The InformationWeek -- Blogs
Welcome Guest. | Log In| Register | Membership Benefits

Security

Topics:   Security

  • Email this page E-mail this page
  • Print this page Print this page
  • Bookmark and Share
  • icon

Apple Drops Major Security Patch


Posted by George Hulme, Feb 12, 2009 11:59 PM

Apple today released a bevy of patches that, by my quick count, fix about 55 bugs in its flagship OS X operating system as well as Java. Fortunately, through Software Update, the patch updates for Java for Mac OS X 19.5 Update 3, and Security UPdate 2009-001, which total 47 MB, went smoothly for this user.


While the patches fix nearly 50 security holes, including a number in Java for OS X 10.5 and many of the open source components that provide some of the underbelly of the operating system, it's the Safari RSS flaw that is perhaps the most dangerous to the greatest number of users:

Safari RSS

CVE-ID: CVE-2009-0137
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.6, Mac OS X Server v10.5.6

Impact: Accessing a maliciously crafted feed: URL may lead to arbitrary code execution

Description: Multiple input validation issues exist in Safari's handling of feed: URLs. The issues allow execution of arbitrary JavaScript in the local security zone. This update addresses the issues through improved handling of embedded JavaScript within feed: URLs. Credit to Clint Ruoho of Laconic Security, Billy Rios of Microsoft, and Brian Mastenbrook for reporting these issues.

Looks like just visiting a maliciously crafted Web site is all that would be needed to nail your system.

More information about the update is available from Apple, right here.

If you haven't yet, run Software Update. Despite the number of fixes, it only took a few minutes for me to patch a Mac Pro and a MacBook Pro.

« IE8: Better, But Still Not Best | Main | Tata Tells CIOs: Show Me The Money! »



Sign Up Now
For InformationWeek News Alerts




This is a public forum. United Business Media and its affiliates are not responsible for and do not control what is posted herein. United Business Media makes no warranties or guarantees concerning any advice dispensed by its staff members or readers.

Community standards in this comment area do not permit hate language, excessive profanity, or other patently offensive language. Please be aware that all information posted to this comment area becomes the property of United Business Media LLC and may be edited and republished in print or electronic format as outlined in United Business Media's Terms of Service.

Important Note: This comment area is NOT intended for commercial messages or solicitations of business.




 
 

  1. HPC Joins the Dummy Revolution?
  2. Detecting Scalability Problems With Intel Parallel Universe Portal
  3. Just Say No To SFAQL Parallelism


Join The InformationWeek Group On LinkedIn


                           


  1. HTC Droid Eris To Get Android 2.0 Update
  2. Verizon Says Droid Fix Coming In A Few Weeks
  3. iPhone Headed For T-Mobile?
  4. Verizon Calls iPhone A 'Digitally Clueless Beauty Queen'
  5. Intel Floats Cloud Computing On A Chip


  1. Can Electronic Medical Records Be Secured?
  2. Google Chrome OS Previewed
  3. Analytics Brief: 5 Key Steps To Cybersecurity
  4. CIO Profiles: Patti Reilly White, Senior VP And CIO Of Darden Restaurants
  5. The Point-Of-Sale Problem
  6. Air Pressure: Why IT Must Sort Out App Mobilization Challenges

 

  Ars Technica
Boing Boing
Channel 9 Forums
CRN Blogs
Dr.Dobb's Portal: Blogs
Engadget
Gizmodo
GrokLaw
  Lifehacker
Schneier on Security
Slashdot
TechCrunch
Techdirt
Techmeme
Valleywag

  DECEMBER 2008
NOVEMBER 2008
OCTOBER 2008
SEPTEMBER 2008
AUGUST 2008
JULY 2008
JUNE 2008
MAY 2008
  APRIL 2008
MARCH 2008
FEBRUARY 2008
JANUARY 2008
DECEMBER 2007
NOVEMBER 2007
OCTOBER 2007
SEPTEMBER 2007