Apple issues final non-security update for OS X Mountain Lion
Patches 30 vulnerabilities, also ships updates for Lion and aged Snow Leopard
Computerworld - Apple on Thursday updated OS X Mountain Lion to version 10.8.5, likely the final refresh of the 14-month-old operating system before the company supersedes it with OS X Mavericks.
The update, a combination of security, stability and compatibility fixes, patched a total of 30 vulnerabilities in Mountain Lion. It was accompanied by security-only updates for 2011's OS X 10.7, aka Lion, and 2009's OS X 10.6, known as Snow Leopard. This was the first time since early June that Apple refreshed Mountain Lion.
Apple called out several non-security fixes inside 10.8.5, including ones that addressed a bug that blocked the bundled Mail email client from displaying messages, improved file transfer performance and reliability over Wi-Fi and Ethernet networks, and tweaked connections between Macs and Apple's Xsan storage area network.
On the security side, 10.8.5 patched 30 vulnerabilities, including 7 labeled with the line "may lead to ... arbitrary code execution," which is Apple's way of saying that they're critical. The fixes quashed bugs in several open-source components integrated with Mountain Lion, such as Apache (4 patches); Bind (5), the most widely-used DNS (domain name system) software for routing Internet requests to the correct addresses; OpenSSL (3); and PHP (4), the server-side scripting language.
Also included in the update were patches to stymie attacks using rogue PDF documents, one to fix a problem with Macs coming out of sleep to a locked state, and another to plug a hole in QuickTime, Apple's often-buggy media playing software.
One of the patches was for a several-months-old vulnerability in the Unix component known as "sudo," which lets users gain super-user or "root" rights. By resetting the system clock, hackers who have already managed to grab limited control of a Mac can sidestep the need for the root-access password.
The sudo flaw had been identified in OS X in March, but attracted more attention two weeks ago after Metasploit, the popular open-source penetration toolkit, added a module that made it easy to exploit the bug.
Also published Thursday was an update to Safari 5, the Apple browser for Snow Leopard; the separate update patched a pair of vulnerabilities, including one revealed at the September 2012 Mobile Pwn2Own hacking contest by a Dutch team who used it to exploit iOS. Apple had patched the same bugs in the newer Safari 6 last year.
OS X 10.8.5 and Security Update 2013-003 -- the latter targets OS X Snow Leopard and OS X Lion, which at this point receive only security fixes -- can be retrieved by selecting "Software Update..." from the Apple menu, or by opening the Mac App Store application and clicking the Update icon at the top right. The updates can also be downloaded manually from Apple's support site.
Apple has not yet revealed a release date for OS X Mavericks, the successor to Mountain Lion, but it will probably ship in the second half of next month.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His email address is email@example.com.
- Researcher claims two hacker gangs exploiting unpatched IE bug
- Update: Third of Internet Explorer users at risk from attacks
- Microsoft plans another short patch slate for next week, but finds a few XP bugs to crush
- Target attack shows danger of remotely accessible HVAC systems
- Target hackers try new ways to use stolen card data
- Update: Microsoft to patch just-revealed Windows zero-day tomorrow
- NSA spying prompts open TrueCrypt encryption software audit to go viral
- Microsoft warns of Office zero-day, active hacker exploits
- Hackers move to create next Blackhole after 'Paunch' arrest
- Adobe hack shows subscription software vendors lucrative targets
Read more about Mac OS X in Computerworld's Mac OS X Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Streamline Data Protection with IBM Tivoli Storage Manager Operations Center IBM Tivoli Storage Manager (TSM) has been an industry-standard data protection solution for two decades. But, where most competitors focus exclusively on Backup...
- Simplify and Consolidate Data Protection for Better Business Results Learn about IBM® Tivoli® Storage Manager Operations Center, which provides advanced visualization, built-in analytics and integrated workflow automation features that leapfrog traditional backup...
- HP HAVEn: See the big picture in Big Data HP HAVEn is the industry's first comprehensive, scalable, open, and secure platform for Big Data. Enterprises are drowning in a sea of data...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Mac OS X White Papers | Webcasts