Date: Wed, 29 Oct 2003 11:37:52 +0000
From: graham.coles@...ail-logic.com
To: "Thor Larholm" <thor@...x.com>
Cc: bugtraq@...urityfocus.com
Subject: RE: Mac OS X vulnerabilities ['Virus checked"]



Thor,

Sorry, I hadn't read the vendor response section of the advisories fully,
I'd rather assumed they would be issuing a security update for 10.2 as
per usual.

I'd have to agree it's a pretty poor showing from Apple if the only fix is
to
buy the next version of the operating system. I believe Microsoft are about
to stop patching Windows Me shortly (which has been around for a few years
now) and usually support the current and previous service pack of an OS.

If Apple are only going to support the most recent version of OS X - which
equates to about 12 months lifetime, as I believe they're planning a major
new release each year - then it's going to be either difficult or expensive
to
keep secure.

Given the current climate with regards to security, I don't think they're
doing
themselves any favours if they take this route. I hope they'll reconsider
if this
is their policy.

Regards,

Graham Coles



                                                                                                                                       
                      "Thor Larholm"                                                                                                   
                      <thor@...x.com>          To:       <graham.coles@...ail-logic.com>, <bugtraq@...urityfocus.com>                  
                                               cc:                                                                                     
                      29/10/2003 10:25         Subject:  RE: Mac OS X vulnerabilities ['Virus checked"]                                
                                                                                                                                       
                                                                                                                                       




Graham,

Thank you for the feedback.

I can't locate any new patches or updates through the software update tool
on our 10.2 systems, and Apples security site (which I now received the URL
to) mentions nothing about these security updates for OS X 10.2

The only way for any Mac OS X 10.2 user to stay secure is to pay Apple for
an upgrade to Mac OS X 10.3, there are simply no patches for these
vulnerabilities in 10.2 even though 10.2 is affected.


Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/ - Get our research, join our mailinglist

 -----Original Message-----
 From: graham.coles@...ail-logic.com [mailto:graham.coles@...ail-logic.com]
 Sent: Wed 10/29/2003 2:14 AM
 To: bugtraq@...urityfocus.com; Thor Larholm
 Cc:
 Subject: Re: Mac OS X vulnerabilities ['Virus checked"]




 I usually download main updates (10.2.8) and security patches from
 http://www.apple.com/downloads/macosx/apple

 There's also an automated update from within OS X which will check
 for and install patches automatically.

 These are non-chargeable updates, I believe the price you quote is
 for a single user copy of Mac OS X.

 Regards,

 Graham Coles





                       "Thor Larholm"
                       <thor@...x.com>          To:       "@stake
                       Advisories" <advisories@...take.com>,
                       <bugtraq@...urityfocus.com>
                                                cc:
                       <product-security@...le.com>
                       28/10/2003 19:23         Subject:  Re: Mac OS X
                       vulnerabilities ['Virus checked"]






 I couldn't find any security contacts on apple.com that didn't look
 fee-based so
 I am asking here in response to these latest disclosures of security
 vulnerabilities in Mac OS X.

 When most vendors are notified of security vulnerabilities in their
 products,
 they produce a patch for the affected versions of the software and
 distribute it
 for free. Does Apple plan to distribute a free patch for these security
 vulnerabilities to Mac OS X 10.2, or will my clients have to spend $129
 per
 workstation (the single user upgrade price) to have their Apple computer
 stay
 secure?


 Regards
 Thor Larholm
 PivX Solutions, LLC - Senior Security Researcher
 http://pivx.com/larholm/ - Get our research, join our mailinglist


 > ----- Original Message -----
 > From: "@stake Advisories" <advisories@...take.com>

 > Subject: Mac OS X Long argv[] buffer overflow
 > This is fixed in Mac OS X 10.3
 <snip
 http://www.securityfocus.com/archive/1/342735/2003-10-25/2003-10-31/0
 >

 > Mac OS X Systemic Insecure File Permissions
 > This is fixed in Mac OS X 10.3
 <snip
 http://www.securityfocus.com/archive/1/342725/2003-10-25/2003-10-31/0
 >

 > Mac OS X Arbitrary File Overwrite via Core Files
 > This is fixed in Mac OS X 10.3
 <snip
 http://www.securityfocus.com/archive/1/342730/2003-10-25/2003-10-31/0
 >

Powered by blists - more mailing lists