Apple updates Leopard, issues 68 fixes

But it doesn't patch three iCal security bugs

More than three months after it last updated Mac OS X, Apple Wednesday released 10.5.3, an upgrade for its Leopard operating system that boasts nearly 70 stability, compatibility and security improvements and fixes.

Apple did not include patches for several iCal vulnerabilities in the update, however.

Mac OS X 10.5.3, the third upgrade to Leopard since Apple launched the current in October 2007, addresses issues in several components and bundled applications, ranging from the Address Book and Automator to Time Machine and VoiceOver.

Apple also listed a baker's dozen under a "General" category that included a fix for hard drives that wouldn't show in the Finder; an improvement in Spotlight, the OS's built-in search tool, for searches done on AFP volumes; and a patch for stuttering audio and video playback from certain USB-based hardware.

AirPort, Apple's label for its wireless technology, got a pair of fixes: one to improve wireless reliability in general, the other to boost reliability when used with the company's relatively new Time Capsule router-cum-backup-device that debuted earlier this year.

iChat, the Mac OS's bundled instant messaging and video conferencing application, received five fixes; Mail, Apple's own e-mail client, got 10; and Time Machine was the target of seven.

The Time Machine fixes, said Apple, resolve issues when backing up a notebook running on battery power, and address a reliability problem some users have encountered when restoring from a Time Machine backup.

Apple also tucked eight fixes for iCal, its personal scheduling program, into the 10.5.3 update, but did not patch the three security vulnerabilities disclosed a week ago by Core Security Technologies.

The three iCal bugs, which were reported to Apple in January 2008, were revealed last Wednesday by Core after it had repeatedly been asked by Apple to delay publishing its findings. Core decided to unveil the vulnerabilities after Apple again postponed its patches.

"No vendor moves as fast as the vulnerability researcher wants them to," said Andrew Storms, director of security operations at nCircle Network Security.

Storms refused to blame either side. "It generally takes a major vendor, like Microsoft or Apple, about six to eight months to get a patch released," he said. "But Core had every right to push the vendor into delivering the patch."

In a follow-on interview last week, Ivan Arce, Core Technologies' chief technology officer, said that the current version of iCal is vulnerable to the flaws, one of which he considered critical. But his team had not found evidence of any in-the-wild attacks trying to trigger the iCal vulnerabilities.

"It wouldn't take a whole lot of reverse engineering to figure this out," Storms said, referring to the ease with which attackers would be able to put two and two together from Core's disclosures. "It's a valid concern," he added. "The moment you click on a malformed .ics file, you're done."

Apple has not responded to e-mails asking when it would patch the iCal vulnerabilities.

Mac OS X 10.5.3 can be downloaded manually from the Apple site, or retrieved and installed using Mac OS X's integrated update feature.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?