Apple plugs 20 Mac OS X vulnerabilities

Apple released security patches to correct 20 vulnerabilities affecting its Mac OS X operating system on Wednesday. The flaws could be exploited by remote or local attackers to execute arbitrary commands, cause a denial of service or obtain elevated privileges.

The latest security updates come just over a month after Apple plugged around a dozen flaws in the OS X operating system and launched Tiger, the latest version of the company's flagship OS.

The latest set of vulnerabilities includes problems with the OS X's HTTP proxy service, its default Bluetooth settings and the way the OS handles Javascript in its Help viewer.

According to a security advisory from iDEFENSE, one of the vulnerabilities affects the server version of OS X and could allow arbitrary code to be executed with root privileges.

"The [NeST] vulnerability itself is a textbook stack overflow and is trivially exploitable. This binary does not ship by default with the standard install of Mac OS X, so only OS X Server platforms are affected," the advisory said.

Apple has also patched the way OS X handles Bluetooth file exchanges. By default, the Bluetooth file exchange service is switched on and uses a shared directory that could be used by other applications, potentially exposing confidential files without the users' knowledge.

According to an advisory posted on Apple's Web site, the security update "disables Bluetooth file exchange and changes the location of the default transfer directory on systems where the old default directory is set. In addition, new users of a system must now enable Bluetooth file exchange before it is allowed."

Another vulnerability, in OS X's Help Viewer, could allow the utility to run Javascript without the restrictions that are normally imposed.

"When Javascript is loaded for a remote site, it is executed in a restricted environment. The environment restrictions are not applied for local Javascript files loaded by the Help Viewer. [the security update] addresses this by only allowing Help Viewer to load registered pages," Apple's advisory said.

Ty Miller, security specialist at Pure Hacking, said the vulnerabilities are a cause for concern and administrators should apply the updates and lock down their systems as soon as possible.

"Some of these vulnerabilities are only dangerous when the machine is right out of the box. Mac OS X has a relatively secure default configuration and administrators should generally shut down things they don't need," said Miller, who believes that as the Apple platform becomes more popular these vulnerabilities are likely to be exploited.

"Apple is becoming more popular since they brought out Mac OS X I think it will become a lot more attacks against it as it becomes more popular. You can't get a completely secure system. The more and operating system plays in the game the more it will be attacked," said Miller.

Advertisement

Talkback 1 comments

    OK, so where's the update?!Anonymous -- 05/05/05

    OK, so where's the update?!


Latest Videos

Blogs

  • Suzanne Tindal E-health too unsexy for COAG
    There will always be something more politically sexy than e-health for state governments, meaning the National E-Health Transition Authority's business case for a national electronic medical record might just sit on the shelf gathering dust forever.
  • Array Will Rudd's bush backhaul bonanza deliver?
    Rural areas will be welcoming the government's decision to put its money where its politicising is, funnelling $250m into a regional fibre upgrade to six rural centres. Remedying over a decade of near-neglect at the hands of telecoms privatisation, the investment could be the firmest step yet for Labor's NBN dream — but with inevitable political questions and a looming election, Rudd and Conroy need to deliver, and quickly, to preserve the NBN's credibility.
  • Array Doing for AV what VoIP did for telephony
    Sydney-based start-up Audinate is making traditional analog cabling obsolete in favour of TCP/IP-based networking technology. And it's doing a pretty good job so far, with its technology used by World Youth Day and the Sydney Opera House.
  • More blogs »

Tags

Back to top

Featured