Apple Mac OS X security updates
Apple has released Update 2007-009 for Mac OS X 10.4.11 and 10.5.1, including server versions of the operating system, to close a number of security holes. In the overview of the update, the vendor documents a total of 31 vulnerabilities, 16 of which can be used to inject and execute malicious code. Additionally, Apple has released an important security update to the Java components of OS X 10.4.
Several updates close holes in programs and mechanisms that access the internet. For instance, specially crafted websites can be used to inject arbitrary executable code into the local address book due to a flaw in the URL handler. Likewise, images with an integrated, manipulated ColorSync profile can be exploited to execute arbitrary code. The web browser Safari and Shockwave have also been patched to prevent remote code execution.
The vulnerabilities patched by the Java update can be exploited to allow attackers to remotely manipulate a user's digital keychain and take control of vulnerable systems. For this to occur, the user has to visit a manipulated website using a Java-capable browser. According to Apple, OS X 10.5 Leopard is not affected by the Java security holes.
The recent Apple updates also remedy remote code execution flaws in other services exposed to the local network, including the CUPS printing service and the Samba Windows Network component. Other components that have been fixed include Flash Player, Apple Mail, iChat, Quick Look, Spotlight, Desktop Services, IO Storage, Launch Services, XQuery, CFNetwork, Core Foundation, and Spin Tracer as well as some open-source components. Most of the addressed vulnerabilities would allow local users to escalate their privileges in the system and attackers to get access to sensitive information and overwrite files.
The updates are being distributed via the automatic OS X update function, which can be started by clicking on "Software Updates" in the Apple menu, but administrators can also download packets for their platform from Apple. Mac OS X users are advised to install the updates as soon as possible because they address a number of critical security issues. Because of the serious flaw in the update mechanism, extra care should be taken to only run it in a trusted network such as a home network behind a firewall router.
- About Security Update 2007-009, overview of Apple's update
- Download Update 2007-009 for Mac OS X 10.5.1 Client and Server (35.6 MB)
- Download Update 2007-009 for Mac OS X 10.4.11 Client and Server for the PPC platform (15.9 MB)
- Download Update 2007-009 for Mac OS X 10.4.11 Client and Server (Universal/Intel) (27.4 MB)
- About the security content of Java Release 6 for Mac OS X 10.4, technical information posted by Apple