Safari Gets Security Update, along with iOS and Mac

Image via Wikipedia

Apple has released an update for Safari on both the Mac and Windows platforms. At the same time it has released updates for iOS and the Mac. These are security updates to close an exploit recently demonstrated at the PWN2OWN security challenge. It was Charlie Miller, a security researcher, who  successfully exploited iOS earlier this year by successfully hacking into an iPhone. Apple’s iOS also uses the WebKit rendering engine, which was exploited by VUPEN security in their 5 second attack on Mac OS X.

Here is what Apple says about the Safari update:

Products Affected

Safari 5 (Windows), Safari 5 (Mac OS X 10.6), Safari 5 (Mac OS X 10.5), Product Security

Safari 5.0.5

• WebKitAvailable for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.5 or later, Mac OS X Server v10.6.5 or later, Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

  Description: An integer overflow issue existed in the handling of nodesets. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

  CVE-ID

  CVE-2011-1290 : Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann working with TippingPoint‘s Zero Day Initiative

• WebKitAvailable for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.5 or later, Mac OS X Server v10.6.5 or later, Windows 7, Vista, XP SP2 or later

  Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

  Description: A use after free issue existed in the handling of text nodes. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

  CVE-ID

  CVE-2011-1344 : Vupen Security working with TippingPoint’s Zero Day Initiative, and Martin Barbella

Note:

Certificates Trust Policy

Several fraudulent SSL certificates were issued by a Comodo affiliate registration authority. This may allow a man-in-the-middle attacker to redirect connections and intercept user credentials or other sensitive information. Safari relies on the certificate store of the host operating system to determine if an SSL server certificate is trustworthy. For Mac OS X systems, this issue is addressed with Security Update 2011-002. For iOS, this issue is addressed with iOS 4.3.2 and iOS 4.2.7. For Windows systems, applying the update described in Microsoft Knowledge Base Article 2524375 will cause Safari to regard these certificates as untrusted. The article is available athttp://support.microsoft.com/kb/2524375

Here is what it has to say about the Security Update for Mac:

This document describes Security Update 2011-002, which can be downloaded and installed via Software Updatepreferences, or from Apple Downloads.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see “How to use the Apple Product Security PGP Key.”

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see “Apple Security Updates“.

Products Affected

Mac OS X 10.6, Product Security

Security Update 2011-002

• Certificate Trust PolicyAvailable for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.7, Mac OS X Server v10.6.7

  Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information

  Description: Several fraudulent SSL certificates were issued by a Comodo affiliate registration authority. This may allow a man-in-the-middle attacker to redirect connections and intercept user credentials or other sensitive information. This issue is addressed by blacklisting the fraudulent certificates.

  Note: For iOS, this issue is addressed with iOS 4.3.2 and iOS 4.2.7. For Windows systems, Safari relies on the certificate store of the host operating system to determine if an SSL server certificate is trustworthy. Applying the update described in Microsoft Knowledge Base Article 2524375 will cause Safari to regard these certificates as untrusted. The article is available at http://support.microsoft.com/kb/2524375

  For mre info on all the recent updates visit http://support.apple.com/kb/HT1222

Related Articles

• Apple updates Safari, iOS, and OS X to address security flaw (reviews.cnet.com)
• Apple Releases Safari 5.0.5 And Mac OS X Security Update 2011-002 (cultofmac.com)
• “Safari 5.0.5 Available, Security Update 2011-002″ and related posts (news.worldofapple.com)
• Apple Releases Safari 5.0.5 and Security Update 2011-002 (macstories.net)
• Apple security fixes for SSL, Safari and iOS (nakedsecurity.sophos.com)
• Safari 5.0.5 and Security Update 2011-002 now in Software Update (tuaw.com)

Microsoft’s CEO rated worst CEO of Tech Companies

Unlike Steve Jobs. Microsoft’s CEO Steve Ballmer has never been the darling of the tech media. According to the site glassdoor.com his approval rating from his employees is the lowest of any major tech company — a dismal 40%, down from 46% last year.

In contrast, Steve Jobs has a rating of 95% and Eric Schmidt of Google has a rating of 96%. In fact, of the top 12 tech companies surveyed, Ballmers was the worst CEO and Schmidt was the best. The largest year-on-year decline however belongs to Yahoo’s Carol Bartz, after she started off with a 77% approval rating, which was more than twice the approval rating of her predecessor Jerry Yang, who had a 34% approval upon his departure.  In the past 12 months, Bartz’s approval has dropped to 50%.

You can view the full chart and comments at http://goo.gl/dZXXe

Whether this poor performance will lead to calls for Steve Ballmer to go remains to be seen. There have been rumblings in recent months due to the lacklustre performance of Microsoft in the mobile sector and its failure to come up with a response to the iPad. Some have argued that Microsoft Office has dominated the company’s outlook so much that innovation in the mobile devices sector has been stifled or worse, actively resisted lest it lead to a resources being taken away from Office development.

Certainly, Microsoft has lost the plot as far as the smart phone and tablet sectors are concerned.

 

 

 

Windows 8 to have Time Machine clone

Rumours are that Windows 8 will come with Microsoft’s version of Time Machine, enabling easy backups from within the OS. Although Vista had something similar (Shadow Copies) Apple’s Time Machine preceded this by around 2 years. Certainly, Apple made a better job of the interface and user-friendliness of the software than did Microsoft, but then that is a given most of the time.

As always, it seems Microsoft copies the best of Apple’s innovations, only usually a few years after Apple debuts them and then somewhat poorly. At least that’s the argument that most Mac fans would make.

Facial recognition and tablet computers are apparently a part of Microsoft’s Windows 8, along with improved start-up times. However, so far these are just rumours and we will have to wait a while longer before we have confirmation of Window 8′s official features list.

Microsoft admit iPad eating into netbook market

Image via Wikipedia

Microsoft‘s own Gavriella Schuster, general manager for Windows product management has admitted in an interview that the iPad is impacting netbook sales.

Netbooks are a huge market for Microsoft with over 90% of them shipping with Windows, so any loss of sales to the iPad is sure to hit profits for the company.

This is a big deal for them and it is yet another indication that the iPad is re-shaping the market, just as the iPod did in the portable music player arena and the iPhone has done in the smartphone market. Truth is that no company, not Nokia, Sony Ericsson nor Microsoft can afford to ignore what Apple is doing. Why else would there be a veritable flood of new tablet devices coming to market and a decline in netbook sales?

Related articles

• Microsoft acknowledges iPad’s effect on netbook market (tuaw.com)
• Netbooks are being ‘cannibalized,’ says Windows GM (engadget.com)
• Microsoft admits tablets are cannibalizing netbooks (slashgear.com)
• Tablets eating Netbooks? A Microsoft GM says yes (news.cnet.com)
• The iPad IS cannibalizing netbook sales (zdnet.com)
• Microsoft Windows exec says iPad cannibalizing netbooks (electronista.com)
• Finally, Someone at Microsoft Says Tablets Are Cannibalizing Netbooks (macstories.net)
• Microsoft finally admits that the iPad is ‘cannibalizing’ netbook sales [TNW Microsoft] (thenextweb.com)
• 240 million Windows 7 licenses sold in first 12 months (geek.com)