Apple issues first security update of year

Share this article:
Apple on Thursday issued four security updates that address a number of vulnerabilities in Mac OS X, Java and Safari for Windows.

These are the first security updates Apple has released this year.

Twenty-eight issues were included in Apple's Security Update 2009-001, which addresses about 50 security vulnerabilities, many that are present in third-party applications bundled with the Mac OS X platform.

The flaws could enable an attacker to execute arbitrary code, cause a denial-of-service condition, access the system with escalated privileges, or obtain sensitive information, according to a US-CERT advisory encouraging users and administrators to review and apply the updates.

One of the more notable vulnerabilities patched is in Safari RSS. It leaves Mac OS X or Windows users open to arbitrary code execution if they access a maliciously crafted feed.

Security researcher Brian Mastenbrook -- credited by Apple with discovering the flaw -- blasted the computing giant for not patching the bug sooner, which he reported roughly seven months ago. 

“This vulnerability works in exactly the same way on all affected platforms, and does not require intricate knowledge of the processor or operating system to exploit,” Mastenbrook wrote. “I discovered it accidentally, which indicates that this issue could also be discovered by others. These two factors should have indicated to Apple that this vulnerability carried a high risk.”

An Apple spokesperson could not be reached for comment Friday.

Other vulnerabilities addressed in the security update include errors that could all lead to arbitrary code execution if successfully exploited in Apple Pixlet Video, Carbon Core, ClamAV, CoreText, perl, python, SMB, and X11.

Other issues were addressed in AFP Server, Certificate Assistant, CUPS web interface, DS Tools, fetchmail, Folder Manager, FSEvents, Network Time, csregprinter, Remote Apple Events server, Server Manager, SquirrelMail, FreeType, LibX11, and XTerm -- the details of all are included in Apple's update.

Apple additionally issued an updates for Java for Mac OS X 10.15 (Update 3) and 10.4 (Release 8) for “multiple vulnerabilities” in Java Web Start and the Java Plug-in, the worst of which may allow untrusted Java Web Start applications and untrusted Java applets to obtain elevated privileges.
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

Company news: New hires at Accuvant, ZeroFox and ThreatStream

New hires at Accuvant, ZeroFOX and ThreatStream, while a divestiture at Juniper and an acquisition for BlackBerry.

News briefs: The latest on Sony, Android, Backoff malware and more.

News briefs: The latest on Sony, Android, Backoff ...

This month's news briefs cover a preliminary settlement Sony will bear for the exposure of 77 million customers, and more.

CryptoWall surpasses CryptoLocker in infection rates

CryptoWall surpasses CryptoLocker in infection rates

A threat analysis from Dell SecureWorks CTU says that CryptoWall has picked up where its famous sibling left off.