p2pnet - rss feed: OS X 10.3.9 security flaws
p2pnet.net News:- Apple is recommending that all Mac users install its Security Update 2005-002 which, “delivers a number of security enhancements”.
By exploiting one of the flaws, "unprivileged local users" could create a "denial of service via a kernel panic," says Apple.
Under Security content of Mac OS X 10.3.9 Update, Apple lists:
CVE ID: CAN-2005-0974 CERT: VU#713614
Impact: Local system users can cause a local denial of service.
Description: A vulnerability in the nfs_mount() call due to insufficient checks on input values could allow unprivileged local users to create a denial of service via a kernel panic.
CVE ID: CAN-2005-0975
Impact: Local system users can cause a temporary interruption of system operation.
Description: A vulnerability in the parsing of certain executable files could allow unprivileged local users to temporarily suspend system operations. Credit to Neil Archibald for reporting this issue.
Safari
CVE ID: CAN-2005-0976
Impact: Remote sites could cause html and javascript to run in the local domain.
Description: This update closes a vulnerability that allowed remote websites to load javascript to execute in the local domain. Credit to David Remahl for reporting this issue.
Apple says the fixs includes these components:
- Java Web Start
- JavaPluginCocoa.bundle
- JavascriptCore
- Core Java classes
Something you think we should know? tips[at]p2pnet.net
<——Making fun of AOL users is like making fun of the kid in the wheel chair——>
April 19th, 2005 at 3:37 pm
where or where are all the Mac pundits now…..btw I own 2 macs I just knew every system has it’s flaws…
April 19th, 2005 at 5:35 pm
They are off with the Java kids playing in the sandbox - burrying their heads in the sand
April 19th, 2005 at 9:34 pm
Macs simply do not have security flaws of any sort. The author of this story was obviously writing about something he/she does not understand.
April 20th, 2005 at 1:15 am
The world is ending, Mac OS X is clearly no different to XP or 2000. Why this morning I turned it on, and 15 minutes into my session i’d downloaded three trojans and had a myriad of inexplicable pop-ups.
I’m not in the sandbox, i’m just dealing with my oh-so-very-fraught-with-security-holes OS.
This patch means very little - its an acknowledgement to how well fortified the OS is. It took 5 days to find, without any users becomming affected by…anything. How many tens, hundreds - thousands! - of Windows users have been infected or adversely effected before a pertinent (quite often, if not always, 3rd party) patch/virus definition becomes available.