bugtraq - Re: Mac OS X vulnerabilities ['Virus checked"]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <OFFE15DBD8.B73D5E6F-ON80256DCE.00375799@nisaba.com>
Date: Wed, 29 Oct 2003 10:14:13 +0000
From: graham.coles@...ail-logic.com
To: bugtraq@...urityfocus.com, thor@...x.com
Subject: Re: Mac OS X vulnerabilities ['Virus checked"]



I usually download main updates (10.2.8) and security patches from
http://www.apple.com/downloads/macosx/apple

There's also an automated update from within OS X which will check
for and install patches automatically.

These are non-chargeable updates, I believe the price you quote is
for a single user copy of Mac OS X.

Regards,

Graham Coles




                                                                                                                                       
                      "Thor Larholm"                                                                                                   
                      <thor@...x.com>          To:       "@stake Advisories" <advisories@...take.com>, <bugtraq@...urityfocus.com>     
                                               cc:       <product-security@...le.com>                                                  
                      28/10/2003 19:23         Subject:  Re: Mac OS X vulnerabilities ['Virus checked"]                                
                                                                                                                                       
                                                                                                                                       




I couldn't find any security contacts on apple.com that didn't look
fee-based so
I am asking here in response to these latest disclosures of security
vulnerabilities in Mac OS X.

When most vendors are notified of security vulnerabilities in their
products,
they produce a patch for the affected versions of the software and
distribute it
for free. Does Apple plan to distribute a free patch for these security
vulnerabilities to Mac OS X 10.2, or will my clients have to spend $129 per
workstation (the single user upgrade price) to have their Apple computer
stay
secure?


Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/ - Get our research, join our mailinglist


> ----- Original Message -----
> From: "@stake Advisories" <advisories@...take.com>

> Subject: Mac OS X Long argv[] buffer overflow
> This is fixed in Mac OS X 10.3
<snip http://www.securityfocus.com/archive/1/342735/2003-10-25/2003-10-31/0
>

> Mac OS X Systemic Insecure File Permissions
> This is fixed in Mac OS X 10.3
<snip http://www.securityfocus.com/archive/1/342725/2003-10-25/2003-10-31/0
>

> Mac OS X Arbitrary File Overwrite via Core Files
> This is fixed in Mac OS X 10.3
<snip http://www.securityfocus.com/archive/1/342730/2003-10-25/2003-10-31/0
>