast Producer, Preview, Printing, System Configuration, UDF, Wiki Server and X11.
Several were found only in Server 10.5. The open-source ClamAV antivirus scanner included with Apple's server operating system received patches for nine bugs, for example. "Multiple vulnerabilities exist in ClamAV 0.90.3 provided with Mac OS X Server v10.5 systems, the most serious of which may lead to arbitrary code execution," read Apple's advisory.
In Tiger, meanwhile, AFP Client, AFP Server, Apache, AppKit, CFNetwork, ClamAV, CoreFoundation, CoreServices, CUPS, curl, Emacs, file, Foundation, Help Viewer, Kerberos, libc, notifyd, OpenSSH, PHP, System Configuration and X11 were patched.
"The majority of the more critical updates from today are found in those third-party applications," said Storms. "Point being, we can't blame Apple for all the security issues in OS X."
Unlike other operating system vendors, Apple doesn't rate the vulnerabilities it patches. A large number of the fixes Tuesday, however, were accompanied by Apple phrasing -- "arbitrary code execution" -- that signals the bug could be used by attackers to infect a Mac with malicious code. In others' ranking systems, vulnerabilities like that are typically classified as "critical" threats.
Security Update 2008-002 can be downloaded manually from the Apple site, or installed using Mac OS X's integrated update service. Depending on the version, the update runs between 50MB and 108MB in size.
Read more about Security in Computerworld's Security Topic Center.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts