Apple plugs 20 Mac OS X vulnerabilities

Apple released security patches to correct 20 vulnerabilities affecting its Mac OS X operating system on Wednesday. The flaws could be exploited by remote or local attackers to execute arbitrary commands, cause a denial of service or obtain elevated privileges.

The latest security updates come just over a month after Apple plugged around a dozen flaws in the OS X operating system and launched Tiger, the latest version of the company's flagship OS.

The latest set of vulnerabilities includes problems with the OS X's HTTP proxy service, its default Bluetooth settings and the way the OS handles Javascript in its Help viewer.

According to a security advisory from iDEFENSE, one of the vulnerabilities affects the server version of OS X and could allow arbitrary code to be executed with root privileges.

"The [NeST] vulnerability itself is a textbook stack overflow and is trivially exploitable. This binary does not ship by default with the standard install of Mac OS X, so only OS X Server platforms are affected," the advisory said.

Apple has also patched the way OS X handles Bluetooth file exchanges. By default, the Bluetooth file exchange service is switched on and uses a shared directory that could be used by other applications, potentially exposing confidential files without the users' knowledge.

According to an advisory posted on Apple's Web site, the security update "disables Bluetooth file exchange and changes the location of the default transfer directory on systems where the old default directory is set. In addition, new users of a system must now enable Bluetooth file exchange before it is allowed."

Another vulnerability, in OS X's Help Viewer, could allow the utility to run Javascript without the restrictions that are normally imposed.

"When Javascript is loaded for a remote site, it is executed in a restricted environment. The environment restrictions are not applied for local Javascript files loaded by the Help Viewer. [the security update] addresses this by only allowing Help Viewer to load registered pages," Apple's advisory said.

Ty Miller, security specialist at Pure Hacking, said the vulnerabilities are a cause for concern and administrators should apply the updates and lock down their systems as soon as possible.

"Some of these vulnerabilities are only dangerous when the machine is right out of the box. Mac OS X has a relatively secure default configuration and administrators should generally shut down things they don't need," said Miller, who believes that as the Apple platform becomes more popular these vulnerabilities are likely to be exploited.

"Apple is becoming more popular since they brought out Mac OS X I think it will become a lot more attacks against it as it becomes more popular. You can't get a completely secure system. The more and operating system plays in the game the more it will be attacked," said Miller.

Talkback 1 comments

Latest Videos

Sponsored content

Power Centre - Content from our premier sponsors

Blogs

  • Brad Howarth The key Topik is always money
    One of the big problems of the internet is that is practically impossible to keep up-to-date on preferred topics. You can limit your sources, but this can mean missing a lot of valuable data.
  • Array Do we need the legislative blackmail?
    Virtually everyone in the telecommunications industry has their say in the Senate Standing Committee's public hearing into the pending legislation to split up Telstra, in this week's Twisted Wire podcast.
  • Array Give Tax a break for a Change
    Considering the circumstances the Australian Taxation Office's (ATO) Change Program has been operating in over the last few years, it really hasn't been going too badly.
  • More blogs »

Tags

Back to top

Featured