I just received a notice from Cert about an advisory for an Apple Mac OS X vulnerabilty. You know that software and computer that doesn’t need anti-virus because it’s so secure? Yeah! Those guys! (And yes, I’m in one of my smart a** moods today!)
The systems affected are:
- Apple Mac OS X versions prior to and including 10.4.11 (Tiger) and 10.5.4 (Leopard)
- Apple Mac OS X Server versions prior to and including 10.4.11 (Tiger) and 10.5.4 (Leopard)
Apple has released a security update for those computers that are so secure and never have any issues with security here: http://support.apple.com/kb/HT3137
But I’m sure the majority of Mac users won’t need this because after all, they are already secure.
The security update fixes several vulnerabilities that Mac users don’t really have. The Cert Advisory claims that:
Attackers could exploit these vulnerabilities to execute arbitrary code, gain access to sensitive information, or cause a denial of service.
Among the list of fixes listed at Apple, we see the following vulnerabilities being fixed:
- Viewing a document containing a maliciously crafted font may lead to arbitrary code execution.
- Multiple vulnerabilities exist in ClamAV 0.92.1, the most serious of which may lead to arbitrary code execution.
- A person with access to the login screen may be able to list user names
- A local user may obtain the server password if an OpenLDAP system administrator runs slapconfig.
- An attacker with access to the local network may cause a denial of service.
- Viewing a maliciously crafted TIFF, PICT, or JPEG image may lead to an unexpected application termination or arbitrary code execution. (Is unexpected application termination another name for a crash? No, it can’t be! Everyone knows Mac’s don’t crash!)
- Files may be accessed by a local user who does not have the proper permissions.
- A weakness in the DNS protocol may allow remote attackers to perform DNS cache poisoning attacks.
- A user may log in without providing a password.
- A person with access to the login screen may be able to change a user’s password.
- mDNSResponder is susceptible to DNS cache poisoning and may return forged information.
- Multiple vulnerabilities exist in OpenSSH versions provided with Mac OS X v10.4.11 and Mac OS X v10.5.4, the most serious of which allows a local user to control another user’s X11 session.
- A local user may obtain the PPP password.
- Users may be misled into believing their passwords are stronger than they are.
- Authenticated users may have unexpected remote access to files and directories.
- Backing up a system with Time Machine may lead to the disclosure of sensitive information.
- Videoconferencing with a malicious user may lead to an unexpected application termination or arbitrary code execution.
- A remote attacker may cause persistent JavaScript injection on a Wiki server.
Welcome to the REAL world Mac users! The real world PC users are familiar with where nothing is taken for granted in terms of security.
You know what? You folks are looking more and more like a PC in terms of security! I’m sure glad I didn’t spend big money on your really secure machine that doesn’t need Antivirus because it’s SO secure! DANG! That would’ve really ticked me off!
And for those of you who are wondering why I’m being such a smart a**, you have no idea how many times I’ve been told in our courses that Apple Mac users don’t need to know about security because their machine is so secure it doesn’t even need Antivirus. And if I had a dollar for every Mac user in my security courses that have told me that the sales staff at the Mac store have told them this is so, I wouldn’t be looking at employment options right now!
In fact, if all PC and Mac users would realize that security is THEIR responsibility, I’d sell out every one of our courses we’ve offered during our Anniversary special! Am I in a bad mood? Yes I am. And the reason? Because I’m sick and tired of people telling me that nothing is every going to happen to them until it does. And then they come crying to me to fix their computer after the hack or malware attack, or the identity breach!
In fact, just this week, I had two family members inform me their identity has been breached! Which p*sses me off even more! This is what I teach! But not even my own family thinks it will happen to them after they hear me talk about it! But that’s a conversation for tomorrows blog entry.
Go update your MAC!
Do you enjoy this blog? Then buy me a coffee or send me a tip! May I suggest $3 for a Venti (extra-large) cup of Starbucks Carmel Macchiato? You can also choose any amount you wish.
September 30th, 2008 at 8:50 am
The difference is that Apple releases security updates and their user base DOES download them. I run a Microsoft WSUS server and I have to force critical updates down peoples throats who use windows because MS has a way of seriously destroying its OS with updates.
Now I may be a little pro Apple, and I may even be what you call a “Fan Boy” but it’s for good reason. No computer is 100% secure but the fact remains. There are still no ‘viri’ for mac.
Steps off soap box.
I have to agree about your point that no matter which OS the person happens to be on they need to take security into their own hands. The burden always goes to the user, and so many users fall short.
Stop using your first name as your password people. Honestly!