
More holes than a doily...
By Joris Evers
Published: 14 March 2007 08:25 GMT
Apple has issued a security update for its Mac OS X to plug 45 security holes, including several zero-day vulnerabilities.
The mega-patch is the seventh Apple security patch release in three months. It deals with vulnerabilities in the Mac maker's own software, as well as third-party components such as Adobe Systems' Flash Player, MySQL and OpenSSH. Sixteen of the vulnerabilities addressed by the update were previously released as part of two high-profile bug-hunting campaigns.
The vulnerabilities pose varying risks to Macs. Several of the flaws could be exploited to gain full control over a Mac running the vulnerable component, according to Apple's advisory. Other holes are limited and could only be exploited to crash a Mac or used by somebody who already has access to a machine to elevate privileges, for example.
One focus of the patch is to fix eight vulnerabilities in the way Mac OS X handles disk images, files that when opened appear as a drive within the Macintosh Finder. Mounting a malicious image may lead to an error and could provide a means for an attacker to breach a Mac, Apple said.
The update deals with nine vulnerabilities released as part of the Month of Apple Bugs in January and seven bugs disclosed in the Month of Kernel Bugs back in November. In earlier fix releases, Apple fixed several flaws identified during the projects.
While several of the vulnerabilities repaired by Apple's updates were previously known, it doesn't appear that any attacks which exploited the flaws actually occurred.
In addition to the Mac OS X patch, Apple issued a second update to fix a security bug in iPhoto which could expose Mac users to a serious attack. An attacker could craft a malicious "photocast" which, when opened, could compromise a Mac, Apple said in its alert. The Photocasts feature allows people to share pictures in iPhoto.
The latest two releases bring Apple's total patch count for the year to seven. Microsoft, meanwhile, skipped its monthly patch day. However, it released a dozen security bulletins with fixes for 20 vulnerabilities in February and four bulletins with fixes for 10 bugs in January.
The Apple patch can be downloaded and installed via the Software Update feature in Mac OS X, or from Apple Downloads.
Joris Evers writes for CNET News.com
I am currently looking for an Apple Mac support engineer for my large Media Client. Technically you will need to be proficient and have ...
My Client in EAST LONDON requires someone for a short term contract to support their MAC OS X users. Rate 10-12 per hour Required skills: Knowledge ...
We require someone with Mac expertise to recompile the software for Mac, feed back any portability issues to our developers for review as necessary ...
CIO Agenda 2008
The exclusive silicon.com CIO Agenda 2008 survey looks at the CIO's tech shopping list for the year, examines whether IT budgets are rising or falling and reveals what the pain points are for tech chiefs this year. Find out more in our latest special report.
Staffing Service Coordinates Sales Activities, Utilizes Business Intelligence With...
Teachers Association Turns to Centralized Data Repository to Improve Member Service
Financial-Software Leader Credits Productivity Boost, Reduced IT Costs to 2007 Software
United States Coast Guard Explores Potential to Enhance Training With Digital Note-Taking...
Stories from the web...
Copyright ©1995-2008 CNET Networks, Inc. All rights reserved. Top of page
silicon.com Dear silicon.com... XP lives, the femtocell 'truth', BlackBerry bashing… Reader Comments of the Week
Martin Brampton The Brampton Factor: Open source 'brotherhood' closed to co-operation Where's the real sharing?