Over the past several months, I’ve heard from students and clients about how the Apple/Mac store personnel tell them how secure Mac’s are compared to PCs. So secure says one of my PC Security students that she boasts not using any antivirus software or security tools!
I received one of my many security update summaries for last week and something interesting caught my eye that made me think back to this student. The summary listed 7, yes 7, vulnerabilities in Apple/Mac software.
Of course I reported on the issue with safari here: http://mice.org/blog/microsoft-advisory-blended-threat-windows-and-safari/
But there were six others disclosed just last week that included not only the MAC OS X Server but the OS X Operating System also.
These are also beginning to sound a lot like Microsoft flaws!
Here they are:
Unspecified vulnerability in AppKit in Apple Mac OS X before 10.5 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted document file, as demonstrated byopening the document with TextEdit. (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1028)
Integer overflow in the CFDataReplaceBytes function in the CFData API inCoreFoundation in Apple Mac OS X before 10.5.3 allows context-dependent attackers to execute arbitrary code or cause a denial of service (crash) via an invalid length argument, which triggers a heap-based buffer overflow. (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1030)
Integer overflow in ImageIO in Apple Mac OS X before 10.5.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG2000 image that triggers a heap-based buffer overflow. (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1574)
Unspecified vulnerability in the Apple Type Services (ATS) server in Apple Mac OS X 10.5 before 10.5.3 allows user-assisted remote attackers to execute arbitrary code via a crafted embedded font in a PDF document, related to memory corruption that occurs during printing. (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1575)
Mail in Apple Mac OS X before 10.5, when an IPv6 SMTP server is used, does not properly initialize memory, which might allow remote attackers to execute arbitrary code or cause a denial of service (application crash), or obtain sensitive information (memory contents) in opportunistic circumstances, by sending an e-mail message. (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1576)
Unspecified vulnerability in the Pixlet codec in Apple Pixlet Video inApple Mac OS X before 10.5.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file, related to “multiple memory corruption issues.” (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1577)
This page at Apple’s site: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html also lists these items and a few more, but in all of their descriptions they call a crash an unexpected system shutdown. Ummmmm, Apple folks? Here’s a heads up for you - that’s called a CRASH!
The question remains: Are Apple Mac users that arrogant to believe they are immune to flaws purely by virtue that they are running a Mac? Or, are they purely THAT STUPID?
Linux users know better than to believe their OS is infallible! Windows users have learned from experience that they are not infallible — REPEATEDLY!
So Mac users, which is it? Arrogance or stupidity? Because it’s obvious you aren’t immune!
And to the young lady in my course that doesn’t use AV software on her MAC, I’d suggest you get one immediately!
June 25th, 2008 at 5:11 pm
This sounds like the typical advice of a ’security expert’ (read - antivirus software consultant). Can you tell me what the actual incidence (percentage) of Mac OS X users who, despite keeping their system fulling updated have been hit with a virus?
You’re correct in stating that Mac OS X is not immune. No computer system is. However, anti-virus software is not without its downsides either. I’ve had Norton anti-virus cause horrible problems when it was trying to fix a disk.
A better form of security might be to use a good backup strategy, (such as that provided by Time Machine) than to spend money and time using anti-virus software that has a near zero probability of being of benefit and a non-zero probability of creating its own set of problems.
July 10th, 2008 at 2:57 pm
Matthew, if you go to this site: http://nvd.nist.gov/ and click on the statistics section in the upper right side of the page, you can do a search for vulnerabilities by Apple and by OS and see all the statistics you like to back up what I said.
How many viruses or vulnerabilities does it take to bring a Mac? Only one.
Debbie