May 25, 2004 2:14 PM PDT
Mac OS fix fails to plug security hole
- Related Stories
-
Apple issues Mac OS X security patch
May 21, 2004 -
Mac OS X vulnerable to one-two combo attack
May 18, 2004 -
Apple criticized for security advisories
May 4, 2004
The security issue could allow an attacker to transfer and then run a malicious program on a Mac, if the Mac's user can be enticed to go to a fake Web page on which the program has been placed.
"This, in my mind, is the first critical vulnerability on OS X," said Richard Forno, a security researcher and the former chief of security for domain registrar Network Solutions. "Downloading the patch and seeing that there were some things that were fixed and some things that weren't, tells me that there is more work to be done."
Get Up to Speed on...
Enterprise security
Get the latest headlines and
company-specific news in our
expanded GUTS section.
Apple would not comment. The company
The vulnerability actually involves two flaws. One allows a Web site to place a file on the Mac's hard drive when a user clicks on a uniform resource locator, or URL, specifically designed to bypass Mac OS X's security. The other gives an attacker the ability to run a file on another user's computer, provided the location of the file is known. Used together, the flaws constitute a major security hole that could result in a potential instant-messaging or e-mail virus.
Perhaps the biggest problem is that there seems to be no easy solution, Jason Harris, a programmer for Unsanity, wrote in the
"There's lots of overlap between useful applications of this functionality and malicious ones, meaning that Apple can't easily fix this without removing useful features from its operating system and from existing apps," he wrote.
The issue is the first major security problem for Mac OS X that has not been caused by the operating system's underlying Unix roots. Previously, Mac OS X has mainly had to patch problems that affected FreeBSD, the Unix-like operating system on which it is based. However, the current issue is in the code that the company built on top of that software.
Forno maintains that the Mac is more secure than Windows but stressed that this problem should have been caught in testing before the operating system had shipped. Moreover, in light of the goofed patch and previous issues with
"Apple is coming to terms with dealing with these types of issues, "Forno said.
See more CNET content tagged:
security hole,
Apple Mac OS,
Apple Mac OS X,
Apple Computer,
Apple Macintosh
issues handled.
My ISP, Videotron is promising upgrades in security but for now
continues to be a target for harvesters and saboteurs. Your
article compels me to be even more careful on the web.
Louis Greco,Montreal,Canada.