Apple's Security Update Patches Mac OS X, Safari Max OS X and Safari Fixes in First Security Update of 2009 Sean Michael Kerner
Apple has come out with its first major security advisory update of 2009, with fixes to Mac OS X as well as the Safari Web browser. But at least one security expert said the company took too long to respond to problems that had been flagged in Safari.
On the OS X side, Security Update 2009-001 patches at least 22 different issues, spanning video, server, and open source packages. Among the fixes is an Apple update for an error in the Pixlet video codec that could have potentially led to arbitrary code execution.
Though this is the first broad Apple security update of the year, in January, Apple patched its QuickTime media-playing software to version 7.6 for unrelated security issues.
Mac OS X also gets patched in the latest update for a number of different open source programs that it includes, with updates for the Perl and Python programming languages as well as an update to the Common Unix Printing System (CUPS) printing system.
Apple also updated the ClamAV open source antivirus application, which it includes on the Mac OS X Server platforms.
The company has paid more attention to antivirus software lately, although not all of the efforts may have gone as smoothly as it would have liked: Last year, the company posted a Web page advising its desktop users on whether they needed antivirus software for their desktop system. But shortly after catching the eye of the media, it removed the page.
Apple also updated SMB (Server Message Block) (define), which is used by Macs to interoperate with the Microsoft Windows filesystem. The upgrade aims to protect against a buffer overflow and a memory exhaustion issue that could have led to a system shutdown or an arbitrary code execution, Apple said.
Stepped-Up Safari Security
On the browser side, Apple is updating Safari for both Mac and Windows platforms for an RSS (define) feed issue. According to Apple's advisory on the RSS issue, there were multiple input validation issues in Safari's handling of "feed:" URLs.
"The issues allow execution of arbitrary JavaScript in the local security zone," Apple said in its notes accompanying the update. "This update addresses the issues through improved handling of embedded JavaScript within feed."
The general idea of using RSS as an attack vector is not a new one. In 2006, security engineer Robert Auger delivered a presentation at the Black Hat Las Vegas conference detailing how RSS exploitation could work.
In the case of the Safari RSS problem, Apple credits security researcher Brian Mastenbrook for reporting the issue.
Yet Mastenbrook's not especially pleased with how the update played out. In a blog post, he said he originally reported the issue to Apple as early as July 11, 2008 — and criticized the company for its slowness to act.
"Many vulnerabilities rely on attack mechanisms which require a fair amount of technical sophistication on the part of the attacker," Mastenbrook said in his post. "By contrast, this vulnerability works in exactly the same way on all affected platforms, and does not require intricate knowledge of the processor or operating system to exploit. I discovered it accidentally, which indicates that this issue could also be discovered by others."
Mastenbrook goes on to allege that Apple users were unnecessarily left at risk for months and that the company's handling of the matter could erode public confidence that Apple has robust security. Time and again, security researchers have alleged that one of the Mac's best security features is the perception of its better security.
"If Apple's products were widely perceived to be just as insecure as Microsoft's, a significant amount of the goodwill the company has accumulated since the introduction of OS X would be erased," Mastenbrook said.
Apple spokespeople did not return requests for comment by press time.
