Apple issues first security update of yearApple on Thursday issued four security updates that address a number of vulnerabilities in Mac OS X, Java and Safari for Windows. These are the first security updates Apple has released this year. Twenty-eight issues were included in Apple's Security Update 2009-001, which addresses about 50 security vulnerabilities, many that are present in third-party applications bundled with the Mac OS X platform. The flaws could enable an attacker to execute arbitrary code In computer security, arbitrary code is executable code introduced externally that runs despite the intent of the original programmer. The code is injected into a currently-running application or its memory space, thus making the application execute the code. , cause a denial-of-service condition, access the system with escalated privileges, or obtain sensitive information, according to according to prep. 1. As stated or indicated by; on the authority of: according to historians. 2. In keeping with: according to instructions. 3. a US-CERT (United States-Computer Emergency Readiness Team) The group charged with protecting the U.S. Internet infrastructure by coordinating defense against and response to cyberattacks. advisory encouraging users and administrators to review and apply the updates. One of the more notable vulnerabilities patched is in Safari RSS (Really Simple Syndication) A syndication format that was developed by Netscape in 1999 and became very popular for aggregating updates to blogs and the news sites. RSS has also stood for "Rich Site Summary" and "RDF Site Summary. . It leaves Mac OS X or Windows users open to arbitrary code execution if they access a maliciously crafted feed. Security researcher Brian Mastenbrook -- credited by Apple with discovering the flaw -- blasted the computing giant for not patching the bug sooner, which he reported roughly seven months ago. “This vulnerability works in exactly the same way on all affected platforms, and does not require intricate knowledge of the processor or operating system operating system (OS) Software that controls the operation of a computer, directs the input and output of data, keeps track of files, and controls the processing of computer programs. to exploit,” Mastenbrook wrote. “I discovered it accidentally, which indicates that this issue could also be discovered by others. These two factors should have indicated to Apple that this vulnerability carried a high risk.” An Apple spokesperson could not be reached for comment Friday. Other vulnerabilities addressed in the security update include errors that could all lead to arbitrary code execution if successfully exploited in Apple Pixlet Video, Carbon Core, ClamAV, CoreText, perl, python, SMB (1) (Small to Medium-sized Business) Also called "SME" (small to medium-sized enterprise), it refers to companies that are larger than the small office/home office (SOHO), but not huge. , and X11. Other issues were addressed in AFP (1) (AppleTalk Filing Protocol) The file sharing protocol used in an AppleTalk network. In order for non-Apple networks to access data in an AppleShare server, their protocols must translate into the AFP language. See file sharing protocol. Server, Certificate Assistant, CUPS web interface, DS Tools, fetchmail, Folder Manager, FSEvents, Network Time, csregprinter, Remote Apple Events server, Server Manager, SquirrelMail, FreeType, LibX11, and XTerm -- the details of all are included in Apple's update. Apple additionally issued an updates for Java for Mac OS X 10.15 (Update 3) and 10.4 (Release 8) for “multiple vulnerabilities” in Java Web Start A mechanism from Sun for delivering full-blown Java applications from a Web server. The programs are initially downloaded using the browser, but run outside of the browser. Contrast with Java applets, which require an open browser window to stay active. and the Java Plug-in, the worst of which may allow untrusted Java Web Start applications and untrusted Java applets to obtain elevated privileges. 
|
|
||||||||||||||
Printer friendly
Cite/link
Email
Feedback
Reader Opinion