Apple Tuesday issued a record-breaking security update that patched nearly 90 vulnerabilities in both its own code and the third-party applications it bundles with its Tiger and Leopard operating systems.
Security Update 2008-002 plugged 87 holes in the client and server editions of Mac OS X 10.4 and Mac OS 10.5, This single update's total patch count nearly equaled half of all the fixes Apple released in 2007, and easily dwarfed the biggest updates that year, both which saw 40 or more bugs patched.
"What a dizzy double take," said Andrew Storms, director of security operations at nCircle Network Security in an e-mail. "Right on the heels of an unprecedented giant Safari fix, we now have a frighteningly large set of updates for OSX 10.4.11 and 10.5.2."
Earlier today, Apple updated its Safari browser for both Mac and Windows, patching 13 vulnerabilities.
The day's much larger security roll-up fixed flaws in 30 different applications or operating system components in Mac OS X, from AFP Client and Apache to the Wiki Server and X11, the Mac's version of the X Window System. "Historically, the third-party applications bundled with OS X have made up a decent majority of these updates," said Storms. Today's release is no different." By Storm's count, 18 of the 30 components or applications patched were Apple's own. An even dozen were the responsible of others.
Some of the vulnerabilities were specific to Leopard, others to Tiger. The Leopard update quashed bugs in AFP Client, Apache, Application Firewall, ClamAV, CUPS, Emacs, Help Viewer, Image Raw, Kerberos, mDNSResponder, OpenSSH, pax archive, PHP, Podcast Producer, Preview, Printing, System Configuration, UDF, Wiki Server, and X11.
Several were found only in Server 10.5. The open-source ClamAV antivirus scanner included with Apple's server operating system received patches for nine bugs, for example. "Multiple vulnerabilities exist in ClamAV 0.90.3 provided with Mac OS X Server v10.5 systems, the most serious of which may lead to arbitrary code execution," read Apple's advisory.
In Tiger, meanwhile, AFP Client, AFP Server, Apache, AppKit, CFNetwork, ClamAV, CoreFoundation, CoreServices, CUPS, curl, Emacs, file, Foundation, Help Viewer, Kerberos, libc, notifyd, OpenSSH, PHP, System Configuration, and X11 were patched.
"The majority of the more critical updates from today are found in those third-party applications," said Storms. "Point being, we can't blame Apple for all the security issues in OS X."
Unlike other operating system vendors, Apple doesn't rate the vulnerabilities it patches. A large number of the fixes Tuesday, however, were accompanied by Apple phrasing -- "arbitrary code execution" -- that signals the bug could be used by attackers to infect a Mac with malicious code. In others' ranking systems, vulnerabilities like that are typically classified as "critical" threats.
Security Update 2008-002 can be downloaded manually from the Apple site, or installed using Mac OS X's integrated update service. Depending on the version, the update runs between 50MB and 108MB in size.
Computerworld is an InfoWorld affiliate.
This whitepaper explains the terminology and concepts behind Data Replication technologies and establishes some sizing rules through worked examples. Learn the new paradigm in disaster tolerance—protect data anywhere.
Download now »
Server virtualization is a popular option for dealing with mounting datacenter costs. Another equally promising approach is the use of an Application Delivery Controller. Citrix NetScaler provides a low-cost way for organizations to reduce their server count and accrue cost savings from a reduction in space, cooling, power and personnel.
Download now »
The emergence of WLANs has created a new breed of security threats to enterprise networks.
Included in HP ProCurve WLAN solutions is security technology that alleviates threats from WLANs through:
* Monitoring wireless activity inside and out of the enterprise
* Classifying WLAN transmissions into harmful and harmless
* Preventing transmissions that pose a security threat to the enterprise network
* Locating participating devices for physical remediation
Effectively address data protection challenges, implementing solutions that help store and protect business–critical data while cutting costs and improving efficiency and reliability.
Download now »
Sign up to receive Security Resource Alerts
This white paper provides guidance on how to develop a strategic approach to managing and monitoring logs, a key function required for compliance with many regulatory mandates and a critical defense against security threats.
Download now! »
Learn about the processes and technologies that support security information management (SIM) operations, as well as the business case for SIM. The series examines different options for implementing SIM and gives you evaluation criteria for selecting the best option for your organization.
Download now! »
Learn the strategies, actions, and capabilities that Best-in-Class organizations employ and technologies they choose to obtain superior performance against various security performance metrics. This report provides guidelines for identifying which security solutions to consume as a MSS and defines best practices for choosing and managing MSSPs.
Download now! »
Recommend This
