Security Weekly

Apple Security Update, Safari, and OS X Security

While Firefox and IE are getting all the hype lately, Apple has released four patches for Safari as part of its latest round, two of which claim to be remotely exploitable:

CVE-2005-2491 – Processing a regular expressions may result in arbitrary code execution
CVE-2005-3702 – Safari may download files outside of the designated download directory
CVE-2005-3703 – JavaScript dialog boxes in Safari may be misleading
CVE-2005-3705 – Visiting malicious web sites with WebKit-based applications may lead to arbitrary code execution

I believe this ties into the SANS Top 20 list, which has listed OS X for the first time as having vulnerabilities (which pose a threat :) This was intended as a wake up call of sorts for OS X users and hopefully sends the message that we all need to pay attention to security, even if we do use a Mac. WeaponX anyone?

Full Apple Patch Release Information

Paul Asadoorian

Paul Asadoorian is currently the Principal Security Evangelist for Eclypsium, focused on firmware and supply chain security awareness. Paul’s passion for firmware security extends back many years to the WRT54G hacking days and reverse engineering firmware on IoT devices for fun. Paul and his long-time podcast co-host Larry Pesce co-authored the book “WRTG54G Ultimate Hacking” in 2007, which fueled the firmware hacking fire even more.

Paul has worked in technology and information security for over 20 years, holding various security and engineering roles in a lottery company, university, ISP, independent penetration tester, and security product companies such as Tenable.
In 2005 Paul founded Security Weekly, a weekly podcast dedicated to hacking and information security. Paul grew Security Weekly into a network of security podcasts spanning multiple topics, such as application security and business. It has been estimated that Paul has conducted over 1,000 interviews with security professionals and hosted more than 1,000 podcast episodes in cybersecurity. In 2020 Security Weekly was acquired by the Cyberrisk Alliance.

Paul is still the host of one of the longest-running security podcasts, Paul’s Security Weekly, he enjoys coding in Python, telling everyone he uses Linux as his daily driver, poking at the supply chain, and reading about UEFI and other firmware-related technical topics.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.