Apple patches critical Java for Mac, Mac OS X security holes
Summary: Apple has shipped a high-priority Java for Mac update to cover multiple security vulnerabilities that expose Mac OS X users to hacking attacks.
Apple has shipped a high-priority Java for Mac update to cover multiple security vulnerabilities that expose Mac OS X users to hacking attacks.
According to warnings from Apple, the vulnerabilities could allow an untrusted Java applet to execute arbitrary code outside the Java sandbox.
The risks:
Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user.
The updates are available for Mac OS X v10.6.6 and Mac OS X v10.5.8.
The Java for Mac patches follows the weekend release of a major Mac OS X security update to cover major security holes.
Some of the Mac OS X security holes could lead to remote code execution via rigged fonts or PDF files. The components affected by critical vulnerabilities include ATS, ColorSync, CoreFoundation, CoreGraphics, ImageIO.
Apple also warned about security flaws in MobileMe, MySQL, OpenSSL, QuickLook and QuickTime.
Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.
Talkback
may lead to arbitrary code execution with the privileges of the current use
How can this then be? Isn't the magical, secret component and the awesome Unix heritage protecting OS X through the RDF shield?
Links are useful when accusing others
Given the few (if any) sites still using Java applets I disable Java in Safari and "open safe files" on all my Macs.
OK it doesn't solve all problems, but these two attack vectors have been exposed in a large number of documented vulnerabilities in Mac OS X. I'd like to see Apple adopt this as the default.
RE: Apple patches critical Java for Mac, Mac OS X security holes
Exactly right. Java in the browser offers no benefit* and opens a gaping hole.
For those who feel compelled to misquote the informed and quote the misinformed, have your jollies. Give it about an hour, maybe two, then double check that your java and .net on Windows are also up to date.
Because when java is identified as a problem, it is a problem on Windows, Linux, *BSD, and any other platform where a jvm is found.
.net gets its share of updates as well.
*Oh yes, $#%%%#%@% GoToMeeting browser-version required me to activate java the last time I used it. The irony was, it was a demonstration of app-building software that now could be used ? Ta Da? for iOS apps. They demonstrated how darn quickly they could build an UGLY app. I asked the marketing textbot about good looking apps, and as I was awaiting my reply (Oh, yeah, you can do it if you want) the presenter commented on how they didn't feel beholden to the gui hegemony of Steve Jobs. Okay, next. But, my big hint to development environment product sellers? The quickness to deliver a good interface is where you have to compete with the free XCode. But I digress while the java update downloads.
One right here
RE: Apple patches critical Java for Mac, Mac OS X security holes
How do you get people to visit your "maliciously crafted untrusted Java applet" containing webpage?
By magic or social engineering?
The fatal flaw in your failure of a post.
The same way you get them to do so with Windows.
And how is that, ye?
;)
So drive-by exploits doesn't count!
Right, the user has to visit a page with the applet. So drive-by exploits are not that serious. I guess that we can just forget about browser exploits then, because they all require the user to visit a specially crafted page. All of them.
But tell me, is it this way <i>only on Apple</i> systems or do you also consider IE vulnerabilities non-existing because they require the user to visit the web page for an exploit to be launched? I'm really interesting in knowing how this looks from inside the RDF.
BTW, have you ever heard about Google/index/image poisoning? The way attackers can overwhelm certain search terms to point to their <i>maliciously crafted</i> web pages? Or does that also only work on non-Apple systems?
RE: Apple patches critical Java for Mac, Mac OS X security holes
I'm starting to think that you are a troll. Was I just had?
Stupidity is not limited to Windows users.
RE: Apple patches critical Java for Mac, Mac OS X security holes
I think I win now because I just explained exactly how to get people to visit a malicious site with no social engineering. Now would you shut up about how social engineering is the only vector for that sort of attack? It's demonstrably false and attacks of this type have occurred in recent memory. I don't know why, in spite of the fact that I've told you how this works multiple times you continue to espouse this.
RE: Apple patches critical Java for Mac, Mac OS X security holes
But I use Linux most of the time so that doesn't apply.
So answer the question, pal.
RE: Apple patches critical Java for Mac, Mac OS X security holes
I think the only difference is if you are targeting a malicious code execution then who do you target? OSX? No because OSX doesn't make up a significant portion of the market. Why bother writing up a malicious page for less than 10% of the installed OS base? If you want to get right down to it that is OSX's strongest security asset, the fact that it isn't heavily used. If the market was split more evenly you can believe that OSX would be just as exploited as Windows. The talent is out there but, the motivation isn't.
Just to clarify, this one doesn't count
RE: Apple patches critical Java for Mac, Mac OS X security holes
I've heard that a million times on ZDNet
It must be true. There is no way that a lie could be repeated a million times on ZDNet.
RE: Apple patches critical Java for Mac, Mac OS X security holes
RE: Apple patches critical Java for Mac, Mac OS X security holes
Probably not... It was a poor design decision engineering wise, and they know it. Also they still have European regulators on their back... It simplifies how they manage the branches for Windows 7N and Windows 7 to continue doing it how it is now.
RE: Apple patches critical Java for Mac, Mac OS X security holes
LOL! What a bunch of bull.
Don't fall for it
you're feeding the troll.