Apple Patches 15 Mac OS X Flaws
Apple Computer Inc. has issued a patch for 15 security flaws in its Mac OS X operating system, including many originating in the software's open-source components. The company, however, claims most users are safe from the bugs' most dangerous effects.
Source: eWeekThe patch, available from Apple's Web site or through its automatic update system, fixes issues with Kerberos, Apache 2, IPSec, rsync and other open-source components, as well as in Apple applications such as the Safari browser. (Safari also draws open-source components, such as KHTML and KJS.) Possible exploits include remote execution of malicious code, denial of service, local user privilege escalation, cross-site scripting and Web page spoofing. However, most users will be protected from the flaws' worst dangers, Apple said. For example, a recently publicized string of "double-free" bugs in the Kerberos authentication system doesn't affect the OS X and OS X Server version of Kerberos. Apple's component is susceptible to a buffer overflow that could allow a remote attacker to take over a system, but only if "auth_to_local_names" or "auth_to_local" support is also configured in the edu.mit.Kerberos file, Apple said. "Apple does not enable this by default," the company said in its advisory.
0