[ISN] Apple megapatch plugs 45 security holes

From: InfoSec News (alerts@private)
Date: Tue Mar 13 2007 - 22:13:14 PST


By Joris Evers
Staff Writer, CNET News.com
March 13, 2007

Apple on Tuesday issued a security update for its Mac OS X to plug 45 
security holes, including several zero-day vulnerabilities.

The megapatch is the seventh Apple security patch release in three 
months. It deals with vulnerabilities in Apple's own software, as well 
as third-party components such as Adobe Systems' Flash Player, OpenSSH 
and MySQL. Sixteen of the vulnerabilities addressed by the update were 
previously released as part of two high-profile bug-hunting campaigns.

The vulnerabilities pose varying risks to Macs. Several of the flaws 
could be exploited to gain full control over a Mac running the 
vulnerable component, according to Apple's advisory. Other holes are 
limited and could only be exploited to crash a Mac or used by somebody 
who already has access to a machine to elevate privileges, for example.

One focus of the patch is to fix eight vulnerabilities in the way Mac OS 
X handles disk images, files that when opened appear as a drive within 
the Macintosh Finder. Mounting a malicious image may lead to an error 
and could provide a means for an attacker to breach a Mac, Apple said.

Tuesday's update deals with nine vulnerabilities released as part of the 
Month of Apple Bugs in January and seven bugs disclosed in the Month of 
Kernel Bugs in November. In earlier fix releases, Apple fixed several 
flaws identified during the projects.

While several of the vulnerabilities repaired by Apple's updates were 
previously known, it doesn't appear that any attacks that exploited the 
flaws actually occurred.

In addition to the Mac OS X patch, Apple issued a second update on 
Tuesday to fix a security bug in iPhoto that could expose Mac users to a 
serious attack. An attacker could craft a malicious "photocast" which, 
when opened, could compromise a Mac, Apple said in its alert. The 
Photocasts feature allows people to share pictures in iPhoto.

Tuesday's two releases bring Apple's total patch count for the year to 
seven. Microsoft, meanwhile, on Tuesday skipped its monthly patch day. 
However, it released a dozen security bulletins with fixes for 20 
vulnerabilities in February and four bulletins with fixes for 10 bugs in 

The Apple patch can be downloaded and installed via the Software Update 
feature in Mac OS X, or from Apple Downloads.

Visit the InfoSec News Security Bookstore

This archive was generated by hypermail 2.1.3 : Tue Mar 13 2007 - 22:20:33 PST