Apple Tuesday issued a record-breaking security update that patched nearly 90 vulnerabilities in both its own code and the third-party applications it bundles with its Tiger and Leopard operating systems.
Security Update 2008-002 plugged 87 holes in the client and server editions of Mac OS X 10.4 and Mac OS 10.5, This single update’s total patch count nearly equaled half of all the fixes Apple released in 2007, and easily dwarfed the biggest updates that year, both which saw 40 or more bugs patched.
“What a dizzy double take,” said Andrew Storms , director of security operations at nCircle Network Security Inc. in an e-mail. “Right on the heels of an unprecedented giant Safari fix, we now have a frighteningly large set of updates for OSX 10.4.11 and 10.5.2.”
Earlier today, Apple updated its Safari browser for both Mac and Windows, patching 13 vulnerabilities.
“Wow, Apple has to be careful,” said Storms, director of security operations at nCircle Network Security Inc. “Safari may not have any more bugs, and fixes, than IE and Firefox, but unleashing a giant package like this is going to create worry among users.
“When you release a dot-release version and its comes with a mother lode of vulnerabilities, that can bring down the favorable relationship that Apple has with its users,” Storms said.
The day’s much larger security roll-up fixed flaws in 30 different applications or operating system components in Mac OS X, from AFP Client and Apache to the Wiki Server and X11, the Mac’s version of the X Window System.
“Historically, the third-party applications bundled with OS X have made up a decent majority of these updates,” said Storms. Today’s release is no different.” By Storm’s count, 18 of the 30 components or applications patched were Apple’s own. An even dozen were the responsible of others.
Some of the vulnerabilities were specific to Leopard, others to Tiger. The Leopard update quashed bugs in AFP Client, Apache, Application Firewall, ClamAV, CUPS, Emacs, Help Viewer, Image Raw, Kerberos, mDNSResponder, OpenSSH, pax archive, PHP, Podcast Producer, Preview, Printing, System Configuration, UDF, Wiki Server and X11.
Several were found only in Server 10.5. The open-source ClamAV antivirus scanner included with Apple's server operating system received patches for nine bugs, for example. “Multiple vulnerabilities exist in ClamAV 0.90.3 provided with Mac OS X Server v10.5 systems, the most serious of which may lead to arbitrary code execution,” read Apple’s advisory.
In Tiger, meanwhile, AFP Client, AFP Server, Apache, AppKit, CFNetwork, ClamAV, CoreFoundation, CoreServices, CUPS, curl, Emacs, file, Foundation, Help Viewer, Kerberos, libc, notifyd, OpenSSH, PHP, System Configuration and X11 were patched.
“The majority of the more critical updates from today are found in those third-party applications,” said Storms. “Point being, we can’t blame Apple for all the security issues in OS X.”
Among the changes, a fix for Podcast Producer so it no longer sends passwords that can potentially be viewed by other local users. Apple’s Preview application also got an update to fix an issue that could allow encrypted PDF files saved in Preview to be read without a password.
Unlike other operating system vendors, Apple doesn’t rate the vulnerabilities it patches. A large number of the fixes Tuesday, however, were accompanied by Apple phrasing — “arbitrary code execution” — that signals the bug could be used by attackers to infect a Mac with malicious code.
In others’ ranking systems, vulnerabilities like that are typically classified as “critical” threats.
Amongst the Safari fixes, Nine of the vulnerabilities — eight on Mac OS X — were classified by Apple as cross-site scripting flaws, which are often used by phishers and other identity thieves, but in some cases can be used to plant malware — a Trojan horse, perhaps — on a machine.
It’s easy to dismiss cross-site scripting bugs, warned Storms, but doing so misses the big picture.
“We’ve come to learn that cross-site scripting vulnerabilities are not the worst of the possible scenarios. But you have to understand where researchers are coming from. They’re concentrating on cross-site scripting vulnerabilities, as well as other client-side [bugs]. It’s all browsers these days.”
The updated browser can be downloaded in versions for Mac OS X 10.4 (Tiger), Mac OS X 10.5 (Leopard), Windows XP and Windows Vista from Apple’s Web site.
Security Update 2008-002 can be downloaded manually from the Apple site , or installed using Mac OS X’s integrated update service.
Depending on the version, the update runs between 50MB and 108MB in size.
— With files from Jim Dalrymple