bugtraq - RE: Mac OS X vulnerabilities ['Virus checked"]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 29 Oct 2003 02:25:44 -0800
From: "Thor Larholm" <thor@...x.com>
To: <graham.coles@...ail-logic.com>, <bugtraq@...urityfocus.com>
Subject: RE: Mac OS X vulnerabilities ['Virus checked"]

Graham,
 
Thank you for the feedback.
 
I can't locate any new patches or updates through the software update tool on our 10.2 systems, and Apples security site (which I now received the URL to) mentions nothing about these security updates for OS X 10.2
 
The only way for any Mac OS X 10.2 user to stay secure is to pay Apple for an upgrade to Mac OS X 10.3, there are simply no patches for these vulnerabilities in 10.2 even though 10.2 is affected.
 
 
Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/ - Get our research, join our mailinglist

	-----Original Message----- 
	From: graham.coles@...ail-logic.com [mailto:graham.coles@...ail-logic.com] 
	Sent: Wed 10/29/2003 2:14 AM 
	To: bugtraq@...urityfocus.com; Thor Larholm 
	Cc: 
	Subject: Re: Mac OS X vulnerabilities ['Virus checked"]
	
	


	I usually download main updates (10.2.8) and security patches from
	http://www.apple.com/downloads/macosx/apple
	
	There's also an automated update from within OS X which will check
	for and install patches automatically.
	
	These are non-chargeable updates, I believe the price you quote is
	for a single user copy of Mac OS X.
	
	Regards,
	
	Graham Coles
	
	
	
	
	                                                                                                                                      
	                      "Thor Larholm"                                                                                                  
	                      <thor@...x.com>          To:       "@stake Advisories" <advisories@...take.com>, <bugtraq@...urityfocus.com>    
	                                               cc:       <product-security@...le.com>                                                 
	                      28/10/2003 19:23         Subject:  Re: Mac OS X vulnerabilities ['Virus checked"]                               
	                                                                                                                                      
	                                                                                                                                      
	
	
	
	
	I couldn't find any security contacts on apple.com that didn't look
	fee-based so
	I am asking here in response to these latest disclosures of security
	vulnerabilities in Mac OS X.
	
	When most vendors are notified of security vulnerabilities in their
	products,
	they produce a patch for the affected versions of the software and
	distribute it
	for free. Does Apple plan to distribute a free patch for these security
	vulnerabilities to Mac OS X 10.2, or will my clients have to spend $129 per
	workstation (the single user upgrade price) to have their Apple computer
	stay
	secure?
	
	
	Regards
	Thor Larholm
	PivX Solutions, LLC - Senior Security Researcher
	http://pivx.com/larholm/ - Get our research, join our mailinglist
	
	
	> ----- Original Message -----
	> From: "@stake Advisories" <advisories@...take.com>
	
	> Subject: Mac OS X Long argv[] buffer overflow
	> This is fixed in Mac OS X 10.3
	<snip http://www.securityfocus.com/archive/1/342735/2003-10-25/2003-10-31/0
	>
	
	> Mac OS X Systemic Insecure File Permissions
	> This is fixed in Mac OS X 10.3
	<snip http://www.securityfocus.com/archive/1/342725/2003-10-25/2003-10-31/0
	>
	
	> Mac OS X Arbitrary File Overwrite via Core Files
	> This is fixed in Mac OS X 10.3
	<snip http://www.securityfocus.com/archive/1/342730/2003-10-25/2003-10-31/0
	>