Safari Gets Security Update, along with iOS and Mac


Apple Safari icon

Image via Wikipedia

Apple has released an update for Safari on both the Mac and Windows platforms. At the same time it has released updates for iOS and the Mac. These are security updates to close an exploit recently demonstrated at the PWN2OWN security challenge. It was Charlie Miller, a security researcher, who  successfully exploited iOS earlier this year by successfully hacking into an iPhone. Apple’s iOS also uses the WebKit rendering engine, which was exploited by VUPEN security in their 5 second attack on Mac OS X.

Here is what Apple says about the Safari update:

Products Affected

Safari 5 (Windows), Safari 5 (Mac OS X 10.6), Safari 5 (Mac OS X 10.5), Product Security

Safari 5.0.5

  • WebKitAvailable for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.5 or later, Mac OS X Server v10.6.5 or later, Windows 7, Vista, XP SP2 or later

    Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

    Description: An integer overflow issue existed in the handling of nodesets. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

    CVE-ID

    CVE-2011-1290 : Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann working with TippingPoint‘s Zero Day Initiative

  • WebKitAvailable for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.5 or later, Mac OS X Server v10.6.5 or later, Windows 7, Vista, XP SP2 or later

    Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution

    Description: A use after free issue existed in the handling of text nodes. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution.

    CVE-ID

    CVE-2011-1344 : Vupen Security working with TippingPoint’s Zero Day Initiative, and Martin Barbella

Note:

Certificates Trust Policy

Several fraudulent SSL certificates were issued by a Comodo affiliate registration authority. This may allow a man-in-the-middle attacker to redirect connections and intercept user credentials or other sensitive information. Safari relies on the certificate store of the host operating system to determine if an SSL server certificate is trustworthy. For Mac OS X systems, this issue is addressed with Security Update 2011-002. For iOS, this issue is addressed with iOS 4.3.2 and iOS 4.2.7. For Windows systems, applying the update described in Microsoft Knowledge Base Article 2524375 will cause Safari to regard these certificates as untrusted. The article is available athttp://support.microsoft.com/kb/2524375

Here is what it has to say about the Security Update for Mac:

This document describes Security Update 2011-002, which can be downloaded and installed via Software Updatepreferences, or from Apple Downloads.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see “How to use the Apple Product Security PGP Key.”

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see “Apple Security Updates“.

Products Affected

Mac OS X 10.6, Product Security

Security Update 2011-002

  • Certificate Trust PolicyAvailable for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.7, Mac OS X Server v10.6.7

    Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information

    Description: Several fraudulent SSL certificates were issued by a Comodo affiliate registration authority. This may allow a man-in-the-middle attacker to redirect connections and intercept user credentials or other sensitive information. This issue is addressed by blacklisting the fraudulent certificates.

    Note: For iOS, this issue is addressed with iOS 4.3.2 and iOS 4.2.7. For Windows systems, Safari relies on the certificate store of the host operating system to determine if an SSL server certificate is trustworthy. Applying the update described in Microsoft Knowledge Base Article 2524375 will cause Safari to regard these certificates as untrusted. The article is available at http://support.microsoft.com/kb/2524375

    For mre info on all the recent updates visit http://support.apple.com/kb/HT1222

Lion Developer Preview available for download


OS X LionIf you are a registered Mac OS X developer, you can now hit Software Update for the latest update to Lion Developer Preview 2. The prerelease version of Mac OS X 10.7 works with XCode 4.1 Developer Preview 3.

Looking forward to Lion we can enjoy the prospect of full screen apps, refined Aqua look (popovers, overlay scrollbars and multi-touch gestures), as well as Auto Save and versions.

Related Articles

Mac App Store confirmed as coming 6 January


Mac App Store

Apple has now confirmed that the Mac App Store will go live on 6 January 2011. The store will be available in 90 countries from Day 1. It will feature games, productivity apps and a whole lot more. Steve Jobs said, “The App Store revolutionized mobile apps. We hope to do the same for PC apps with the Mac App Store by making finding and buying PC apps easy and fun. We can’t wait to get started on January 6.”

Apple has already started accepting apps for the store (and rejecting submissions too). Now it’s set a deadline of December 31st for developers wishing to get their app in the Store by the launch on 6th January. Looks like some developers will have a busy Christmas!

Enhanced by Zemanta

MacUser report SX/Jahlav-D infectin hiding in hacked Quicktime update


First for mac news, reviews and know-how
MacUser is reporting that a fake Quicktime installer has been identified. The installer package contains the . Previous versions of the trojan have been distributed in hacked copies of iWork and Photoshop, or have masqueraded as updates to Adobe’s Flash player and as plugins said to be necessary to watch web videos.

The potential infection serves again as a reminder not to install software unless it is comes from the developers’ own website, or in Apple’s case via Software Update, or from a trusted third-party site such as MacUpdate or Version Tracker.

Currently, installing hacked software is the only way to allow an infection onto a Mac. There is no self-propagating malware that kind find its way onto a system without the user’s help.

Original article by Simon Aughton. Visit the MacUser site here: http://www.macuser.co.uk/news/266320/mac-infection-masquerades-as-quicktime-update.html

Reblog this post [with Zemanta]