|
BugTraq
Mac OS X Long argv[] buffer overflow Oct 28 2003 05:57PM @stake Advisories (advisories atstake com) (1 replies) Re: Mac OS X vulnerabilities Oct 28 2003 07:23PM Thor Larholm (thor pivx com) (1 replies) Re: Mac OS X vulnerabilities Oct 29 2003 01:30AM Joshua Levitsky (jlevitsk joshie com) (1 replies) Re: Mac OS X vulnerabilities Oct 30 2003 10:43AM Radoslav Dejanovic (radoslav dejanovic opsus hr) (1 replies) |
|
Privacy Statement |
servers. Since mac os 10.0 (before "X") apple has used paid upgrades
that addressed security updates, as the release point for the next
supported version of the OS.
I don't personally agree with this method of major patch/upgrade
but it has been in place at least a couple of years. This is not
"news" that MacOS users pay for major security update bundles. At
least they have the $200/5 user home bundle to make it more palatable
to home users. And the education list price for volume maintenance is
even better per copy. But you still pay.
Apple also releases the details of what was patched and provides
the tools to "roll your own" patches with the combination of
developer tools CD's & darwin or samba or SSH or whatever source
sites. We did our own patches at one period of time as an early
adopter of MacOS, (circa spring, 2001), rather than pay for the next
OS upgrade. If you are patching something like open SSH on solaris,
HP-UX, and IRIX already, compiling a new open SSH for OS X is not
much additional work once you get it down.
Mike
At 11:43 AM +0100 10/30/03, Radoslav Dejanovic wrote:
>On Wednesday 29 October 2003 02:30 am, Joshua Levitsky wrote:
>
>> If Apple is responsible then we should see 10.2 patches backported. I think
>> it's reasonable that 10.3 patches come, and then 10.2 patches, and Apple
>> should have some Life Cycle policy to say if everything before 10.2 is EOL
>> or not. It's all a new world with Apple. Let us hope that they do not let
>> us down.
>
>As I mentioned to Thor in my previous e-mail (and got rejected by list admin
>because he thought I missed exactly that point), we should expect Apple
>patching 10.2 as well, because it still hasn't reached its EOL. I don't think
>Apple wouldn't release a patch for 10.2 but instead tell their customers to
>upgrade to 10.3.
[ reply ]