Technical Tidbits

Over the past several months, I’ve heard from students and clients about how the Apple/Mac store personnel tell them how secure Mac’s are compared to PCs. So secure says one of my PC Security students that she boasts not using any antivirus software or security tools!

I received one of my many security update summaries for last week and something interesting caught my eye that made me think back to this student. The summary listed 7, yes 7, vulnerabilities in Apple/Mac software.

Of course I reported on the issue with safari here: http://mice.org/blog/microsoft-advisory-blended-threat-windows-and-safari/

But there were six others disclosed just last week that included not only the MAC OS X Server but the OS X Operating System also.

These are also beginning to sound a lot like Microsoft flaws!

Here they are:

Unspecified vulnerability in AppKit in Apple Mac OS X before 10.5 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted document file, as demonstrated byopening the document with TextEdit. (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1028)

Integer overflow in the CFDataReplaceBytes function in the CFData API inCoreFoundation in Apple Mac OS X before 10.5.3 allows context-dependent attackers to execute arbitrary code or cause a denial of service (crash) via an invalid length argument, which triggers a heap-based buffer overflow. (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1030)

Integer overflow in ImageIO in Apple Mac OS X before 10.5.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG2000 image that triggers a heap-based buffer overflow. (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1574)

Unspecified vulnerability in the Apple Type Services (ATS) server in Apple Mac OS X 10.5 before 10.5.3 allows user-assisted remote attackers to execute arbitrary code via a crafted embedded font in a PDF document, related to memory corruption that occurs during printing. (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1575)

Mail in Apple Mac OS X before 10.5, when an IPv6 SMTP server is used, does not properly initialize memory, which might allow remote attackers to execute arbitrary code or cause a denial of service (application crash), or obtain sensitive information (memory contents) in opportunistic circumstances, by sending an e-mail message. (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1576)

Unspecified vulnerability in the Pixlet codec in Apple Pixlet Video inApple Mac OS X before 10.5.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file, related to “multiple memory corruption issues.” (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1577)

This page at Apple’s site: http://lists.apple.com/archives/security-announce/2008//May/msg00001.html also lists these items and a few more, but in all of their descriptions they call a crash an unexpected system shutdown. Ummmmm, Apple folks? Here’s a heads up for you - that’s called a CRASH!

The question remains: Are Apple Mac users that arrogant to believe they are immune to flaws purely by virtue that they are running a Mac? Or, are they purely THAT STUPID?

Linux users know better than to believe their OS is infallible! Windows users have learned from experience that they are not infallible — REPEATEDLY!

So Mac users, which is it? Arrogance or stupidity? Because it’s obvious you aren’t immune!

And to the young lady in my course that doesn’t use AV software on her MAC, I’d suggest you get one immediately!

written by Admin \\ tags: apple, apple video, application crash, crash, image, Mac, mac crash, mac mail, mac os x, mac video, mail, os, os x, os x server, osx, pdf, safari, safari browser, server, text, text document, video, vulnerabilities, vulnerability

Microsoft has issued an advisory early this morning warning of a possible blended threat that can affect Windows XP and Vista computers when Apple’s Safari is installed!

According to the advisory, Microsoft is investigating public reports of a blended threat that allows remote code execution on all supported versions of Windows XP and Windows Vista when Apple’s Safari for Windows has been installed. Microsoft reports that they are working with Apple to confirm these public reports and to establish an action plan for patching if the reports are proven true.

Microsoft recommends that you restrict use of Safari as a web browser until an appropriate update is available from Microsoft and/or Apple.

The Safari installation on Windows issue also relates to our blog entry: http://mice.org/blog/the-apple-updates-safari-great-debate/

That discusses how you might have installed Safari with an iTunes or QuickTime update.

The full Advisory is located here:

http://www.microsoft.com/technet/security/advisory/953818.mspx

We’ve alerted our Alert subscribers and will be following this issue to resolution.

If you wish to subscribe to our Alerts Newsletters to be informed of up-to-the-minute security issues that may affect you as they happen, please visit our subscribe page located here:

http://mice.org/lists/subscribe.html

We get all early warnings from a variety (and number) of sources so we compile them into one alert for you! It saves inbox space!

written by Admin \\ tags: Advisory, apple, apple safari, blended threat, itunes, Mac, Microsoft, quicktime, safari, safari vulnerability, security advisory, vista, windows, windows safari vulnerability, Windows Vista, Windows XP, xp

There seems to be some big “hissy fit” going on about Apple trying to push the new safari browser through your Apple Update Software. So, I decided to take some time today to check it out myself and ran the Apple Update.

And yes, there it is!

Now, first of all, let’s point out the obvious. See the check box next to Safari? If you uncheck it, Safari won’t install! We all know how to read, don’t we?

Secondly, I’ve read some BS out there about how Apple is trying to sneak this in on you. Are nuts? Where is this sneaking anything?

Some have also compared this to Microsoft’s sneaky attempts to give you junk you don’t want nor need. NO WAY! You cannot even compare the two!

Microsoft has snuck into our PCs and given us stealth updates - which Apple does not do. Additionally, Microsoft’s auto update encourages the EXPRESS installation which is a blanket install of anything they want to shove on you. You cannot compare the Apple Update Software to any of Microsoft’s antics! Get real!

Okay, that being said, I went ahead and installed the Safari browser just for fun. I must say I’m impressed and really thinking about moving from my ever slowing, sluggish Firefox to the new Safari. I really, really, really, love the bookmark organization in there! (But I’ll save that for a later review.)

But for now, let me say to those who are crying “FOUL” over the Apple Updates including Safari, if you can’t read or don’t pay attention to what the heck you’re downloading, then don’t blame Apple!

I have some issues with the elitest attitude of Apple users, so don’t think I’m a die hard Apple/MAC lover. The BS that MAC’s don’t get viruses and that they don’t crash, they have “Forced System Resets” that is touted by their sales staff makes me want to gag. But there is no way you can compare their update OFFERING you Safari as a download option to Microsoft’s SHOVE IT DOWN YOUR THROAT software installations.

If you’re too busy to read the screen when you download something, don’t blame Apple for your lack of attention. And if you have any software update set to “auto install” you need counseling. No one should ever allow a software manufacturer (or anyone for that matter) “cart blanc” to their PC! You have no right to cry “Foul” if you’ve allowed that.

This big “to-do” is just another bunch of cry babies not taking personal responsibility for their actions - or in this case, downloads. Or, is it just a way to call attention to yourself and your website? Hmm, maybe that what’s really behind this? Did I hear someone say, “Free traffic?”

written by Admin \\ tags: apple, apple software updates, apple updates, itunes, quicktime, safari, safari browser