Apple plugs 20 Mac OS X vulnerabilities

Apple released security patches to correct 20 vulnerabilities affecting its Mac OS X operating system on Wednesday. The flaws could be exploited by remote or local attackers to execute arbitrary commands, cause a denial of service or obtain elevated privileges.

The latest security updates come just over a month after Apple plugged around a dozen flaws in the OS X operating system and launched Tiger, the latest version of the company's flagship OS.

The latest set of vulnerabilities includes problems with the OS X's HTTP proxy service, its default Bluetooth settings and the way the OS handles Javascript in its Help viewer.

According to a security advisory from iDEFENSE, one of the vulnerabilities affects the server version of OS X and could allow arbitrary code to be executed with root privileges.

"The [NeST] vulnerability itself is a textbook stack overflow and is trivially exploitable. This binary does not ship by default with the standard install of Mac OS X, so only OS X Server platforms are affected," the advisory said.

Apple has also patched the way OS X handles Bluetooth file exchanges. By default, the Bluetooth file exchange service is switched on and uses a shared directory that could be used by other applications, potentially exposing confidential files without the users' knowledge.

According to an advisory posted on Apple's Web site, the security update "disables Bluetooth file exchange and changes the location of the default transfer directory on systems where the old default directory is set. In addition, new users of a system must now enable Bluetooth file exchange before it is allowed."

Another vulnerability, in OS X's Help Viewer, could allow the utility to run Javascript without the restrictions that are normally imposed.

"When Javascript is loaded for a remote site, it is executed in a restricted environment. The environment restrictions are not applied for local Javascript files loaded by the Help Viewer. [the security update] addresses this by only allowing Help Viewer to load registered pages," Apple's advisory said.

Ty Miller, security specialist at Pure Hacking, said the vulnerabilities are a cause for concern and administrators should apply the updates and lock down their systems as soon as possible.

"Some of these vulnerabilities are only dangerous when the machine is right out of the box. Mac OS X has a relatively secure default configuration and administrators should generally shut down things they don't need," said Miller, who believes that as the Apple platform becomes more popular these vulnerabilities are likely to be exploited.

"Apple is becoming more popular since they brought out Mac OS X I think it will become a lot more attacks against it as it becomes more popular. You can't get a completely secure system. The more and operating system plays in the game the more it will be attacked," said Miller.

Advertisement

Talkback 1 comments

  1. OK, so where's the update?! Anonymous -- 05/05/05

    OK, so where's the update?!


Latest Videos

ZDNet's CIO Vision Series

Department of Defence | Greg Farr, CIO (part two)

In the second part of his interview, Defence CIO Greg Farr talks about outsourcing, the skills crisis and reveals his most urgent IT priority.

Sponsored content

Power Centre - Content from our premier sponsors

Blogs

  • Angus Kidman I'm a celebrity, don't back me up
    Celebrity comes with its perks — free alcohol, better-looking partners, lots of holiday time — and disadvantages — constant media intrusions, being forced to appear in films with Eddie Murphy for the long-term good of your career, and having to do mindless radio interviews with angry men who've been awake since 4am.
  • Array Lies, damned lies and telco stupidity
    Earlier this month, Telstra put out a press release trumpeting that it's come up with a new phone coaching service to help people who are "bamboozled" by their mobiles. Another excellent example of wrongheaded thinking from the mobile industry.
  • Array Dear carriers: More walking, less talking
    Sometimes, a well-placed and well-timed letter can make all the difference. Other times, it can make no difference at all — and even hurt your case. This week's missive by the Competitive Carriers' Coalition, I would suggest, falls into the latter category.
  • More blogs »

Tags

Back to top

Featured