Apple Computer has issued fixes for 10 security  holes that have been rated as "critical" by security firms.
The patches, which are available through Apple's Web site, fix vulnerabilities in versions 10.3.9 and 10.4.2 of the company's Mac OS X operating system.
Although no exploits have been reported as of yet, both Symantec and the French Security Incident Response Team have noted that the flaws are serious and that users with those systems should apply the patches immediately.
Patch Work
With the vulnerabilities, machines running the affected systems could be targets for remote attack, which could be done with images sent through e-mail, Apple has noted.
For example, by crafting a corrupt GIF image, an attacker could trigger a buffer overflow in ImageIO, a Java tool used to display images, resulting in the ability of the attacker to execute arbitrary code on the targeted machine. Several components of OS X use ImageIO, including WebCore and the Safari browser.
Other areas of the system that have been fixed include Ruby, QuickDraw Manager, QuickTime for Java and SecurityAgent.
A flaw in the system's Authorization Services would have allowed unprivileged users to grant certain rights usually restricted to administrators, Apple noted. With admin privileges, malicious users could manipulate files or perform other actions remotely.
System Error
The discovery of critical flaws in OS X is not surprising, said Sophos senior technology consultant Graham Cluley.
"Any complicated operating system is likely to have bugs, and Apple is not immune," he noted. "What's important for users to know is that they should patch right now, even if there are no actual threats exploiting these flaws."
Even though the vulnerabilities are critical, the actual threat is minimal because there is very little malware written for the Mac OS, said Cluley. Virus and worm writers tend to focus on Microsoft 's operating systems because they can infect more users that way. But the discovery of flaws in OS X is a heads-up that no company is completely safe, Cluley added.
"It's a useful reminder that Microsoft isn't the only one that has vulnerabilities," he said.
|
Rackspace: It makes a difference when you focus on support.
House Lawmakers Push Ban on Peer-to-Peer Software
GAO: Los Alamos Computer Security Has Weaknesses
Computer Security Firm Fortinet Plans IPO This Week
Flat Shipments Hurt Dell Despite Increased Earnings
New Pogoplug 'Personal Cloud' Does Social Networking
Apple Tablet Rumored Delayed as Publisher Gears Up
Smartphones: A Bigger Target for Security Threats
FBI Says Hackers Targeting Law Firms, PR Companies