Apple fixes Flash snafu in Snow Leopard, patches 33 bugs in Leopard

Mac users get third and fourth updates this week, but Safari may be next, says researcher

Less than two weeks after Apple launched Snow Leopard, the company today issued the new operating system's first security update. In a separate upgrade, Apple patched 33 vulnerabilities in 2007's Leopard, and about half as many in the even older Tiger.

Today's updates were the third and fourth from Apple in the last two days. Wednesday, Apple delivered security fixes for the iPhone and iPod Touch, as well as another upgrade for its QuickTime media player.

"It's another sneak attack," said Andrew Storms, director of security operations at nCircle Network Security, referring to the string of updates. "Actually, it's almost what we've come to expect from Apple," he added.

Unlike rival OS maker Microsoft, which releases most of its security upgrades on a pre-set monthly schedule, Apple ships its patches whenever they're ready to go out the door.

The Snow Leopard 10.6.1 update's security content consisted solely of an upgrade for Adobe's Flash Player, which was bumped to the up-to-date version

Users and security researchers had taken Apple to task for not only shipping Snow Leopard with an outdated and vulnerable version of Flash Player, but also for silently "downgrading" once-secure editions when Macs were updated to the new operating system.

Mac OS X 10.6.1 packaged nine patches for Flash vulnerabilities, some of which could result in "arbitrary code execution," Apple-speak of a critical flaw that attackers could exploit to grab control of a Mac.

According to the corresponding Adobe security advisory, six of the nine flaws could be considered critical.

Apple released the first update for Snow Leopard less than two weeks after it debuted the operating system on Aug. 28, a slightly faster pace than in 2007, when Apple took about three weeks to issue the first security update for Mac OS X 10.5, aka Leopard.

Adobe updated Flash Player to in late July to plug a dozen vulnerabilities, including three inherited from flawed Microsoft development code -- obviously, those were not present in the Mac version -- and one that hackers had been exploiting for at least a week, which did apply to the Mac.

"Having to release a whole OS update just to patch one third-party component, that's a bit heavy-handed," said Storms. "Apple had to go through one whole engineering cycle to fix Flash."

As if to echo Storms' point, Apple noted that the 10.6.1 update -- which admittedly includes fixes for eight non-security issues -- tipped the scale at 75MB.

The Security Update 2009-005 for Leopard and Tiger was more traditional, patching 33 vulnerabilities in the former and 16 in the latter. Of the 33 bugs in Mac OS X 10.5, Leopard, 23 were tagged with Apple's "arbitrary code execution" phrase; 14 of the 16 flaws in Tiger were pegged the same way.

Among the components patched in 2009-005 were ClamAV, the open-source antivirus scanner bundled with Apple's server software; CoreGraphics; the Apple-developed-but-open-source CUPS printing system; Launch Services; MySQL; the PHP scripting language; and SMB (Server Message Block), the file- and print-sharing protocol Macs use to access Windows-based networks.

Two of the vulnerabilities could be triggered by duping users into visiting rigged Web sites, said Apple, while a number of others, including flaws in ColorSync, CoreGraphics and ImageIO, could be exploited by attackers who serve up malformed image, PDF or PixarFilm-encoded TIFF formatted files.

Storms focused on the six patches for PHP, which updated Leopard's version of the scripting language to 5.2.10. "PHP [5.2.10] was released in June," Storms said. "Apple either needs to close this [time] loophole, or distance itself from bundling third-party and open-source components."

Apple has taken heat, from Storms as well as other security experts, for its sometimes-sluggish pace of rolling third-party updates into its operating system. It took Apple until mid-May, for example, to include Flash Player, the version Adobe released in late February, with a Leopard security upgrade.

Also included in the Mac OS 10.6.1 update were at least eight fixes for non-security bugs, Apple said in a separate support document. Among them was one that "addresses an issue in which some printer compatibility drivers might not appear properly in the Add Printer browser," said Apple.

The company today pushed out an additional update that boosted the number of Hewlett-Packard printer drivers.

Both were in reaction to complaints by users that they weren't able to operate some HP printers after upgrading to Snow Leopard.

Storms said it was possible that today's updates weren't the last for the week.

"They've updated the iPhone, QuickTime and OS X. A new iTunes has just come out, and it's likely there were some fixes in that, too. The only thing that's left is Safari," he said, noting that Apple's browser has been patched every month since May, each time in the first or second week of the month.

Mac OS X 10.6.1, the 2009-005 security update and the updated HP printer drivers can be downloaded from the Apple site or installed using the Mac's integrated update service.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags AppleflashMac OS Xmac bugssnow leopard

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments





Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?