In association with heise online

20 January 2010, 09:55

Apple releases Security Update for Mac OS X

  • Twitter
  • Facebook
  • submit to slashdot
  • StumbleUpon
  • submit to reddit

Mac OS X Apple has released Security Update 2010-001 for its Leopard (Mac OS X 10.5.8 client and server) and Snow Leopard (Mac OS X 10.6.2 client and server) operating systems, closing a total of 12 vulnerabilities. Security Update 2010-001 addresses seven vulnerabilities in the Adobe Flash Player plug-in which can be exploited by an attacker to execute arbitrary code when a victim visits a specially crafted malicious web site. The issues were addressed by Adobe in its December updates with the release of version of the Flash Player plug-in. Buffer overflow vulnerabilities in CoreAudio, ImageIO and Image RAW have also been closed which could have allowed an attacker to run malicious code on a victims system. For an attack to be successful, a victim must first open a malicious MP4, TIFF or DNG file. The ImageIO vulnerability, however, only applies to Apple's Leopard OS.

In addition, the security update eliminates a denial of service (DoS) vulnerability in the CUPS printing service and disables Transport Layer Security (TLS) renegotiation in OpenSSL as a preventative security measure to reduce the risk of a known man-in-the-middle attack. The flawed implementation of the dtoa (double to ascii) C function for converting floating point numbers into strings, however, still remains unpatched. Using the vulnerability, an attacker could provoke a heap overflow, inject arbitrary code into a system, and execute it there. So far, a proof-of-concept exploit for Mac OS X has yet to be released.

The update is available on Apple's Software Update service. Alternatively, Security Update 2010-001 for Leopard (client, server) and Snow Leopard (client) is available to download from Apple's Support Downloads page. All users are advised to update.

See also:


Print Version | Send by email | Permalink:

  • July's Community Calendar

The H Open

The H Security

The H Developer

The H Internet Toolkit