Onderwerp: Re: Mac OS X vulnerabilities ['Virus checked"]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

All this issue depends on how suspicious you are really.

One could say that @stake waited till Panther 10.3 came out to release
the Security alert and therefore push the sales of the new system. Or
you could argue that it was an unlucky coincidence that with the new
release there were quite a few security bugs apearing.

So apple might have had to make a decision as to how the path work has
to be done, and in all the hectic some things must have gone "wrong"
e.g. no mentions about fixing 10.2 and so on.

Anyway, I do hope that Apple is going to patch 10.2 and I think they
will, they went the *nix/"OpenSource" way so now they have to walk the
route and adapt the philosophy that comes with it.

Greets,

Steve Clement


graham.coles@retail-logic.com wrote:
| Thor,
|
| Sorry, I hadn't read the vendor response section of the advisories fully,
| I'd rather assumed they would be issuing a security update for 10.2 as
| per usual.
|
| I'd have to agree it's a pretty poor showing from Apple if the only fix is
| to
| buy the next version of the operating system. I believe Microsoft are
about
| to stop patching Windows Me shortly (which has been around for a few years
| now) and usually support the current and previous service pack of an OS.
|
| If Apple are only going to support the most recent version of OS X - which
| equates to about 12 months lifetime, as I believe they're planning a major
| new release each year - then it's going to be either difficult or
expensive
| to
| keep secure.
|
| Given the current climate with regards to security, I don't think they're
| doing
| themselves any favours if they take this route. I hope they'll reconsider
| if this
| is their policy.
|



- --
ION Network Solutions
Steve Clement
Unix System Administrator
13, rue des Ardennes
L-1133 Luxembourg
Tel: +352 261 276-2
Fax: +352 261 276-9
mailto:steve@ion.lu
http://www.ion.lu
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQE/n/ZvMH8DIBsiCrgRAufQAJ4x1RK9dj+Dcf878VsMkov6dRONnQCf Y1y2
oRrsmJ23reT2w4SjmPqh1Z4=
=X8y+
-----END PGP SIGNATURE-----

Thor,

Sorry, I hadn't read the vendor response section of the advisories fully,
I'd rather assumed they would be issuing a security update for 10.2 as
per usual.

I'd have to agree it's a pretty poor showing from Apple if the only fix is
to
buy the next version of the operating system. I believe Microsoft are about
to stop patching Windows Me shortly (which has been around for a few years
now) and usually support the current and previous service pack of an OS.

If Apple are only going to support the most recent version of OS X - which
equates to about 12 months lifetime, as I believe they're planning a major
new release each year - then it's going to be either difficult or expensive
to
keep secure.

Given the current climate with regards to security, I don't think they're
doing
themselves any favours if they take this route. I hope they'll reconsider
if this
is their policy.

Regards,

Graham Coles




"Thor Larholm"
<thor@pivx.com> To: <graham.coles@retail-logic.com>, <bugtraq@securityfocus.com>
cc:
29/10/2003 10:25 Subject: RE: Mac OS X vulnerabilities ['Virus checked"]






Graham,

Thank you for the feedback.

I can't locate any new patches or updates through the software update tool
on our 10.2 systems, and Apples security site (which I now received the URL
to) mentions nothing about these security updates for OS X 10.2

The only way for any Mac OS X 10.2 user to stay secure is to pay Apple for
an upgrade to Mac OS X 10.3, there are simply no patches for these
vulnerabilities in 10.2 even though 10.2 is affected.


Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/ - Get our research, join our mailinglist

-----Original Message-----
From: graham.coles@retail-logic.com [mailto:graham.coles@retail-logic.com]
Sent: Wed 10/29/2003 2:14 AM
To: bugtraq@securityfocus.com; Thor Larholm
Cc:
Subject: Re: Mac OS X vulnerabilities ['Virus checked"]




I usually download main updates (10.2.8) and security patches from
http://www.apple.com/downloads/macosx/apple

There's also an automated update from within OS X which will check
for and install patches automatically.

These are non-chargeable updates, I believe the price you quote is
for a single user copy of Mac OS X.

Regards,

Graham Coles





"Thor Larholm"
<thor@pivx.com> To: "@stake
Advisories" <advisories@atstake.com>,
<bugtraq@securityfocus.com>
cc:
<product-security@apple.com>
28/10/2003 19:23 Subject: Re: Mac OS X
vulnerabilities ['Virus checked"]






I couldn't find any security contacts on apple.com that didn't look
fee-based so
I am asking here in response to these latest disclosures of security
vulnerabilities in Mac OS X.

When most vendors are notified of security vulnerabilities in their
products,
they produce a patch for the affected versions of the software and
distribute it
for free. Does Apple plan to distribute a free patch for these security
vulnerabilities to Mac OS X 10.2, or will my clients have to spend $129
per
workstation (the single user upgrade price) to have their Apple computer
stay
secure?


Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/ - Get our research, join our mailinglist


> ----- Original Message -----
> From: "@stake Advisories" <advisories@atstake.com>

> Subject: Mac OS X Long argv[] buffer overflow
> This is fixed in Mac OS X 10.3
<snip
http://www.securityfocus.com/archive...5/2003-10-31/0
>

> Mac OS X Systemic Insecure File Permissions
> This is fixed in Mac OS X 10.3
<snip
http://www.securityfocus.com/archive...5/2003-10-31/0
>

> Mac OS X Arbitrary File Overwrite via Core Files
> This is fixed in Mac OS X 10.3
<snip
http://www.securityfocus.com/archive...5/2003-10-31/0
>

I usually download main updates (10.2.8) and security patches from
http://www.apple.com/downloads/macosx/apple

There's also an automated update from within OS X which will check
for and install patches automatically.

These are non-chargeable updates, I believe the price you quote is
for a single user copy of Mac OS X.

Regards,

Graham Coles





"Thor Larholm"
<thor@pivx.com> To: "@stake Advisories" <advisories@atstake.com>, <bugtraq@securityfocus.com>
cc: <product-security@apple.com>
28/10/2003 19:23 Subject: Re: Mac OS X vulnerabilities ['Virus checked"]






I couldn't find any security contacts on apple.com that didn't look
fee-based so
I am asking here in response to these latest disclosures of security
vulnerabilities in Mac OS X.

When most vendors are notified of security vulnerabilities in their
products,
they produce a patch for the affected versions of the software and
distribute it
for free. Does Apple plan to distribute a free patch for these security
vulnerabilities to Mac OS X 10.2, or will my clients have to spend $129 per
workstation (the single user upgrade price) to have their Apple computer
stay
secure?


Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/ - Get our research, join our mailinglist


> ----- Original Message -----
> From: "@stake Advisories" <advisories@atstake.com>

> Subject: Mac OS X Long argv[] buffer overflow
> This is fixed in Mac OS X 10.3
<snip http://www.securityfocus.com/archive...5/2003-10-31/0
>

> Mac OS X Systemic Insecure File Permissions
> This is fixed in Mac OS X 10.3
<snip http://www.securityfocus.com/archive...5/2003-10-31/0
>

> Mac OS X Arbitrary File Overwrite via Core Files
> This is fixed in Mac OS X 10.3
<snip http://www.securityfocus.com/archive...5/2003-10-31/0
>

On Wed, Oct 29, 2003 at 06:18:40PM +0100, Steve Clement wrote:
| -----BEGIN PGP SIGNED MESSAGE-----
| Hash: SHA1
|
| All this issue depends on how suspicious you are really.
|
| One could say that @stake waited till Panther 10.3 came out to release
| the Security alert and therefore push the sales of the new system. Or
| you could argue that it was an unlucky coincidence that with the new
| release there were quite a few security bugs apearing.

@Stake is being pretty up front that they are moving far away from
full-disclosure. Weld has been up-front and vocal about this shift
and the reasons for it.

It seems fairly clear that DaveG reported these issues to Apple (along
with many others over the past while), and for this subset of the
DaveG issues, Apple said "these are complex to fix, we'll get to them in
the next major release."

Which is roughly where we were 10 years ago in some ways: Vendors got
bug reports, and as much time as they wanted to fix the issues. If
there's independent rediscovery of issues (and I think for some of
these, that's likely), then customers are SOL as the issues are
exploited. On the plus side, 10 years ago, vendors might have said
"fixed security issues," without enumeration or acknowledgment. So
that's improved.

I think that announcing a set of security issues, and saying "the fix
is to upgrade your entire OS" is not a great disclosure strategy. If
that's @Stake's new plan, I would give the new OS 30-90 days before
making the announcements. But I believe that the general risk of
independent discovery of issues is substantial enough that this sort
of long delay from discovery to fix is a poor practice, and one that
we as an industry had been moving away from.

Adam

--
"It is seldom that liberty of any kind is lost all at once."
-Hume

R3JhaGFtLA0KIA0KVGhhbmsgeW91IGZvciB0aGUgZmVlZGJhY2 suDQogDQpJIGNhbid0IGxvY2F0
ZSBhbnkgbmV3IHBhdGNoZXMgb3IgdXBkYXRlcyB0aHJvdWdoIH RoZSBzb2Z0d2FyZSB1cGRhdGUg
dG9vbCBvbiBvdXIgMTAuMiBzeXN0ZW1zLCBhbmQgQXBwbGVzIH NlY3VyaXR5IHNpdGUgKHdoaWNo
IEkgbm93IHJlY2VpdmVkIHRoZSBVUkwgdG8pIG1lbnRpb25zIG 5vdGhpbmcgYWJvdXQgdGhlc2Ug
c2VjdXJpdHkgdXBkYXRlcyBmb3IgT1MgWCAxMC4yDQogDQpUaG Ugb25seSB3YXkgZm9yIGFueSBN
YWMgT1MgWCAxMC4yIHVzZXIgdG8gc3RheSBzZWN1cmUgaXMgdG 8gcGF5IEFwcGxlIGZvciBhbiB1
cGdyYWRlIHRvIE1hYyBPUyBYIDEwLjMsIHRoZXJlIGFyZSBzaW 1wbHkgbm8gcGF0Y2hlcyBmb3Ig
dGhlc2UgdnVsbmVyYWJpbGl0aWVzIGluIDEwLjIgZXZlbiB0aG 91Z2ggMTAuMiBpcyBhZmZlY3Rl
ZC4NCiANCiANClJlZ2FyZHMNClRob3IgTGFyaG9sbQ0KUGl2WC BTb2x1dGlvbnMsIExMQyAtIFNl
bmlvciBTZWN1cml0eSBSZXNlYXJjaGVyDQpodHRwOi8vcGl2eC 5jb20vbGFyaG9sbS8gLSBHZXQg
b3VyIHJlc2VhcmNoLCBqb2luIG91ciBtYWlsaW5nbGlzdA0KDQ oJLS0tLS1PcmlnaW5hbCBNZXNz
YWdlLS0tLS0gDQoJRnJvbTogZ3JhaGFtLmNvbGVzQHJldGFpbC 1sb2dpYy5jb20gW21haWx0bzpn
cmFoYW0uY29sZXNAcmV0YWlsLWxvZ2ljLmNvbV0gDQoJU2VudD ogV2VkIDEwLzI5LzIwMDMgMjox
NCBBTSANCglUbzogYnVndHJhcUBzZWN1cml0eWZvY3VzLmNvbT sgVGhvciBMYXJob2xtIA0KCUNj
OiANCglTdWJqZWN0OiBSZTogTWFjIE9TIFggdnVsbmVyYWJpbG l0aWVzIFsnVmlydXMgY2hlY2tl
ZCJdDQoJDQoJDQoNCg0KCUkgdXN1YWxseSBkb3dubG9hZCBtYW luIHVwZGF0ZXMgKDEwLjIuOCkg
YW5kIHNlY3VyaXR5IHBhdGNoZXMgZnJvbQ0KCWh0dHA6Ly93d3 cuYXBwbGUuY29tL2Rvd25sb2Fk
cy9tYWNvc3gvYXBwbGUNCgkNCglUaGVyZSdzIGFsc28gYW4gYX V0b21hdGVkIHVwZGF0ZSBmcm9t
IHdpdGhpbiBPUyBYIHdoaWNoIHdpbGwgY2hlY2sNCglmb3IgYW 5kIGluc3RhbGwgcGF0Y2hlcyBh
dXRvbWF0aWNhbGx5Lg0KCQ0KCVRoZXNlIGFyZSBub24tY2hhcm dlYWJsZSB1cGRhdGVzLCBJIGJl
bGlldmUgdGhlIHByaWNlIHlvdSBxdW90ZSBpcw0KCWZvciBhIH NpbmdsZSB1c2VyIGNvcHkgb2Yg
TWFjIE9TIFguDQoJDQoJUmVnYXJkcywNCgkNCglHcmFoYW0gQ2 9sZXMNCgkNCgkNCgkNCgkNCgkg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC AgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC AgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgIA0KCSAgICAgICAgICAgICAgIC AgICAgICAiVGhvciBMYXJob2xt
IiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC AgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC AgICAgDQoJICAgICAgICAgICAg
ICAgICAgICAgIDx0aG9yQHBpdnguY29tPiAgICAgICAgICBUbz ogICAgICAgIkBzdGFrZSBBZHZp
c29yaWVzIiA8YWR2aXNvcmllc0BhdHN0YWtlLmNvbT4sIDxidW d0cmFxQHNlY3VyaXR5Zm9jdXMu
Y29tPiAgICANCgkgICAgICAgICAgICAgICAgICAgICAgICAgIC AgICAgICAgICAgICAgICAgICAg
IGNjOiAgICAgICA8cHJvZHVjdC1zZWN1cml0eUBhcHBsZS5jb2 0+ICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA0KCSAgIC AgICAgICAgICAgICAgICAgICAy
OC8xMC8yMDAzIDE5OjIzICAgICAgICAgU3ViamVjdDogIFJlOi BNYWMgT1MgWCB2dWxuZXJhYmls
aXRpZXMgWydWaXJ1cyBjaGVja2VkIl0gICAgICAgICAgICAgIC AgICAgICAgICAgICAgICAgDQoJ
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC AgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC AgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICANCgkgICAgICAgICAgICAgIC AgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC AgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC AgICAgIA0KCQ0KCQ0KCQ0KCQ0K
CUkgY291bGRuJ3QgZmluZCBhbnkgc2VjdXJpdHkgY29udGFjdH Mgb24gYXBwbGUuY29tIHRoYXQg
ZGlkbid0IGxvb2sNCglmZWUtYmFzZWQgc28NCglJIGFtIGFza2 luZyBoZXJlIGluIHJlc3BvbnNl
IHRvIHRoZXNlIGxhdGVzdCBkaXNjbG9zdXJlcyBvZiBzZWN1cm l0eQ0KCXZ1bG5lcmFiaWxpdGll
cyBpbiBNYWMgT1MgWC4NCgkNCglXaGVuIG1vc3QgdmVuZG9ycy BhcmUgbm90aWZpZWQgb2Ygc2Vj
dXJpdHkgdnVsbmVyYWJpbGl0aWVzIGluIHRoZWlyDQoJcHJvZH VjdHMsDQoJdGhleSBwcm9kdWNl
IGEgcGF0Y2ggZm9yIHRoZSBhZmZlY3RlZCB2ZXJzaW9ucyBvZi B0aGUgc29mdHdhcmUgYW5kDQoJ
ZGlzdHJpYnV0ZSBpdA0KCWZvciBmcmVlLiBEb2VzIEFwcGxlIH BsYW4gdG8gZGlzdHJpYnV0ZSBh
IGZyZWUgcGF0Y2ggZm9yIHRoZXNlIHNlY3VyaXR5DQoJdnVsbm VyYWJpbGl0aWVzIHRvIE1hYyBP
UyBYIDEwLjIsIG9yIHdpbGwgbXkgY2xpZW50cyBoYXZlIHRvIH NwZW5kICQxMjkgcGVyDQoJd29y
a3N0YXRpb24gKHRoZSBzaW5nbGUgdXNlciB1cGdyYWRlIHByaW NlKSB0byBoYXZlIHRoZWlyIEFw
cGxlIGNvbXB1dGVyDQoJc3RheQ0KCXNlY3VyZT8NCgkNCgkNCg lSZWdhcmRzDQoJVGhvciBMYXJo
b2xtDQoJUGl2WCBTb2x1dGlvbnMsIExMQyAtIFNlbmlvciBTZW N1cml0eSBSZXNlYXJjaGVyDQoJ
aHR0cDovL3BpdnguY29tL2xhcmhvbG0vIC0gR2V0IG91ciByZX NlYXJjaCwgam9pbiBvdXIgbWFp
bGluZ2xpc3QNCgkNCgkNCgk+IC0tLS0tIE9yaWdpbmFsIE1lc3 NhZ2UgLS0tLS0NCgk+IEZyb206
ICJAc3Rha2UgQWR2aXNvcmllcyIgPGFkdmlzb3JpZXNAYXRzdG FrZS5jb20+DQoJDQoJPiBTdWJq
ZWN0OiBNYWMgT1MgWCBMb25nIGFyZ3ZbXSBidWZmZXIgb3Zlcm Zsb3cNCgk+IFRoaXMgaXMgZml4
ZWQgaW4gTWFjIE9TIFggMTAuMw0KCTxzbmlwIGh0dHA6Ly93d3 cuc2VjdXJpdHlmb2N1cy5jb20v
YXJjaGl2ZS8xLzM0MjczNS8yMDAzLTEwLTI1LzIwMDMtMTAtMz EvMA0KCT4NCgkNCgk+IE1hYyBP
UyBYIFN5c3RlbWljIEluc2VjdXJlIEZpbGUgUGVybWlzc2lvbn MNCgk+IFRoaXMgaXMgZml4ZWQg
aW4gTWFjIE9TIFggMTAuMw0KCTxzbmlwIGh0dHA6Ly93d3cuc2 VjdXJpdHlmb2N1cy5jb20vYXJj
aGl2ZS8xLzM0MjcyNS8yMDAzLTEwLTI1LzIwMDMtMTAtMzEvMA 0KCT4NCgkNCgk+IE1hYyBPUyBY
IEFyYml0cmFyeSBGaWxlIE92ZXJ3cml0ZSB2aWEgQ29yZSBGaW xlcw0KCT4gVGhpcyBpcyBmaXhl
ZCBpbiBNYWMgT1MgWCAxMC4zDQoJPHNuaXAgaHR0cDovL3d3dy 5zZWN1cml0eWZvY3VzLmNvbS9h
cmNoaXZlLzEvMzQyNzMwLzIwMDMtMTAtMjUvMjAwMy0xMC0zMS 8wDQoJPg0KCQ0KCQ0KCQ0KCQ0K
CQ0KCQ0KDQo=

--On den 29 oktober 2003 13:03 -0500 Adam Shostack <adam@homeport.org>
wrote:

> I think that announcing a set of security issues, and saying "the fix
> is to upgrade your entire OS" is not a great disclosure strategy.

I certainly agree here, as do we all, I think. Let me just again
point out that we don't know yet if this is what they say.

All of you who care, please show them that you do.
Either register for a developer account (free) and send
a bug report on <http://bugreport.apple.com>, or send an
email to product-security@apple.com.

/ragge

In-Reply-To: <20031029180349.GA85446@lightship.internal.homepor t.org>


@stake's policy has been the same since June, 2002 which was its last revision. Our policy is in line with the OIS guidelines. Assuming Mac OS X 10.2 is supported, Apple is not following the OIS guidelines which require a vendor to release a remedy for
*all supported platforms* and to make an effort to deliver them simultaneously.


From: http://www.oisafety.org/reference/process.pdf

7.1.4

The Vendor shall ensure that a remedy is available for all supported products affected by the Flaw

7.3.9

If multiple products or versions are affected by the Flaw, the Vendor shall exercise reasonable efforts to simultaneously deliver all remedies.


It may come as a surprise to many people on the list that the OIS guidelines require/recommend vendors to do a lot of things that many vendors do not do now and are very good for customers.

When we reported these issues to Apple they told us that they would have them fixed in the Panther release timeframe. To be honest, I assumed there would also be a patch for 10.2. We certainly didn't dictate any specific way of releasing the fixes.

The DMG file issue was reported in June, 2003 and the core overwrite issue was reported on 7/25/2003. I don't have a recorded notification date for the long argv issue.

Whether or not a vendor makes a customer pay for a security remedy is a business decision but they should make it clear that they are not supporting older versions if they are not releasing free patches for them. I think security fixes should be separate
from feature updates since new features often introduce new vulnerabilies.

Cheers,

Chris



> Adam Shostack wrote:
>
>@Stake is being pretty up front that they are moving far away from
>full-disclosure. Weld has been up-front and vocal about this shift
>and the reasons for it.
>
>It seems fairly clear that DaveG reported these issues to Apple (along
>with many others over the past while), and for this subset of the
>DaveG issues, Apple said "these are complex to fix, we'll get to them in
>the next major release."
>
>Which is roughly where we were 10 years ago in some ways: Vendors got
>bug reports, and as much time as they wanted to fix the issues. If
>there's independent rediscovery of issues (and I think for some of
>these, that's likely), then customers are SOL as the issues are
>exploited. On the plus side, 10 years ago, vendors might have said
>"fixed security issues," without enumeration or acknowledgment. So
>that's improved.
>
>I think that announcing a set of security issues, and saying "the fix
>is to upgrade your entire OS" is not a great disclosure strategy. If
>that's @Stake's new plan, I would give the new OS 30-90 days before
>making the announcements. But I believe that the general risk of
>independent discovery of issues is substantial enough that this sort
>of long delay from discovery to fix is a poor practice, and one that
>we as an industry had been moving away from.
>
>Adam
>
>--
>"It is seldom that liberty of any kind is lost all at once."
> -Hume
>
>
>

At 7:52 PM +0100 10/29/03, Ragnar Sundblad wrote:
>--On den 29 oktober 2003 13:03 -0500 Adam Shostack <adam@homeport.org> wrote:
>
>>I think that announcing a set of security issues, and saying "the fix
>>is to upgrade your entire OS" is not a great disclosure strategy.
>
>I certainly agree here, as do we all, I think. Let me just again
>point out that we don't know yet if this is what they say.
>
>All of you who care, please show them that you do.
>Either register for a developer account (free) and send
>a bug report on <http://bugreport.apple.com>, or send an
>email to product-security@apple.com.
>
>/ragge


As an OSX admin I am with you all on this. Here's another place to
speak up. This is the link from the icon in the OSX Dock.

<http://www.apple.com/macosx/feedback/>

I'm hoping they're in the process of doing the right thing and just
haven't announced it yet. The wording of Apple's security
announcement did make me wonder though.


Kurt