I can't locate any new patches or updates through the software update tool on our 10.2 systems, and Apples security site (which I now received the URL to) mentions nothing about these security updates for OS X 10.2
The only way for any Mac OS X 10.2 user to stay secure is to pay Apple for an upgrade to Mac OS X 10.3, there are simply no patches for these vulnerabilities in 10.2 even though 10.2 is affected.
Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/ - Get our research, join our mailinglist
-----Original Message-----
From: graham.coles (at) retail-logic (dot) com [email concealed] [mailto:graham.coles (at) retail-logic (dot) com [email concealed]]
Sent: Wed 10/29/2003 2:14 AM
To: bugtraq (at) securityfocus (dot) com [email concealed]; Thor Larholm
Cc:
Subject: Re: Mac OS X vulnerabilities ['Virus checked"]
I usually download main updates (10.2.8) and security patches from
http://www.apple.com/downloads/macosx/apple
There's also an automated update from within OS X which will check
for and install patches automatically.
These are non-chargeable updates, I believe the price you quote is
for a single user copy of Mac OS X.
Regards,
Graham Coles
"Thor Larholm"
<thor (at) pivx (dot) com [email concealed]> To: "@stake Advisories" <advisories (at) atstake (dot) com [email concealed]>, <bugtraq (at) securityfocus (dot) com [email concealed]>
cc: <product-security (at) apple (dot) com [email concealed]>
28/10/2003 19:23 Subject: Re: Mac OS X vulnerabilities ['Virus checked"]
I couldn't find any security contacts on apple.com that didn't look
fee-based so
I am asking here in response to these latest disclosures of security
vulnerabilities in Mac OS X.
When most vendors are notified of security vulnerabilities in their
products,
they produce a patch for the affected versions of the software and
distribute it
for free. Does Apple plan to distribute a free patch for these security
vulnerabilities to Mac OS X 10.2, or will my clients have to spend $129 per
workstation (the single user upgrade price) to have their Apple computer
stay
secure?
Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/ - Get our research, join our mailinglist
Thank you for the feedback.
I can't locate any new patches or updates through the software update tool on our 10.2 systems, and Apples security site (which I now received the URL to) mentions nothing about these security updates for OS X 10.2
The only way for any Mac OS X 10.2 user to stay secure is to pay Apple for an upgrade to Mac OS X 10.3, there are simply no patches for these vulnerabilities in 10.2 even though 10.2 is affected.
Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/ - Get our research, join our mailinglist
-----Original Message-----
From: graham.coles (at) retail-logic (dot) com [email concealed] [mailto:graham.coles (at) retail-logic (dot) com [email concealed]]
Sent: Wed 10/29/2003 2:14 AM
To: bugtraq (at) securityfocus (dot) com [email concealed]; Thor Larholm
Cc:
Subject: Re: Mac OS X vulnerabilities ['Virus checked"]
I usually download main updates (10.2.8) and security patches from
http://www.apple.com/downloads/macosx/apple
There's also an automated update from within OS X which will check
for and install patches automatically.
These are non-chargeable updates, I believe the price you quote is
for a single user copy of Mac OS X.
Regards,
Graham Coles
"Thor Larholm"
<thor (at) pivx (dot) com [email concealed]> To: "@stake Advisories" <advisories (at) atstake (dot) com [email concealed]>, <bugtraq (at) securityfocus (dot) com [email concealed]>
cc: <product-security (at) apple (dot) com [email concealed]>
28/10/2003 19:23 Subject: Re: Mac OS X vulnerabilities ['Virus checked"]
I couldn't find any security contacts on apple.com that didn't look
fee-based so
I am asking here in response to these latest disclosures of security
vulnerabilities in Mac OS X.
When most vendors are notified of security vulnerabilities in their
products,
they produce a patch for the affected versions of the software and
distribute it
for free. Does Apple plan to distribute a free patch for these security
vulnerabilities to Mac OS X 10.2, or will my clients have to spend $129 per
workstation (the single user upgrade price) to have their Apple computer
stay
secure?
Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/ - Get our research, join our mailinglist
> ----- Original Message -----
> From: "@stake Advisories" <advisories (at) atstake (dot) com [email concealed]>
> Subject: Mac OS X Long argv[] buffer overflow
> This is fixed in Mac OS X 10.3
<snip http://www.securityfocus.com/archive/1/342735/2003-10-25/2003-10-31/0
>
> Mac OS X Systemic Insecure File Permissions
> This is fixed in Mac OS X 10.3
<snip http://www.securityfocus.com/archive/1/342725/2003-10-25/2003-10-31/0
>
> Mac OS X Arbitrary File Overwrite via Core Files
> This is fixed in Mac OS X 10.3
<snip http://www.securityfocus.com/archive/1/342730/2003-10-25/2003-10-31/0
>
[ reply ]