Apple issues mega-monster security update
'Frighteningly large' release patches nearly 90 bugs in Leopard, Tiger
Computerworld - Apple Inc. Tuesday issued a record-breaking security update that patched nearly 90 vulnerabilities in both its own code and the third-party applications it bundles with its Tiger and Leopard operating systems.
Security Update 2008-002 plugged 87 holes in the client and server editions of Mac OS X 10.4 and Mac OS 10.5. This single update's total patch count nearly equaled half of all the fixes Apple released in 2007, and easily dwarfed the biggest updates that year, both of which saw 40 or more bugs patched.
"What a dizzy double take," said Andrew Storms, director of security operations at nCircle Network Security Inc. in an e-mail. "Right on the heels of an unprecedented giant Safari fix, we now have a frighteningly large set of updates for OSX 10.4.11 and 10.5.2."
The day's much larger security roll-up fixed flaws in 30 different applications or operating system components in Mac OS X, from AFP Client and Apache to the Wiki Server and X11, the Mac's version of the X Window System. "Historically, the third-party applications bundled with OS X have made up a decent majority of these updates," said Storms. "Today's release is no different." By Storms' count, 18 of the 30 components or applications patched were Apple's own. An even dozen were the responsible of others.
Some of the vulnerabilities were specific to Leopard, others to Tiger. The Leopard update quashed bugs in AFP Client, Apache, Application Firewall, ClamAV, CUPS, Emacs, Help Viewer, Image Raw, Kerberos, mDNSResponder, OpenSSH, pax archive, PHP, Podcast Producer, Preview, Printing, System Configuration, UDF, Wiki Server and X11.
Several were found only in Server 10.5. The open-source ClamAV antivirus scanner included with Apple's server operating system received patches for nine bugs, for example. "Multiple vulnerabilities exist in ClamAV 0.90.3 provided with Mac OS X Server v10.5 systems, the most serious of which may lead to arbitrary code execution," read Apple's advisory.
In Tiger, meanwhile, AFP Client, AFP Server, Apache, AppKit, CFNetwork, ClamAV, CoreFoundation, CoreServices, CUPS, curl, Emacs, file, Foundation, Help Viewer, Kerberos, libc, notifyd, OpenSSH, PHP, System Configuration and X11 were patched.
"The majority of the more critical updates from today are found in those third-party applications," said Storms. "Point being, we can't blame Apple for all the security issues in OS X."
Unlike other operating system vendors, Apple doesn't rate the vulnerabilities it patches. A large number of the fixes Tuesday, however, were accompanied by Apple phrasing -- "arbitrary code execution" -- that signals the bug could be used by attackers to infect a Mac with malicious code. In others' ranking systems, vulnerabilities like that are typically classified as "critical" threats.
Security Update 2008-002 can be downloaded manually from the Apple site, or installed using Mac OS X's integrated update service. Depending on the version, the update runs between 50MB and 108MB in size.
Read more about Security in Computerworld's Security Topic Center.
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!