To print: Click here or Select File and then Print from your browser's menu

This story was printed from silicon.com, located at http://www.silicon.com/

Story URL: http://software.silicon.com/security/0,39024655,39166331,00.htm

Apple issues OS X mega-patch
More holes than a doily...

By Joris Evers

Published: Wednesday 14 March 2007

Apple has issued a security update for its Mac OS X to plug 45 security holes, including several zero-day vulnerabilities.

The mega-patch is the seventh Apple security patch release in three months. It deals with vulnerabilities in the Mac maker's own software, as well as third-party components such as Adobe Systems' Flash Player, MySQL and OpenSSH. Sixteen of the vulnerabilities addressed by the update were previously released as part of two high-profile bug-hunting campaigns.

The vulnerabilities pose varying risks to Macs. Several of the flaws could be exploited to gain full control over a Mac running the vulnerable component, according to Apple's advisory. Other holes are limited and could only be exploited to crash a Mac or used by somebody who already has access to a machine to elevate privileges, for example.

One focus of the patch is to fix eight vulnerabilities in the way Mac OS X handles disk images, files that when opened appear as a drive within the Macintosh Finder. Mounting a malicious image may lead to an error and could provide a means for an attacker to breach a Mac, Apple said.

The update deals with nine vulnerabilities released as part of the Month of Apple Bugs in January and seven bugs disclosed in the Month of Kernel Bugs back in November. In earlier fix releases, Apple fixed several flaws identified during the projects.

While several of the vulnerabilities repaired by Apple's updates were previously known, it doesn't appear that any attacks which exploited the flaws actually occurred.

In addition to the Mac OS X patch, Apple issued a second update to fix a security bug in iPhoto which could expose Mac users to a serious attack. An attacker could craft a malicious "photocast" which, when opened, could compromise a Mac, Apple said in its alert. The Photocasts feature allows people to share pictures in iPhoto.

The latest two releases bring Apple's total patch count for the year to seven. Microsoft, meanwhile, skipped its monthly patch day. However, it released a dozen security bulletins with fixes for 20 vulnerabilities in February and four bulletins with fixes for 10 bugs in January.

The Apple patch can be downloaded and installed via the Software Update feature in Mac OS X, or from Apple Downloads.

Joris Evers writes for CNET News.com