Bugtraq mailing list archives
RE: Mac OS X vulnerabilities ['Virus checked"]
From: graham.coles () retail-logic com
Date: Wed, 29 Oct 2003 11:37:52 +0000
Thor, Sorry, I hadn't read the vendor response section of the advisories fully, I'd rather assumed they would be issuing a security update for 10.2 as per usual. I'd have to agree it's a pretty poor showing from Apple if the only fix is to buy the next version of the operating system. I believe Microsoft are about to stop patching Windows Me shortly (which has been around for a few years now) and usually support the current and previous service pack of an OS. If Apple are only going to support the most recent version of OS X - which equates to about 12 months lifetime, as I believe they're planning a major new release each year - then it's going to be either difficult or expensive to keep secure. Given the current climate with regards to security, I don't think they're doing themselves any favours if they take this route. I hope they'll reconsider if this is their policy. Regards, Graham Coles "Thor Larholm" <thor () pivx com> To: <graham.coles () retail-logic com>, <bugtraq () securityfocus com> cc: 29/10/2003 10:25 Subject: RE: Mac OS X vulnerabilities ['Virus checked"] Graham, Thank you for the feedback. I can't locate any new patches or updates through the software update tool on our 10.2 systems, and Apples security site (which I now received the URL to) mentions nothing about these security updates for OS X 10.2 The only way for any Mac OS X 10.2 user to stay secure is to pay Apple for an upgrade to Mac OS X 10.3, there are simply no patches for these vulnerabilities in 10.2 even though 10.2 is affected. Regards Thor Larholm PivX Solutions, LLC - Senior Security Researcher http://pivx.com/larholm/ - Get our research, join our mailinglist -----Original Message----- From: graham.coles () retail-logic com [mailto:graham.coles () retail-logic com] Sent: Wed 10/29/2003 2:14 AM To: bugtraq () securityfocus com; Thor Larholm Cc: Subject: Re: Mac OS X vulnerabilities ['Virus checked"] I usually download main updates (10.2.8) and security patches from http://www.apple.com/downloads/macosx/apple There's also an automated update from within OS X which will check for and install patches automatically. These are non-chargeable updates, I believe the price you quote is for a single user copy of Mac OS X. Regards, Graham Coles "Thor Larholm" <thor () pivx com> To: "@stake Advisories" <advisories () atstake com>, <bugtraq () securityfocus com> cc: <product-security () apple com> 28/10/2003 19:23 Subject: Re: Mac OS X vulnerabilities ['Virus checked"] I couldn't find any security contacts on apple.com that didn't look fee-based so I am asking here in response to these latest disclosures of security vulnerabilities in Mac OS X. When most vendors are notified of security vulnerabilities in their products, they produce a patch for the affected versions of the software and distribute it for free. Does Apple plan to distribute a free patch for these security vulnerabilities to Mac OS X 10.2, or will my clients have to spend $129 per workstation (the single user upgrade price) to have their Apple computer stay secure? Regards Thor Larholm PivX Solutions, LLC - Senior Security Researcher http://pivx.com/larholm/ - Get our research, join our mailinglist
----- Original Message ----- From: "@stake Advisories" <advisories () atstake com>
Subject: Mac OS X Long argv[] buffer overflow This is fixed in Mac OS X 10.3
<snip http://www.securityfocus.com/archive/1/342735/2003-10-25/2003-10-31/0
Mac OS X Systemic Insecure File Permissions This is fixed in Mac OS X 10.3
<snip http://www.securityfocus.com/archive/1/342725/2003-10-25/2003-10-31/0
Mac OS X Arbitrary File Overwrite via Core Files This is fixed in Mac OS X 10.3
<snip http://www.securityfocus.com/archive/1/342730/2003-10-25/2003-10-31/0
Current thread:
- RE: Mac OS X vulnerabilities ['Virus checked"] Thor Larholm (Oct 29)
- <Possible follow-ups>
- RE: Mac OS X vulnerabilities ['Virus checked"] graham . coles (Oct 29)
- Re: Mac OS X vulnerabilities ['Virus checked"] Steve Clement (Oct 29)
- Re: Mac OS X vulnerabilities ['Virus checked"] Adam Shostack (Oct 29)
- Re: Mac OS X vulnerabilities ['Virus checked"] Ragnar Sundblad (Oct 29)
- Re: Mac OS X vulnerabilities ['Virus checked"] Kurt Harvey (Oct 30)
- Re: Mac OS X vulnerabilities ['Virus checked"] Steve Clement (Oct 29)