Apple issues massive security update for Mac OS X

Updates the largest released by Apple in nearly a year.

Apple today issued multiple updates for Mac OS X and Java that patched 55 bugs, including one for its Safari Web browser that prompted a security researcher to blast the company for a half-hearted approach to security.

The updates were the largest released by Apple in nearly a year.

The year's first bug updates from Apple patched 48 security vulnerabilities in the company's operating system and its components, four in Apple's implementation of Sun Microsystems's Java, two non-security flaws it admitted it had introduced with faulty code in Mac OS X 10.5.6, and one fix it said was a "proactive security measure." The majority of the bugs -- 32 altogether -- were in open-source components or software not originally crafted by Apple, as in the case of the quartet of Java flaws.

But the Safari vulnerability may be the one most people remember.

According to Brian Masterbrook, one of the three researchers Apple credited with reporting the Safari bug, Apple had information about the flaw more than seven months ago. "After six months passed without a fix, I decided to post a warning on January 11, 2009, due to my judgment that this issue could be exploited at any time as long as it remained unfixed," Masterbrook said in an entry to his blog Thursday , after Apple had delivered its updates. Masterbrook had posted some information about the bug, as well as a workaround to temporarily disable the RSS feed feature in the browser, in a Jan. 11 warning .

The RSS vulnerability -- present in both the Mac and Windows versions of the browser -- could be used to introduce attack code from a malicious Web site. All criminals had to do, said Masterbrook, was dupe users into visiting such a site. Attacks based on tempting users to a rogue site are commonplace on the Internet, although the vast majority of them are aimed at Windows users.

"This vulnerability...does not require intricate knowledge of the processor or operating system to exploit," Masterbrook said today. "I discovered it accidentally, which indicates that this issue could also be discovered by others. These two factors should have indicated to Apple that this vulnerability carried a high risk."

He took Apple to task for the way it handles reports of security vulnerabilities, and patches its software. "It took seven months for Apple to patch this latest vulnerability in Safari, despite numerous opportunities for it to be addressed in updates that were already scheduled," he said. "OS X users are at this point in the unenviable situation of hoping that Apple starts taking these issues more seriously before phishing exploits, drive-by malware, and viruses become widespread on the platform."

Apple addressed the Safari flaw in both the Security Update 2009-001 for Mac OS X , and in a separate update for Windows users that bumped up the browser to Version 3.2.2. While recent data puts Safari's overall browser usage share at 8.3%, the Windows edition accounted for a scant 0.3% last month, about a quarter the share of Google's Chrome.

The company last patched Safari in November 2008, when it updated the browser twice in less than two weeks to plug more than a dozen holes.

Other parts of Mac OS X that Apple patched today ranged from the Pixlet codec -- which contained a bug that could be triggered by a malformed movie file -- and the Folder Manager to the printing module and Remote Apple Events, which could be exploited to steal information.

The separate Java updates -- one aimed at Mac OS X 10.4, a.k.a. Tiger, the other targeting Mac OS X 10.5, or Leopard -- fixed four vulnerabilities for each version of Apple's operating system, and brought the software up to par with patches Sun released two months ago .

Security Update 2009-001 and the Java updates can be downloaded manually from the Apple site or installed using Mac OS X's built-in patch service. Safari 3.2.2 for Windows can be downloaded from the Apple site.

Join the PC World newsletter!

Error: Please check your email address.

Tags AppleMac OS X

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?