[syadasti]

Apple has finally gotten around to patching up numerous flaws in their OS. Some vulnerabilities depend on the functionality being enabled, so they would probably only apply to more advanced environments (ie server edition or a power user). In either case, since there are so many flaws - patch her up!

-A password management flaw in OpenLDAP. Some OpenLDAP validation schemes allow an attacker to use an encrypted password to authenticate. This means if attackers can access your encrypted password file, they can use the passwords without decrypting them. They simply authenticate by submitting the encrypted version of the password.
-A directory traversal flaw in OpenSSH. A malicious SSH server can exploit this vulnerability to overwrite files in directories it shouldn't have access to.
-A privilege escalation flaw in PPPDialer. Local attackers can exploit a flaw in how PPP components access log files to overwrite system files and elevate their privileges.
-A DoS in QuickTime Streaming Server. A remote attacker can send a specially-crafted sequence of packets to your Quicktime Streaming Server and crash it. This server only ships with OS X Server edition.
-A directory traversal flaw in rsync. When rsync runs in daemon mode, attackers can exploit a flaw to gain access to directories they should not have access to.
-Two browser flaws in Safari. Two flaws in Apple's Safari Web browser allow malicious Web sites to crash Safari or exploit a Cross-Site Scripting (XSS) attack.
-A SQL injection flaw in SquirrelMail. A flaw in SquirrelMail allows an attacker to execute unauthorized SQL commands.
-A DoS flaw in tcpdump. A remote attacker can send a specially-crafted packet that crashes the tcpdump packet sniffing service.
-A Denial of Service (DoS) in Apache 2. An attacker can stop your Apache Web server from responding to Web requests. Apache only ships with OS X Server edition and is disabled by default.
-Two privilege escalation vulnerabilities in CoreFoundation. -Two technically different flaws allow attackers who already have local accounts to gain elevated privileges on your OS X machines.
-An unauthorized connection flaw in IPSec. A flaw in how IPSec uses certificates can allow an attacker to negotiate an unauthorized IPSec connection. By default, certificates are not enabled for IPSec.
-Buffer Overflows in Kerberos. Multiple buffer overflows in Kerberos authentication functions allow attackers to execute code. However, Kerberos is not enabled by default.
-A race condition flaw in Lukemftpd. A flaw in the lukemftpd service could allow an attacker with a valid FTP login to either crash your FTP server or execute code. This ftp service is not activated by default.

 

[Toshi]

way to be full of hyperbole (thread title), just in case no one caught that you were biased in your previous string of posts about apple...

my analysis:

point 1: openldap, openssh, rsync, tcpdump, ipsec, apache 2 are all open source packages common to most, if not all *nixes. these vulnerabilities are not specific to os x. furthermore rsync and apache 2 are very obscure - rsync was long ago deprecated for ssh/scp and apache 2 is still experimental.

point 2: squirrelmail and lukemftpd are neither apple software nor included with any os x distribution afaik. including them on your list is analogous to blaming microsoft for problems with quicken or dreamweaver.

point 3: there are 5 legitimate vulnerabilities in apple-written software: pppdialer, qtss, kerberos, corefoundation, safari.

of these, only safari is significant since every other exploit either is off by default / not in the client os x distro (qtss, kerberos) or is a local access exploit (pppdialer and corefoundation). when one considers the number of flaws in safari vs. internet explorer it still seems that apple is doing a decent, if not perfect, job.

so basically this list is a bunch of irrelevant or non-os x specific issues save for the safari exploits. big deal.

 

[syadasti]

Oh yeah so irrelevant that Apple posted all 15 security flaws on their website and hosts the patches

http://docs.info.apple.com/article.html?artnum=61798

security Update 2004-09-07

This Security Update is available for the following system versions:
- Mac OS X 10.3.4
- Mac OS X 10.3.5
- Mac OS X Server 10.3.4
- Mac OS X Server 10.3.5
- Mac OS X 10.2.8
- Mac OS X Server 10.2.8

 

[Toshi]

Oh yeah so irrelevant that Apple posted all 15 security flaws on their website and hosts the patches

http://docs.info.apple.com/article.html?artnum=61798

er, who else would host the patches for os x? part of apple's mantra is that ease of use is important. thus making users download source for all those individual packages (openssh, etc.), then compile and install would not be expected, would it?

 

[Ridemonkey]

Well unlike some here I have extensive, daily experience with all major platforms (Mac, Windows, Linux). None of these "serious" Mac flaws have even cost me one minute of lost productivity. My PC, on the other hand, is a liability. At this point I fear the only thing that is going to fix it is to completely reload the OS - which is a task that should never be necessary with a modern computer.

Wouldn't be nice to have an objective conversation among experienced users of all platforms?

 

[syadasti]

Thats nice...

I have extensive experience with Sun (Solaris and earlier SunOS - at Lehman Brothers and Sony Electronics, dealing with up to 3000 workstation/servers at once...), Macs (server and workstations), Red Hat/Suse, FreeBSD, BeOS, and Windows...

And reloading the Windows OS - nope haven't done that since I started using Windows 2000 on my personal machines - maybe you should brush up on your Windows skills, sounds like yours are lacking?

And you call yourself experienced user of all platforms - no Sun experience

 

[Toshi]

syadasti claims experience with all platforms since he's worked at companies where all three have been present.

1) i've used macs without interruption since the days of the LC. that would be 1991 or so.
2) i majored in computer science and did/had to do all of my programming coursework on unix boxes.
3) finally, i was an intern at palm in their developer tools group, helping maintain a unix/windows/mac application (http://www.palmos.com/dev/tools/emulator/), and then recently was it director at a smallish (~500 computers in the organization) hotel group, a typical windows shop.

add 1 + 2 + 3 and i think it's fair to claim that i'm familiar with macs, windows and *nix (and palm os too! )

keep this in mind as syadasti attacks me for being a mindless drone under the spell of Jobs or somesuch

 

[Ridemonkey]

Oh sorry, were we discussing Sun? Can you please point out that part cuz I missed it.

 

[Ridemonkey]

Honestly dude, all platforms have their strengths and weaknesses. You have demonstrated that you are not willing or able to have an objective conversation about this subject.

 

[syadasti]

Honestly dude, you said it - there is nothing magical about Apple's products, as you say, "all platforms have their strengths and weaknesses"

Its a guranteed catch when you use Apple bait

Now that they have a real OS (OSX), the only thing that I dislike is the hardware premiums and BS Apple marketing (and the ignorance it creates)...

 

[Toshi]

no one has demonstrated ignorance here.

 

[syadasti]

Update - Apple patches were flawed - please patch your patches

On September 8, we released an alert describing some new patches Apple released that fixed 15 new security vulnerabilities affecting OS X 10.2.8 and 10.3.x. An attacker exploiting these flaws could cause Denials of Service, elevate his privileges, or, in some cases, execute arbitrary code. Although most of the flaws posed low risk to the average administrator, we recommended that you apply Apple's OS X patches during your next maintenance cycle.

If your next maintenance cycle hasn't arrived yet, count yourself lucky: Apple's original patches have a few flaws of their own. According to their download page, Apple released new versions (1.1) of their September 7 security updates to fix the originals, which had some problems with the lukemftpd and Safari code. The newest updates correct these problems. Whether you've already applied the original patches or not, you should download, test and apply the appropriate new patches below:

http://www.apple.com/support/downloads/