Joel Esler, Sourcefire, Snort, Immunet, ClamAV, Apple, and Network Security. This is my blog.
Tuesday, June 10
Okay, so here's my iPhone 3G post
Okay, so here's my iPhone 3G post
Wednesday, May 28
Apple posts Mac OS X 10.5.3 Update
- General
Fixes a font issue that could result in Helvetica Narrow being used in applications instead of Helvetica.
Addresses an issue with stuttering video and audio playback in certain USB devices.
Resolves stability issues with Word of the Day, iTunes Artwork, and Slideshow screen savers.
Fixes an issue in which certain attached hard drives may not show up in the Finder.
Addresses an issue with .Mac syncing of Dashboard widgets over multiple Macs that use different screen resolutions.
Includes additional RAW image support for several cameras.
Improves the accuracy of the Software Update progress bar indicator.
Addresses an issue in which Finder may not be available if the computer name is blank in Sharing preferences.
Improves Active Directory binding and login.
Eliminates a delay when logging in as an Active Directory user in a .local domain.
Improves Spotlight searches on a AFP file server volumes.
Clients can now change their password at the login window when bound to a Mac OS X 10.4 Open Directory server.
Improves Safari reliability when connecting to the Internet through a Microsoft ISA proxy.
- Address Book
Addresses reliability issues when searching for contacts using built-in search.
Resolves issues with mapping addresses that contain an ampersand character (&).
- AirPort
Improves 802.1X behavior and reliability.
Improves reliability when using Time Capsule.
- Automator
Addresses an issue in which some actions may not work with the "Show When Run" option enabled.
Resolves an issue in which the "New iCal Event" action may not work.
Resolves an issue that prevents workflows from being saved in the Finder's contextual menu.
Fixes reliability issues for Automator scripts that search for files by date.
Resolves an issue that prevents workflows from being saved in the Finder's contextual menu.
Addresses an issue in which Automator workflows as Finder plugins do not work when the workflow begins with the "Get Selected Finder Items" action.
Fixes an issue in which the "Copy Files" action does not reliably work when added from Automator’s warning dialog.
- iCal
Addresses potential privacy issues by allowing events to be marked as private.
Resolves an issue in which the inspector does not show capacity and availability info for conference rooms within a building.
Addresses an issue in which the current day could appear in the left-most column of the weekly view.
Addresses reliability issues with meeting alarms, invitations and attachments.
Resolves issues with reliability when restoring from iCal backups.
Fixes accuracy issues with auto-completion, availability data and location names.
Resolves an issue in which iCal may send cancellation notices for events in the past after a calendar is deleted.
Fixes reliability issues with iCal syncing.
- iChat
Addresses reliability issues with screen sharing.
Resolves an issue in which saved chat transcripts may reported as "still in use" after opening and closing them in iChat.
Resolves an issue with group chats not being indexed in Spotlight.
Only the last 250 messages of an active chat are saved. Fixed to save unlimited number of lines.
Addresses issues with echo cancellation that may occur on portable Macs.
- Mail
Resolves an issue in which Mail may prevent idle sleep when set to automatically check for new messages every minute.
Addresses stability issues that may be encountered when dragging large attachments into an email message.
Fixes an issue that could occur if two compose windows are open when dragging a file to the Mail icon in the Dock.
Addresses reliability issues when changes are made to a mailbox while offline.
Resolves wrapping issues that may be found with consecutive spaces in plain text.
Fixes issues with certain web pages appearing garbled when emailed from Safari.
Fixes an issue in which the Sent, Drafts, and Outbox mailboxes incorrectly list the "cc" recipients in the "To" column.
Addresses reliability issues with attachments added to plain text notes.
Fixes reliability issues with authenticated RSS feeds.
Resolves an issue in which attaching an alias to an email message may not send the actual file.
- Parental Controls
Addresses reliability issues with application logging and time limits.
Resolves an issue in which Parental Controls may prevent forced sleep.
Addresses performance issues with web content filters.
Fixes an issue with managed accounts in which iChat transcripts may not be created.
Addresses issues with 4-byte files and whitelist.
- Spaces
Resolves an issue in which switching to a different space and returning back to the original space may reorder the application windows with a different active window.
Resolves an issue in which activating an application from the Dock switches to a different space, even if there is a window for that application in the current space.
Fixes an issue in which Command-Tab may incorrectly switch to a new space.
Addresses reliability issues with Spaces when syncing preferences over .Mac.
- Time Machine
Includes fixes for Time Machine compatibility with Time Capsule.
Resolves certain issues when backing up a portable Mac that is on battery power.
Addresses compatibility issues with Aperture 2.
Addresses reliability issues when performing a full restore from a Time Machine backup.
Fixes an issue in which certain function keys may be disabled after using Time Machine.
Fixes a possible alert message that incorrectly states a backup volume does not have enough space.
Updates Time Machine to reliably restore attachments and messages in Mail.
- VoiceOver
Includes Braille Update 1.0 which enables GW Micro, HandyTech, HIMS, Nippon, and Papenmeier Refreshable Braille displays.
Addresses an issue with Braille dot 7 and 8 underlining.
Fixes an issue in which HTML page anchors may be ignored by the VoiceOver cursor.
Fixes an issue that prevented Hot Spots from being used in text areas.
Resolves an issue with spell checking in which VoiceOver may only announce the first misspelled word if there are multiple words spelled incorrectly.
Apple posts Mac OS X 10.5.3 Update
- General
Fixes a font issue that could result in Helvetica Narrow being used in applications instead of Helvetica.
Addresses an issue with stuttering video and audio playback in certain USB devices.
Resolves stability issues with Word of the Day, iTunes Artwork, and Slideshow screen savers.
Fixes an issue in which certain attached hard drives may not show up in the Finder.
Addresses an issue with .Mac syncing of Dashboard widgets over multiple Macs that use different screen resolutions.
Includes additional RAW image support for several cameras.
Improves the accuracy of the Software Update progress bar indicator.
Addresses an issue in which Finder may not be available if the computer name is blank in Sharing preferences.
Improves Active Directory binding and login.
Eliminates a delay when logging in as an Active Directory user in a .local domain.
Improves Spotlight searches on a AFP file server volumes.
Clients can now change their password at the login window when bound to a Mac OS X 10.4 Open Directory server.
Improves Safari reliability when connecting to the Internet through a Microsoft ISA proxy.
- Address Book
Addresses reliability issues when searching for contacts using built-in search.
Resolves issues with mapping addresses that contain an ampersand character (&).
- AirPort
Improves 802.1X behavior and reliability.
Improves reliability when using Time Capsule.
- Automator
Addresses an issue in which some actions may not work with the "Show When Run" option enabled.
Resolves an issue in which the "New iCal Event" action may not work.
Resolves an issue that prevents workflows from being saved in the Finder's contextual menu.
Fixes reliability issues for Automator scripts that search for files by date.
Resolves an issue that prevents workflows from being saved in the Finder's contextual menu.
Addresses an issue in which Automator workflows as Finder plugins do not work when the workflow begins with the "Get Selected Finder Items" action.
Fixes an issue in which the "Copy Files" action does not reliably work when added from Automator’s warning dialog.
- iCal
Addresses potential privacy issues by allowing events to be marked as private.
Resolves an issue in which the inspector does not show capacity and availability info for conference rooms within a building.
Addresses an issue in which the current day could appear in the left-most column of the weekly view.
Addresses reliability issues with meeting alarms, invitations and attachments.
Resolves issues with reliability when restoring from iCal backups.
Fixes accuracy issues with auto-completion, availability data and location names.
Resolves an issue in which iCal may send cancellation notices for events in the past after a calendar is deleted.
Fixes reliability issues with iCal syncing.
- iChat
Addresses reliability issues with screen sharing.
Resolves an issue in which saved chat transcripts may reported as "still in use" after opening and closing them in iChat.
Resolves an issue with group chats not being indexed in Spotlight.
Only the last 250 messages of an active chat are saved. Fixed to save unlimited number of lines.
Addresses issues with echo cancellation that may occur on portable Macs.
- Mail
Resolves an issue in which Mail may prevent idle sleep when set to automatically check for new messages every minute.
Addresses stability issues that may be encountered when dragging large attachments into an email message.
Fixes an issue that could occur if two compose windows are open when dragging a file to the Mail icon in the Dock.
Addresses reliability issues when changes are made to a mailbox while offline.
Resolves wrapping issues that may be found with consecutive spaces in plain text.
Fixes issues with certain web pages appearing garbled when emailed from Safari.
Fixes an issue in which the Sent, Drafts, and Outbox mailboxes incorrectly list the "cc" recipients in the "To" column.
Addresses reliability issues with attachments added to plain text notes.
Fixes reliability issues with authenticated RSS feeds.
Resolves an issue in which attaching an alias to an email message may not send the actual file.
- Parental Controls
Addresses reliability issues with application logging and time limits.
Resolves an issue in which Parental Controls may prevent forced sleep.
Addresses performance issues with web content filters.
Fixes an issue with managed accounts in which iChat transcripts may not be created.
Addresses issues with 4-byte files and whitelist.
- Spaces
Resolves an issue in which switching to a different space and returning back to the original space may reorder the application windows with a different active window.
Resolves an issue in which activating an application from the Dock switches to a different space, even if there is a window for that application in the current space.
Fixes an issue in which Command-Tab may incorrectly switch to a new space.
Addresses reliability issues with Spaces when syncing preferences over .Mac.
- Time Machine
Includes fixes for Time Machine compatibility with Time Capsule.
Resolves certain issues when backing up a portable Mac that is on battery power.
Addresses compatibility issues with Aperture 2.
Addresses reliability issues when performing a full restore from a Time Machine backup.
Fixes an issue in which certain function keys may be disabled after using Time Machine.
Fixes a possible alert message that incorrectly states a backup volume does not have enough space.
Updates Time Machine to reliably restore attachments and messages in Mail.
- VoiceOver
Includes Braille Update 1.0 which enables GW Micro, HandyTech, HIMS, Nippon, and Papenmeier Refreshable Braille displays.
Addresses an issue with Braille dot 7 and 8 underlining.
Fixes an issue in which HTML page anchors may be ignored by the VoiceOver cursor.
Fixes an issue that prevented Hot Spots from being used in text areas.
Resolves an issue with spell checking in which VoiceOver may only announce the first misspelled word if there are multiple words spelled incorrectly.
Thursday, May 1
What went wrong with the Podcast?
What went wrong with the Podcast?
Monday, March 31
Comment becoming a post
"anonymous said...
How is it even remotely weak? Considering most virii spreading around these days is done via browser related vulnerabilities, I hardly would consider it "weak".
If it is so easy to discover browser vulnerabilities then how come IE7 held up on the Windows box (until the 3rd day when it was owned by flash)? How come you don't have any browser vulnerabilities credited to your name?
I hate to be "that guy", but the guy that won Pwn2Own walked away with $10k and a new laptop. I doubt he cares too much what bloggers think of him or his vulnerability, especially someone that hasn't done any similar research. Don't bash someone else's work unless you can reproduce it yourself.
Mon Mar 31, 08:55:00 AM"
My response:
Dear person-who-didn't-leave-their-name,
Who says I was bashing work? I still think it's a weak vulnerability.
I'm not saying that the guy that discovered it is stupid, or that the exploit itself is stupid -- props to him for getting 10k and a fat laptop. I'm saying that most of the journalists and bloggers out there are saying things like "Mac owned in 2 minutes". Really? Was it owned in two minutes? Or did the guy merely have the exploit already set up on his webpage before the contest began. Does that make sense? I don't like sensationalist headlines, essentially.
I'm also not saying it's easy for someone to discover the vulnerability, I am sure it took alot of research and fuzzing. I am saying now-a-days, there are alot of browser vulnerabilities. It seems like every week there is at least one. I'm not saying that the research that is done by the people isn't worthwhile, I am just not a fan of browser vulnerabilities, because, as I said.. It's easy to switch browsers.
I do think it was interesting that Windows held up until Flash was introduced. But what kind of metrics are we using here? A machine wasn't able to get exploited in one week? It takes more time than that doesn't it?
All punditry. I guess I just miss the days of remote server side exploits like ws_ftp, IIS, and the like.
Tuesday, February 26
New MacBooks and MacBook Pros
New MacBooks and MacBook Pros
Monday, February 25
Yep, new Macbook part numbers are in Best Buy's database
Posted from Engadget. Take a look at the "In Stock Date" and the "Out Stock Date". I guess it's easy to see when the new computers are coming and when they are leaving.
Yep, new Macbook part numbers are in Best Buy's database
Filed under: Laptops
Our tip jar, it brings us so much joy -- and it brings you, dear reader, this printout of what's purported to be the Best Buy database listing for one of those heretofore-unknown MacBook model numbers. You'll note that whatever MB402LL/A turns out to be, it's said to be in stock on March 2nd, which is just a few days away -- but also note that current MacBook Pros have MA-series model numbers, while the regular MacBook has traditionally carried the MB designation. That's interesting, but we doubt a $1,999 MacBook is about to surface -- besides, the current MacBook box is 15 inches square, smaller than the 19 inches listed here. (Yes, we measured.) As always, we'll see when we see -- come on Tuesday, you're almost here.
Yep, new Macbook part numbers are in Best Buy's database
Posted from Engadget. Take a look at the "In Stock Date" and the "Out Stock Date". I guess it's easy to see when the new computers are coming and when they are leaving.
Yep, new Macbook part numbers are in Best Buy's database
Filed under: Laptops
Our tip jar, it brings us so much joy -- and it brings you, dear reader, this printout of what's purported to be the Best Buy database listing for one of those heretofore-unknown MacBook model numbers. You'll note that whatever MB402LL/A turns out to be, it's said to be in stock on March 2nd, which is just a few days away -- but also note that current MacBook Pros have MA-series model numbers, while the regular MacBook has traditionally carried the MB designation. That's interesting, but we doubt a $1,999 MacBook is about to surface -- besides, the current MacBook box is 15 inches square, smaller than the 19 inches listed here. (Yes, we measured.) As always, we'll see when we see -- come on Tuesday, you're almost here.
Saturday, February 16
Go, Walk no.. Run to CostCo
I think it's a good deal, at least comparable. Hell, I remember spending 89 dollars for my 512 Mb thumbdrive back in the day, and that was a steal. Now 2 Gb ones are McDonalds money. (Reference: McDonalds money means "roughly the same as it would cost my family to eat at McDonalds"
Go, Walk no.. Run to CostCo
I think it's a good deal, at least comparable. Hell, I remember spending 89 dollars for my 512 Mb thumbdrive back in the day, and that was a steal. Now 2 Gb ones are McDonalds money. (Reference: McDonalds money means "roughly the same as it would cost my family to eat at McDonalds"
Friday, February 15
Mossberg previews Lenovo's 'Air-killer' X300
So let's take a look. This thing has 3 USB ports (as opposed to the MacBook Air's 1), it has a DVD Drive, (Air doesn't), has Wifi, and an optional 3G or GPS receiver, a removable battery (air doesn't -- well, easily) and not one, but TWO mouse pointing devices.
So there are pros and cons.
Lenovo --
Has more USB, Apple could do with more USB devices.
DVD Drive, I think Apple did the right thing here and killed the DVD drive. In fact, I think that they will kill off the optical drive in all systems and start shipping their software on USB sticks. Think about how much THAT would save in shipping costs.
Removable Battery -- Okay, well, I'd like to have the ability to easily swap out the MacBook Air's battery. So I kinda have to agree with it.
The Lenovo is thicker, uglier, and really Lenovo, wtf is with TWO mice? The red stick and the trackpad? I have never met anyone, ever that likes the red stick. The trackpad has become the standard, please get with the program. I remember seeing a laptop not too long ago that had the stick, the trackpad, AND the damn trackball. 3 mice. Seriously. Knock it off. Go with the trackpad it seems to work.
Has a slot for a 3G card. Now THAT is what the Macbook Air is lacking. They need the express card slot.
MacBook Air --
Sexy. The Lenovo is the typical Thinkpad ugly ass computer.
Simple. It's a damn Mac!
Lacks more USB
Lacks Optical Drive (so what?)
Lacks Removable Battery
Bottom line, it depends on what you are looking for. Personally I'd like the MacBook Air, but there are too many drawbacks. However, I'd buy it simply because it's a Mac and I refuse to use anything else as my desktop (well, I'd use a bsd or a linux distro as well I guess, but given the option, I'd use a Mac 100%). But I have a Macbook pro. I love this computer, I am writing on it right now. I think the MacBook Pro has it going on.
There is a certain demographic that the MacBook Air is aimed towards, and I think it will sell well in that demographic.
In other news, the same website is reporting that Best Buy is out of the 15in MacBook Pro. Which usually means that Apple has a new one right around the corner. Thinner? Sleeker? Better?
Monday, February 11
Mac OSX 10.5.2 and Security Update 2008-0001 hit the streets
Active Directory
- Addresses issues which could hinder or prevent binding Mac OS X 10.5.x clients to Active Directory domains.
AirPort
- Improves connection reliability and stability
- Includes 802.1X improvements.
- Resolves certain kernel panics.
Back to my Mac
- Adds support for more third-party routers, as detailed in this article.
Dashboard
- Improves performance of certain Apple Dashboard widgets (such as Dictionary).
- Addresses an issue in which Dashboard widgets may no longer be accessible after switching to or from an account that has Parental Controls enabled.
Dock
- Updates Stacks with a List view option, a Folder view option, and an updated background for Grid view.
Desktop
- Addresses legibility issues with the menu bar with an option to turn off transparency in Desktop & Screen Saver preferences.
- Adjusts menus to be slightly-less translucent overall.
iCal
- Improves iCal so that it accurately reflects responses to recurring meetings.
- Addresses an issue in which a meeting may remain on the calendar after being cancelled.
- Addresses stability issues related to .Mac syncing of iCal calendars.
- Resolves an intermittent issue in which editing an event with attendees would cause the event to shrink and not register that the event was updated.
iChat
- Addresses an issue with simultaneously-logged in accounts in which iChat sounds generated from one account might be heard in another account.
- Fixes an issue in which iChat idle time is affected by Time Machine backups.
- Improves connectivity when running iChat behind a router that doesn’t preserve ports.
- Enables logged chats from previous versions of iChat to open faster and more reliably.
- Addresses an issue with text chats in which users may be unable to receive messages from the sender.
- Addresses an issue that may prevent rejoining an AIM chat room without reopening iChat.
- Addresses video chat compatibility issues with AIM 6 and third-party routers.
- Fixes an issue with case-sensitivity of AIM handles.
iSync
- Adds support for Samsung D600E and D900i phones.
Finder
- Addresses an issue in which Finder could unexpectedly quit when displaying folder contents in Column view.
- Addresses an issue in which Finder could unexpectedly quit when accessing Users and Groups in a Get Info pane.
- Resolves an issue that prevented setting permissions on a folder alias.
- Resolves an issue in which the Eject command could write to a disc in the optical drive.
- Fixes an issue in which the scroll bar might disappear when deleting a file within a folder that includes files that are out of view.
- Fixes an issue in the Sharing & Permissions section of Get Info windows, in which the gear icon appears to be gray/disabled after authentication.
- Addresses an issue in which the Show Icon Preview preference might not be not saved when turning it off.
- Fixes an issue that could occur when trying to print an image from the Finder.
- Addresses an issue with Message menu's "Mark As Read" choice.
- Fixes an issue in which duplicate On My Mac folders may appear in the sidebar after upgrading to Leopard.
- Improves the accuracy of the Data Detectors feature.
- Resolves an issue with scrolling through a Note that is displayed using the split view in the message window.
- Fixes an issue with deleting messages located in the Drafts folder.
- Fixes an issue in which dragging the icon in the Safari URL field into a Mail message creates an attachment instead of a link.
- Addresses an issue found when opening a item in the Notes folder that is not a Note.
- Fixes an issue that may prevent RSS feeds from being delivered in Mail.
- Resolves an issue in which a selected message could "flash" from blue to gray when in Organize by Thread mode.
- Fixes an issue with scrolling between multiple To Dos in an email message.
- Fixes an issue in which the body of email messages with certain MIME structures may not be displayed.
- Improves performance with America Online (AOL) account-based messages in Mail.
- Addresses issues with some ISPs during automatic set-up in Mail.
- Addresses an issue in which Mail might not send mail on some networks to some SMTP servers.
- Mail now automatically disables the (unsupported) third-party plugin GrowlMail version 1.1.2 or earlier to avoid issues.
- Adds an option to view large icons in the Mailbox list.
Networking
- Addresses a hanging issue that may occur when connecting to an AFP network volume.
Parental Controls
- Improves stability when opening the Parental Controls System Preferences pane.
- Fixes an issue that may prevent changes to the email address for permission requests.
- Addresses an issue with printer administration for a guest account enabled with Parental Controls.
- Addresses an issue with setting printer administration privileges from another Mac on the local network.
- Fixes an issue that could prevent certain applications from being allowed.
- Addresses accuracy issues with the web content filter.
Preview
- Improves stability when scrolling through a PDF document.
- Fixes an issue that prevents tabbing within a PDF document after clicking on the PDF.
- Improves the Mail Document feature so that email attachments are more reliably created from Print Preview.
Printing
- Addresses an issue in which remote printers may be deleted when the computer is put to sleep.
- Improves printing performance when using some Microsoft Office applications.
- Resolves an issue with some printing options, such as landscape orientation, number of copies, two-sided printing, and so forth that may not have functioned with some printers shared by Microsoft Windows.
- Adds support for certain printers connected to the USB port of an AirPort Extreme or AirPort Express base station.
- Resolves a stalling issue that could occur when installing certain Canon printing software from a disc.
RAW Image
- Adds RAW image support for several cameras, as detailed in this article.
Safari
- Addresses issues with Safari reliably resolving certain domains.
Login and Setup Assistant
- Addresses an issue in which Setup Assistant could unexpectedly appear each time Mac OS X 10.5 starts up.
- Improves stability and performance during log in.
System
- Improves the accuracy of the grammar checker.
- The computer will now shut down if an automatic disk repair does not succeed during startup.
Time Machine
- Adds a menu bar option for accessing Time Machine features (the menu extra can be enabled in Time Machine preferences).
- Improves backup reliability when computer name contains slash or non-ASCII characters.
- Fixes an issue in which the backup disk displayed in the Finder may be out of sync with the disk chosen for Time Machine.
- Addresses issues in which some external drives are not recognized by Time Machine.
- The status menu now appears by default.
Other
- Improves general stability when running third-party applications.
- Addresses an issue in which the incorrect search results may be displayed for certain Automator Find/Filter actions.
- Addresses an issue with the Latvian and Russian keyboard layouts.
- Addresses an issue in which the backlight could turn off before Energy Saver's backlight setting.
Mac OS X v10.5.2 / Security Update 2008-001
Directory Services
CVE-ID: CVE-2007-0355
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11
Impact: A local user may be able to execute arbitrary code with system privileges
Description: A stack buffer overflow exists in the Service Location Protocol (SLP) daemon, which may allow a local user to execute arbitrary code with system privileges. This update addresses the issue through improved bounds checking. This has been described on the Month of Apple Bugs web site (MOAB-17-01-2007). This issue does not affect systems running Mac OS X v10.5 or later. Credit to Kevin Finisterre of Netragard for reporting this issue.
Foundation
CVE-ID: CVE-2008-0035
Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: Accessing a maliciously crafted URL may lead to an application termination or arbitrary code execution
Description: A memory corruption issue exists in Safari's handling of URLs. By enticing a user to access a maliciously crafted URL, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of URLs. This issue does not affect systems prior to Mac OS X v10.5.
Launch Services
CVE-ID: CVE-2008-0038
Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: An application removed from the system may still be launched via the Time Machine backup
Description: Launch Services is an API to open applications or their document files or URLs in a way similar to the Finder or the Dock. Users expect that uninstalling an application from their system will prevent it from being launched. However, when an application has been uninstalled from the system, Launch Services may allow it to be launched if it is present in a Time Machine backup. This update addresses the issue by not allowing applications to be launched directly from a Time Machine backup. This issue does not affect systems prior to Mac OS X v10.5. Credit to Steven Fisher of Discovery Software Ltd. and Ian Coutier for reporting this issue.
Mail
CVE-ID: CVE-2008-0039
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11
Impact: Accessing a URL in a message may lead to arbitrary code execution
Description: An implementation issue exists in Mail's handling of file:// URLs, which may allow arbitrary applications to be launched without warning when a user clicks a URL in a message. This update addresses the issue by displaying the location of the file in Finder rather than launching it. This issue does not affect systems running Mac OS X v10.5 or later.
NFS
CVE-ID: CVE-2008-0040
Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: If the system is being used as an NFS client or server, a remote attacker may cause an unexpected system shutdown or arbitrary code execution
Description: A memory corruption issue exists in NFS's handling of mbuf chains. If the system is being used as an NFS client or server, a malicious NFS server or client may be able to cause an unexpected system shutdown or arbitrary code execution. This update addresses the issue through improved handling of mbuf chains. This issue does not affect systems prior to Mac OS X v10.5. Credit to Oleg Drokin of Sun Microsystems for reporting this issue.
Open Directory
Available for: Mac OS X v10.4.11, Mac OS X v10.4.11 Server
Impact: NTLM authentication requests may always fail
Description: This update addresses a non-security issue introduced in Mac OS X v10.4.11. An race condition in Open Directory's Active Directory plug-in may terminate the operation of winbindd, causing NTLM authentications to fail. This update addresses the issue by correcting the race condition that could terminate winbindd. This issue only affects Mac OS X v10.4.11 systems configured for use with Active Directory.
Parental Controls
CVE-ID: CVE-2008-0041
Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: Requesting to unblock a website leads to information disclosure
Description: When set to manage web content, Parental Controls will inadvertently contact www.apple.com when a website is unblocked. This allows a remote user to detect the machines running Parental Controls. This update addresses the issue by removing the outgoing network traffic when a website is unblocked. This issue does not affect systems prior to Mac OS X v10.5. Credit to Jesse Pearson for reporting this issue.
Samba
CVE-ID: CVE-2007-6015
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: A remote attacker may cause an unexpected application termination or arbitrary code execution
Description: A stack buffer overflow may occur in Samba when processing certain NetBIOS Name Service requests. If a system is explicitly configured to allow "domain logons", an unexpected application termination or arbitrary code execution could occur when processing a request. Mac OS X Server systems configured as domain controllers are also affected. This update addresses the issue by applying the Samba patch. Further information is available via the Samba web site at http://www.samba.org/samba/history/security.html Credit to Alin Rad Pop of Secunia Research for reporting this issue.
Terminal
CVE-ID: CVE-2008-0042
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: Viewing a maliciously crafted web page may lead to arbitrary code execution
Description: An input validation issue exists in the processing of URL schemes handled by Terminal.app. By enticing a user to visit a maliciously crafted web page, an attacker may cause an application to be launched with controlled command line arguments, which may lead to arbitrary code execution. This update addresses the issue through improved validation of URLs. Credit to Olli Leppanen of Digital Film Finland and Brian Mastenbrook for reporting this issue.
X11
CVE-ID: CVE-2007-4568
Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: Multiple Vulnerabilities exist in X11 X Font Server (XFS) 1.0.4
Description: Multiple vulnerabilities in X11 X Font Server (XFS), the most serious of which may lead to arbitrary code execution. This update addresses the issue by updating to version 1.0.5. Further information is available via the X.Org website at http://www.x.org/wiki/Development/Security
X11
CVE-ID: CVE-2008-0037
Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: Changing the settings in the Security Preferences Panel has no effect
Description: The X11 server is not reading correctly its "Allow connections from network client" preference, which can cause the X11 server to allow connections from network clients, even when the preference is turned off. This update addresses the issue by ensuring the X11 server reads its preferences correctly. This issue does not affect systems prior to Mac OS X v10.5.
Mac OSX 10.5.2 and Security Update 2008-0001 hit the streets
Active Directory
- Addresses issues which could hinder or prevent binding Mac OS X 10.5.x clients to Active Directory domains.
AirPort
- Improves connection reliability and stability
- Includes 802.1X improvements.
- Resolves certain kernel panics.
Back to my Mac
- Adds support for more third-party routers, as detailed in this article.
Dashboard
- Improves performance of certain Apple Dashboard widgets (such as Dictionary).
- Addresses an issue in which Dashboard widgets may no longer be accessible after switching to or from an account that has Parental Controls enabled.
Dock
- Updates Stacks with a List view option, a Folder view option, and an updated background for Grid view.
Desktop
- Addresses legibility issues with the menu bar with an option to turn off transparency in Desktop & Screen Saver preferences.
- Adjusts menus to be slightly-less translucent overall.
iCal
- Improves iCal so that it accurately reflects responses to recurring meetings.
- Addresses an issue in which a meeting may remain on the calendar after being cancelled.
- Addresses stability issues related to .Mac syncing of iCal calendars.
- Resolves an intermittent issue in which editing an event with attendees would cause the event to shrink and not register that the event was updated.
iChat
- Addresses an issue with simultaneously-logged in accounts in which iChat sounds generated from one account might be heard in another account.
- Fixes an issue in which iChat idle time is affected by Time Machine backups.
- Improves connectivity when running iChat behind a router that doesn’t preserve ports.
- Enables logged chats from previous versions of iChat to open faster and more reliably.
- Addresses an issue with text chats in which users may be unable to receive messages from the sender.
- Addresses an issue that may prevent rejoining an AIM chat room without reopening iChat.
- Addresses video chat compatibility issues with AIM 6 and third-party routers.
- Fixes an issue with case-sensitivity of AIM handles.
iSync
- Adds support for Samsung D600E and D900i phones.
Finder
- Addresses an issue in which Finder could unexpectedly quit when displaying folder contents in Column view.
- Addresses an issue in which Finder could unexpectedly quit when accessing Users and Groups in a Get Info pane.
- Resolves an issue that prevented setting permissions on a folder alias.
- Resolves an issue in which the Eject command could write to a disc in the optical drive.
- Fixes an issue in which the scroll bar might disappear when deleting a file within a folder that includes files that are out of view.
- Fixes an issue in the Sharing & Permissions section of Get Info windows, in which the gear icon appears to be gray/disabled after authentication.
- Addresses an issue in which the Show Icon Preview preference might not be not saved when turning it off.
- Fixes an issue that could occur when trying to print an image from the Finder.
- Addresses an issue with Message menu's "Mark As Read" choice.
- Fixes an issue in which duplicate On My Mac folders may appear in the sidebar after upgrading to Leopard.
- Improves the accuracy of the Data Detectors feature.
- Resolves an issue with scrolling through a Note that is displayed using the split view in the message window.
- Fixes an issue with deleting messages located in the Drafts folder.
- Fixes an issue in which dragging the icon in the Safari URL field into a Mail message creates an attachment instead of a link.
- Addresses an issue found when opening a item in the Notes folder that is not a Note.
- Fixes an issue that may prevent RSS feeds from being delivered in Mail.
- Resolves an issue in which a selected message could "flash" from blue to gray when in Organize by Thread mode.
- Fixes an issue with scrolling between multiple To Dos in an email message.
- Fixes an issue in which the body of email messages with certain MIME structures may not be displayed.
- Improves performance with America Online (AOL) account-based messages in Mail.
- Addresses issues with some ISPs during automatic set-up in Mail.
- Addresses an issue in which Mail might not send mail on some networks to some SMTP servers.
- Mail now automatically disables the (unsupported) third-party plugin GrowlMail version 1.1.2 or earlier to avoid issues.
- Adds an option to view large icons in the Mailbox list.
Networking
- Addresses a hanging issue that may occur when connecting to an AFP network volume.
Parental Controls
- Improves stability when opening the Parental Controls System Preferences pane.
- Fixes an issue that may prevent changes to the email address for permission requests.
- Addresses an issue with printer administration for a guest account enabled with Parental Controls.
- Addresses an issue with setting printer administration privileges from another Mac on the local network.
- Fixes an issue that could prevent certain applications from being allowed.
- Addresses accuracy issues with the web content filter.
Preview
- Improves stability when scrolling through a PDF document.
- Fixes an issue that prevents tabbing within a PDF document after clicking on the PDF.
- Improves the Mail Document feature so that email attachments are more reliably created from Print Preview.
Printing
- Addresses an issue in which remote printers may be deleted when the computer is put to sleep.
- Improves printing performance when using some Microsoft Office applications.
- Resolves an issue with some printing options, such as landscape orientation, number of copies, two-sided printing, and so forth that may not have functioned with some printers shared by Microsoft Windows.
- Adds support for certain printers connected to the USB port of an AirPort Extreme or AirPort Express base station.
- Resolves a stalling issue that could occur when installing certain Canon printing software from a disc.
RAW Image
- Adds RAW image support for several cameras, as detailed in this article.
Safari
- Addresses issues with Safari reliably resolving certain domains.
Login and Setup Assistant
- Addresses an issue in which Setup Assistant could unexpectedly appear each time Mac OS X 10.5 starts up.
- Improves stability and performance during log in.
System
- Improves the accuracy of the grammar checker.
- The computer will now shut down if an automatic disk repair does not succeed during startup.
Time Machine
- Adds a menu bar option for accessing Time Machine features (the menu extra can be enabled in Time Machine preferences).
- Improves backup reliability when computer name contains slash or non-ASCII characters.
- Fixes an issue in which the backup disk displayed in the Finder may be out of sync with the disk chosen for Time Machine.
- Addresses issues in which some external drives are not recognized by Time Machine.
- The status menu now appears by default.
Other
- Improves general stability when running third-party applications.
- Addresses an issue in which the incorrect search results may be displayed for certain Automator Find/Filter actions.
- Addresses an issue with the Latvian and Russian keyboard layouts.
- Addresses an issue in which the backlight could turn off before Energy Saver's backlight setting.
Mac OS X v10.5.2 / Security Update 2008-001
Directory Services
CVE-ID: CVE-2007-0355
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11
Impact: A local user may be able to execute arbitrary code with system privileges
Description: A stack buffer overflow exists in the Service Location Protocol (SLP) daemon, which may allow a local user to execute arbitrary code with system privileges. This update addresses the issue through improved bounds checking. This has been described on the Month of Apple Bugs web site (MOAB-17-01-2007). This issue does not affect systems running Mac OS X v10.5 or later. Credit to Kevin Finisterre of Netragard for reporting this issue.
Foundation
CVE-ID: CVE-2008-0035
Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: Accessing a maliciously crafted URL may lead to an application termination or arbitrary code execution
Description: A memory corruption issue exists in Safari's handling of URLs. By enticing a user to access a maliciously crafted URL, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of URLs. This issue does not affect systems prior to Mac OS X v10.5.
Launch Services
CVE-ID: CVE-2008-0038
Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: An application removed from the system may still be launched via the Time Machine backup
Description: Launch Services is an API to open applications or their document files or URLs in a way similar to the Finder or the Dock. Users expect that uninstalling an application from their system will prevent it from being launched. However, when an application has been uninstalled from the system, Launch Services may allow it to be launched if it is present in a Time Machine backup. This update addresses the issue by not allowing applications to be launched directly from a Time Machine backup. This issue does not affect systems prior to Mac OS X v10.5. Credit to Steven Fisher of Discovery Software Ltd. and Ian Coutier for reporting this issue.
Mail
CVE-ID: CVE-2008-0039
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11
Impact: Accessing a URL in a message may lead to arbitrary code execution
Description: An implementation issue exists in Mail's handling of file:// URLs, which may allow arbitrary applications to be launched without warning when a user clicks a URL in a message. This update addresses the issue by displaying the location of the file in Finder rather than launching it. This issue does not affect systems running Mac OS X v10.5 or later.
NFS
CVE-ID: CVE-2008-0040
Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: If the system is being used as an NFS client or server, a remote attacker may cause an unexpected system shutdown or arbitrary code execution
Description: A memory corruption issue exists in NFS's handling of mbuf chains. If the system is being used as an NFS client or server, a malicious NFS server or client may be able to cause an unexpected system shutdown or arbitrary code execution. This update addresses the issue through improved handling of mbuf chains. This issue does not affect systems prior to Mac OS X v10.5. Credit to Oleg Drokin of Sun Microsystems for reporting this issue.
Open Directory
Available for: Mac OS X v10.4.11, Mac OS X v10.4.11 Server
Impact: NTLM authentication requests may always fail
Description: This update addresses a non-security issue introduced in Mac OS X v10.4.11. An race condition in Open Directory's Active Directory plug-in may terminate the operation of winbindd, causing NTLM authentications to fail. This update addresses the issue by correcting the race condition that could terminate winbindd. This issue only affects Mac OS X v10.4.11 systems configured for use with Active Directory.
Parental Controls
CVE-ID: CVE-2008-0041
Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: Requesting to unblock a website leads to information disclosure
Description: When set to manage web content, Parental Controls will inadvertently contact www.apple.com when a website is unblocked. This allows a remote user to detect the machines running Parental Controls. This update addresses the issue by removing the outgoing network traffic when a website is unblocked. This issue does not affect systems prior to Mac OS X v10.5. Credit to Jesse Pearson for reporting this issue.
Samba
CVE-ID: CVE-2007-6015
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: A remote attacker may cause an unexpected application termination or arbitrary code execution
Description: A stack buffer overflow may occur in Samba when processing certain NetBIOS Name Service requests. If a system is explicitly configured to allow "domain logons", an unexpected application termination or arbitrary code execution could occur when processing a request. Mac OS X Server systems configured as domain controllers are also affected. This update addresses the issue by applying the Samba patch. Further information is available via the Samba web site at http://www.samba.org/samba/history/security.html Credit to Alin Rad Pop of Secunia Research for reporting this issue.
Terminal
CVE-ID: CVE-2008-0042
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: Viewing a maliciously crafted web page may lead to arbitrary code execution
Description: An input validation issue exists in the processing of URL schemes handled by Terminal.app. By enticing a user to visit a maliciously crafted web page, an attacker may cause an application to be launched with controlled command line arguments, which may lead to arbitrary code execution. This update addresses the issue through improved validation of URLs. Credit to Olli Leppanen of Digital Film Finland and Brian Mastenbrook for reporting this issue.
X11
CVE-ID: CVE-2007-4568
Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: Multiple Vulnerabilities exist in X11 X Font Server (XFS) 1.0.4
Description: Multiple vulnerabilities in X11 X Font Server (XFS), the most serious of which may lead to arbitrary code execution. This update addresses the issue by updating to version 1.0.5. Further information is available via the X.Org website at http://www.x.org/wiki/Development/Security
X11
CVE-ID: CVE-2008-0037
Available for: Mac OS X v10.5 and v10.5.1, Mac OS X Server v10.5 and v10.5.1
Impact: Changing the settings in the Security Preferences Panel has no effect
Description: The X11 server is not reading correctly its "Allow connections from network client" preference, which can cause the X11 server to allow connections from network clients, even when the preference is turned off. This update addresses the issue by ensuring the X11 server reads its preferences correctly. This issue does not affect systems prior to Mac OS X v10.5.
