Apple delivers record monster security update
Patches 92 bugs in Leopard, Snow Leopard; no fix for Pwn2Own vulnerability
Computerworld - Apple today patched 92 vulnerabilities, a third of them critical, in a record update to its Leopard and Snow Leopard operating systems.
Security Update 2010-002 plugged 92 holes in the client and server editions of Mac OS X 10.5 and Mac OS X 10.6, breaking a record that has stood since March 2008. The update dwarfed any released last year, when Apple's largest patched 67 vulnerabilities.
"The sheer number, it's almost so daunting that you don't even want to look," said Andrew Storms, director of security operations at nCircle Network Security.
Today's security roll-up fixed flaws in 42 different applications or operating system components in Mac OS X, from AppKit and Application Firewall to unzip and X11, the Mac's version of the X Window System.
Eighteen of the vulnerabilities were specific to the older Leopard operating system, while 29 were specific to Snow Leopard. The remaining 45 affected both, which are the only editions that Apple currently supports. Users running Leopard will patch 63 vulnerabilities, while Snow Leopard users face a total of 74 flaws.
The update brings Snow Leopard to version 10.6.3, making this the third major update to the OS that Apple launched in August 2009. Apple also addressed a list of nearly 30 non-security issues in the 10.6.3 update. Leopard users, meanwhile, received only the security patches.
More than 40% of the vulnerabilities patched today, 37 out of the 92, were accompanied by the phrase "may lead to arbitrary code execution," which is Apple's way of saying that a flaw is critical and could be used by attackers to hijack a Mac. Apple does not assign ratings or severity scores to the bugs it patches, unlike other major software makers, such as Microsoft and Oracle.
Among the most noticeable patches were nine affecting QuickTime, Apple's media player, in Snow Leopard. All nine were rated critical; six had been reported to Apple by 3Com TippingPoint, which runs a bug bounty program called Zero Day Initiative.
TippingPoint was in the news much of last week as it again sponsored the Pwn2Own hacking contest at the CanSecWest security conference in Vancouver, British Columbia. The company handed out $45,000 in prizes to five researchers for hacking the iPhone, as well as Apple's Safari, Microsoft's Internet Explorer and Mozilla's Firefox browsers.
Charlie Miller, the researcher who cracked Snow Leopard's security defenses to take down Safari, said today that Apple had not patched the vulnerability he used last Wednesday. "New patch doesn't fix pwn2own bug," Miller said via Twitter. "Sorry suckers, gonna have to wait for the next patch."
The timing of today's monster update didn't come as a surprise to nCircle's Storms. "It's not suprising that they patched QuickTime, what with the pending iPad release," he said today, referring to the April 3 on-sale date for Apple's new media tablet. Apple typically updates its iTunes music software, and the accompanying QuickTime player, before it releases new products that call on the former. The iPad will use the iTunes store to serve up applications and media content to customers.
"For the same reason, I'm going to guess that Apple will also update the iPhone OS this week," Storms added.
The security update can be downloaded from the Apple site or installed using Mac OS X's integrated update service.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is firstname.lastname@example.org.
- Apple users were left at risk by 3-week delay between OS X and iOS patches
- As iPad sales slump, Cook hijacks analysts' fast-uptake explanation
- Apple defies PC downturn again, boosts Mac sales
- Tim Cook to Microsoft: Better late than never for Office on iPad
- Apple kicks off public OS X beta testing
- Apple patches Secure Transport, but not because of Heartbleed
- Apple customers downsize iPhone, iPad storage in March quarter
- Free OS X Mavericks now powers half of all Macs
- Apple has bigger plans than just song ID with Shazam deal
- Mac Pro shortage sets record as worst Mac production debacle
Read more about Security in Computerworld's Security Topic Center.
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Neustar 2014 DDoS Attacks and Impact Report For the third consecutive year, Neustar surveyed hundreds of companies on distributed denial of service (DDoS) attacks. The survey reveals evidence that the...
- Acxiom Case Study This case study, which focuses on Acxiom, explores how the company was able to secure employee data, reduce migration costs and boost productivity...
- Windows® XP Migration: Protect and Secure Critical Data With the end of the Microsoft Windows XP operating system's lifecycle on April 8, 2014, businesses are faced with the decision to migrate...
- Enhancing Application Protection and Recovery with a Modern Approach to Snapshot Management This CommVault Business Value and Technology White Paper explains how Simpana IntelliSnap® Recovery Manager can make your application recovery fast and reliable.
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts