Re: Mac OS X vulnerabilities

[Thor Larholm]

I couldn't find any security contacts on apple.com that didn't look fee-based so
I am asking here in response to these latest disclosures of security
vulnerabilities in Mac OS X.

When most vendors are notified of security vulnerabilities in their products,
they produce a patch for the affected versions of the software and distribute it
for free. Does Apple plan to distribute a free patch for these security
vulnerabilities to Mac OS X 10.2, or will my clients have to spend $129 per
workstation (the single user upgrade price) to have their Apple computer stay
secure?


Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/ - Get our research, join our mailinglist


> ----- Original Message -----
> From: "@stake Advisories" <advisories@atstake.com>

> Subject: Mac OS X Long argv[] buffer overflow
> This is fixed in Mac OS X 10.3
<snip http://www.securityfocus.com/archive/1/342735/2003-10-25/2003-10-31/0>

> Mac OS X Systemic Insecure File Permissions
> This is fixed in Mac OS X 10.3
<snip http://www.securityfocus.com/archive/1/342725/2003-10-25/2003-10-31/0>

> Mac OS X Arbitrary File Overwrite via Core Files
> This is fixed in Mac OS X 10.3
<snip http://www.securityfocus.com/archive/1/342730/2003-10-25/2003-10-31/0>

[Joshua Levitsky]

----- Original Message -----
From: "Thor Larholm" <thor@pivx.com>
Sent: Tuesday, October 28, 2003 2:23 PM
Subject: Re: Mac OS X vulnerabilities


> When most vendors are notified of security vulnerabilities in their
products,
> they produce a patch for the affected versions of the software and
distribute it
> for free. Does Apple plan to distribute a free patch for these security
> vulnerabilities to Mac OS X 10.2, or will my clients have to spend $129
per
> workstation (the single user upgrade price) to have their Apple computer
stay
> secure?

This is the first line of the APPLE-SA-2003-10-28 Mac OS X 10.3 Panther
email sent to the Apple Security list today....

"Mac OS X 10.3 Panther has been released, and it contains the following
security enhancements:"

That sounds like they expect you to upgrade. Time will tell of course. Apple
has only had a real OS for about a year or so. (Everything before 10.2 was
unusable and certainly Mac OS 9.x was a childrens toy, not an OS.)

If Apple is responsible then we should see 10.2 patches backported. I think
it's reasonable that 10.3 patches come, and then 10.2 patches, and Apple
should have some Life Cycle policy to say if everything before 10.2 is EOL
or not. It's all a new world with Apple. Let us hope that they do not let us
down.

--
Joshua Levitsky, MCSE, CISSP
System Engineer
Time Inc. Information Technology
[5957 F27C 9C71 E9A7 274A 0447 C9B9 75A4 9B41 D4D1]

[James Kelly]

This vulnerability is much ado about nothing
It was caused by developers of shareware using third party installers
which changed the permissions on certain
directories of MacOS X.

Problem largely solved with the increased use of Apple's installer

AND

problem is easily fixed by adding this command to a root cron job.

diskutil repairpermissions /

Above command can be run every day for your paranoia protection ;-)


jamesk

[Radoslav Dejanovic]

On Wednesday 29 October 2003 02:30 am, Joshua Levitsky wrote:

> If Apple is responsible then we should see 10.2 patches backported. I thi=
nk
> it's reasonable that 10.3 patches come, and then 10.2 patches, and Apple
> should have some Life Cycle policy to say if everything before 10.2 is EOL
> or not. It's all a new world with Apple. Let us hope that they do not let
> us down.

As I mentioned to Thor in my previous e-mail (and got rejected by list admi=
n=20
because he thought I missed exactly that point), we should expect Apple=20
patching 10.2 as well, because it still hasn't reached its EOL. I don't thi=
nk=20
Apple wouldn't release a patch for 10.2 but instead tell their customers to=
=20
upgrade to 10.3. Such step is something that even Microsoft would fear of=
=20
doing. It means simply rejecting huge userbase, essentially telling them to=
=20
upgrade or be damned. No one with sane mind would do that, for it would lea=
d=20
to migrating to other platforms, and there's nothing on the server side tha=
t=20
Mac OS X can give and Linux or BSD can't (expect the price and some other=20
restrictions).=20
But, as you said, Apple is still new in this U*x business (but Steve isn't!=
=20
Remember NeXT!), but I'm sure they'll follow the business line of everyone=
=20
else. Their user base is too precious to them to be lost because of=20
arrogance.
=2D-=20
Radoslav Dejanovi=E6, founder and director
Operacijski sustavi d.o.o. http://www.opsus.hr

[Mike Stark]

Mac OS X Maintenance Agreements are available for clients and
servers. Since mac os 10.0 (before "X") apple has used paid upgrades
that addressed security updates, as the release point for the next
supported version of the OS.

I don't personally agree with this method of major patch/upgrade
but it has been in place at least a couple of years. This is not
"news" that MacOS users pay for major security update bundles. At
least they have the $200/5 user home bundle to make it more palatable
to home users. And the education list price for volume maintenance is
even better per copy. But you still pay.

Apple also releases the details of what was patched and provides
the tools to "roll your own" patches with the combination of
developer tools CD's & darwin or samba or SSH or whatever source
sites. We did our own patches at one period of time as an early
adopter of MacOS, (circa spring, 2001), rather than pay for the next
OS upgrade. If you are patching something like open SSH on solaris,
HP-UX, and IRIX already, compiling a new open SSH for OS X is not
much additional work once you get it down.

Mike

At 11:43 AM +0100 10/30/03, Radoslav Dejanovic wrote:
>On Wednesday 29 October 2003 02:30 am, Joshua Levitsky wrote:
>
>> If Apple is responsible then we should see 10.2 patches backported. I think
>> it's reasonable that 10.3 patches come, and then 10.2 patches, and Apple
>> should have some Life Cycle policy to say if everything before 10.2 is EOL
>> or not. It's all a new world with Apple. Let us hope that they do not let
>> us down.
>
>As I mentioned to Thor in my previous e-mail (and got rejected by list admin
>because he thought I missed exactly that point), we should expect Apple
>patching 10.2 as well, because it still hasn't reached its EOL. I don't think
>Apple wouldn't release a patch for 10.2 but instead tell their customers to
>upgrade to 10.3.

[gabriel rosenkoetter]

--UKNXkkdQCYZ6W5l3
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Oct 29, 2003 at 07:58:54PM -0500, James Kelly wrote:
> problem is easily fixed by adding this command to a root cron job.
>=20
> diskutil repairpermissions /
>=20
> Above command can be run every day for your paranoia protection ;-)

Actually, my paranoia protection says that that would be a REALLY
BAD IDEA.

I'm going to hazard a guess based on other posts here and figure
that that does either a straight shell call or at least the equivalent
of a find / -perm <something> -exec chmod <somethingelse> {} \;

This is a very small step away from a find <somewhere> [stuff] -exec
rm -rf, and it's a bad idea for all the same reasons that that is.

Automated cleanups (whether actually cleaning up files or just
cleaning up metadata) nearly always end up being race conditions and
should always be avoided. Scheduling ANYTHING as a superuser should
be treated with the utmost paranoia.

This is NOT a solution to the specific problem. Please, folks,
unless you wrote diskutil and know exactly what it's doing and how,
don't go out and do this on your systems.

More importantly, it's not a solution to the real problem here,
which has nothing to do with the specific permissions brokenness
on Mac OS X and everything to do with an inappropriate vendor
response.

Just like they did when they first started offering software updates
online but negelected to include one-way function results and
cryptographic signatures, Apple needs to admit they were wrong and
do something about it. I certainly hope that they do. Quickly.

--=20
gabriel rosenkoetter
gr@eclipsed.net

--UKNXkkdQCYZ6W5l3
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (NetBSD)

iD8DBQE/oXFF9ehacAz5CRoRAlywAJ97YWVHbY1FbxkvAAIaLAUR7dAl5Q CdHgap
PSToAyuAYmeJle+hwRAxD+s=
=HBlr
-----END PGP SIGNATURE-----

--UKNXkkdQCYZ6W5l3--

[gabriel rosenkoetter]

--NOl3kBTBh+CNLogO
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

[Moderator: I'd say don't bother approving this message, especially
since this argument misses the important point here. Only but I
can't figure out why you approved the one that I'm replying to,
which seems to be suggesting that people go ahead and do something
that I'm pretty sure I'm right in saying that they shouldn't, so...]

On Thu, Oct 30, 2003 at 01:47:51PM -0700, Lyndon Nerenberg wrote:
> On Thursday, October 30, 2003 3:15 PM -0500 gabriel rosenkoetter wrote:
> > find / -perm <something> -exec chmod <somethingelse> {} \;
> No, it's much closer to an 'mtree -U'. Do a 'man diskutil' for details.

And this makes it not be a race condition how, precisely?

I don't have a Mac OS X machine handy, or I would have read the
manual... but I am sitting in front of a NetBSD machine and have
used that operating system quite a bit, so I feel quite comfortable
saying: you should never, ever schedule an mtree -U as root either.

--=20
gabriel rosenkoetter
gr@eclipsed.net

--NOl3kBTBh+CNLogO
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (NetBSD)

iD8DBQE/oXwn9ehacAz5CRoRAggQAJwKB79jpQun0Q3rLoaCxWt5DZ0Cgg CdFRBU
c9tW7eN+uPnuFXtuYBDYTUo=
=Qo6o
-----END PGP SIGNATURE-----

--NOl3kBTBh+CNLogO--

[Lyndon Nerenberg]

--==========0A94B6193AEE66F19D44==========
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

--On Thursday, October 30, 2003 3:15 PM -0500 gabriel rosenkoetter=20
<gr@eclipsed.net> wrote:

> I'm going to hazard a guess based on other posts here and figure
> that that does either a straight shell call or at least the equivalent
> of a find / -perm <something> -exec chmod <somethingelse> {} \;

No, it's much closer to an 'mtree -U'. Do a 'man diskutil' for details.

--lyndon


--==========0A94B6193AEE66F19D44==========
Content-Type: application/pgp-signature
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: Mulberry PGP Plugin v3.0
Comment: processed by Mulberry PGP Plugin

iQA/AwUBP6F4+YjLp6cLfB87EQJrfwCgsJ2dZV2XfGOcBPB8ILXJwW dNYVYAn2mN
RrEzpkDg6NHFk4/2InmBxxdc
=idJi
-----END PGP SIGNATURE-----

--==========0A94B6193AEE66F19D44==========--