there have been low-key security patches in the past, but this one seems pretty extreme.
sad but true.
ARTICLE: http://www.eweek.com/article2/0,1759,1598258,00.asp
PANTHER PATCH DL: http://www.apple.com/support/downloads/sec...4_(10_3_3).html
in addition, here's another short piece about Apple slowing its update release schedule: http://www.eweek.com/article2/0,1759,1594943,00.asp
------------------------
Topic tagged.
-Pe7er
repent sinners? Someone's acting extreme.
There's lots of serious flaws in the OSX design. They basically borked up parts of the UNIX security model (I've given a whole rant on this before).
Still, you'll notice that the flaw only lets an attacker delete the users HOME directory. If this were Windows, it could delete your whole harddrive/install itself.
This is a remote user exploit, not a remote root exploit, which is VERY serious, and which Windows (and other OSs) have quite a few of.
Originally posted by contrasutra@May 23 2004, 07:02 PM[...]
Still, you'll notice that the flaw only lets an attacker delete the users HOME directory. If this were Windows, it could delete your whole harddrive/install itself.
[...]
That all depends on whether you run as an adminstrator or not...
I fail to see how a user exploit could delete, for example, the contents of %WINDIR%, when I can't even do that manually...
Ji quit worrying about security crap and get the kdx server up :canadian: 
:canadian: :canadian:
Are these security updates supposed to show in the Software Update program? Because I dont see them 
.
Yea, with my mac asking me to sudo every other operation I try on it.
The weird thing about windows is it refuses to let me delete the C:|Windows directory, but if I use some kind of trojan i could, lol.
It's just scary. The idea that by visiting some malicious webpage I could lose my home directory!?!? Jeepers. I happily updated last night to 10.3.3. Just run the Software Update prog, n3rotic, from the apple menu.
Oh i guess since I updated to 10.3.3 long time ago I'm safe eh? ;-)
I'd download the patch cause it was released last night (Japan time).
Additional note; The security fix doesn't actually fix all of the (related) holes. A few sites recommend you download Paranoid Android (by Unsanity, updated to 1.1 today/yesterday I think) which fixes all the talked about issues.
Although it does go a little overboard.. It asks for permission to create new iChat windows/conversations..
Originally posted by Stevie BM@May 23 2004, 03:11 PMThat all depends on whether you run as an adminstrator or not...
I fail to see how a user exploit could delete, for example, the contents of %WINDIR%, when I can't even do that manually...
Of course.
But in all seriousness, what percent of *nix users are running as root, compared to Windows users?
How many Windows programs (especially ones most people have, like Norton AV) require you to run as root?
When was the last time a Windows program warned you about running as root? Especially a P2P program or alike. If I were to try and run B1tchX (a *nix IRC client) as root, it would pop up a warning saying "you're an idiot for running this as root". These are VERY different worlds. 
Not to mention OSX uses sudo, so a mac user NEVER has to run as root, they just need to enter their password. Most windows programs require you to actually run as root.
Originally posted by contrasutra+May 24 2004, 09:27 PM-->QUOTE(contrasutra @ May 24 2004, 09:27 PM)[...]Not a high enough percent of Windows users?But in all seriousness, what percent of *nix users are running as root, compared to Windows users?
Far too many. None that I write, thoughOriginally posted by contrasutra@May 24 2004, 09:27 PMHow many Windows programs (especially ones most people have, like Norton AV) require you to run as root?
Excluding Windows itself, and my own apps, none.Originally posted by contrasutra@May 24 2004, 09:27 PMWhen was the last time a Windows program warned you about running as root?
Originally posted by Stevie BM@May 24 2004, 08:34 PMThat's another one of my quests - to bully Windows users and developers to not accept this idiocy.
Amen! Winamp, of all things, requires write access to it's own directory. Screw that. My parents' PC has been such a nightmare because since reformatting it and putting XP on it (had 2000) I REFUSE to give them admin priviliges. The stupid weather.com applet needs write access to it's own directory as well >.<
is it me or are the security updates appearing faster and faster?
Originally posted by mgleason007@Jun 9 2004, 06:00 PMAmen! Winamp, of all things, requires write access to it's own directory. Screw that. My parents' PC has been such a nightmare because since reformatting it and putting XP on it (had 2000) I REFUSE to give them admin priviliges. The stupid weather.com applet needs write access to it's own directory as well >.<
There's a big difference between write access and ADMIN.
Apps like the weather.com thing need write access to update app specific data.
They do not have to be an admin to do this... any USER can have write access.
Just make sure they do not have FULL CONTROL.
Typical Windows apps usualy only require read/write/execute from their own directory.
Occasionaly they will also require modify permissions.
The reality is on a default install of Windows XP, the EVERYONE group has FULL CONTROL of a ton of directories it shouldn't.
So just because you limit admin access does not mean you are any safer.
The EVERYONE group is any user, authenticated or not.
I replace EVERYONE with AUTHENTICATED USERS at a minimum and disable any guest or anonyomous accounts like GUEST and ASPNET.
I don't give ADMIN priviledges to my wife on her computer, but she does have sufficient and carefuly crafted rights so that she can run her applications without issue.
The only thing she really can't do is install anything that writes to the system registry (HKLM, HKCR, HKU or HKCC), %SYSTEM ROOT% or %WINDIR%.
She can write info to HKCU because it only affects her ID.
Look at programs like CACLS or XCACLS to do system wide ACL changes to the directory structure of your PC. Part of the Resource Kit.
Really a much faster and more efficient way to manage file permissions.
Originally posted by rjohnstone@Jun 10 2004, 05:29 PM[...]
The reality is on a default install of Windows XP, the EVERYONE group has FULL CONTROL of a ton of directories it shouldn't.
So just because you limit admin access does not mean you are any safer.
The EVERYONE group is any user, authenticated or not.
I replace EVERYONE with AUTHENTICATED USERS at a minimum and disable any guest or anonyomous accounts like GUEST and ASPNET.
[...]
Not true - on a standard install of XP, the "Everyone" group doesn't have full control anywhere - I know this because I'm sat with a fresh install of XP on one of my laptops. The "Users" group has full control over the contents of the "All Users" directory, but that's it.
As for the ASPNet account, there's actually little point in disabling it - it's a virtual account that only has permissions (by default) to your WWWroot folder in IIS. Don't have IIS installed? Then it can't do anything at all. That said, disabling it does no harm, either, unless you're running ASP.Net applications.
Also, giving full control isn't all that major an issue - it only allows the users/groups to change permissions on those areas which they have full control to (although you obviously don't want to give full control to Users on %WINDIR%). What happens when you get a normal user on a multi-user system who doesn't want the other users to go snooping around their files on a shared area?
Originally posted by Stevie BM@Jun 10 2004, 11:33 AMNot true - on a standard install of XP, the "Everyone" group doesn't have full control anywhere - I know this because I'm sat with a fresh install of XP on one of my laptops. The "Users" group has full control over the contents of the "All Users" directory, but that's it.
As for the ASPNet account, there's actually little point in disabling it - it's a virtual account that only has permissions (by default) to your WWWroot folder in IIS. Don't have IIS installed? Then it can't do anything at all. That said, disabling it does no harm, either, unless you're running ASP.Net applications.
Also, giving full control isn't all that major an issue - it only allows the users/groups to change permissions on those areas which they have full control to (although you obviously don't want to give full control to Users on %WINDIR%). What happens when you get a normal user on a multi-user system who doesn't want the other users to go snooping around their files on a shared area?
Yep.. I stand corrected.
The EVERYONE group has read or read/execute by default, depends on directory.
I don't typicaly deal with shared systems except for my wife's PC.
I'm the admin, she's a basic user.
I have restricted permissions on my install source drive so she can't "accidently" delete something.
Which she does from time to time.
As for ASPNet account, I disabled it anyway.
Any account I'm not using or have no use for get's disabled by default.
If I need it later I can always re-enable.
No sense in leaving a potential point of entry open.
Any account that can authenticate to a system can be compromised and then it's let the priviledge escalations begin.
I also refrain from the libral use of FULL CONTROL permission.
It leaves too many things open to fat fingers and such.
My method is give them what they need and only what they need... no more.
I'm a security nut when it comes to my systems if you can't tell already.
That includes the ones I control at work also.
They are some of the most secure systems here.
They are even locked down to what ports are open, IPSec policies are great once you understand how to use them.
Originally posted by rjohnstone@Jun 10 2004, 04:29 PMThere's a big difference between write access and ADMIN.
Apps like the weather.com thing need write access to update app specific data.
They do not have to be an admin to do this... any USER can have write access.
Just make sure they do not have FULL CONTROL.
Typical Windows apps usualy only require read/write/execute from their own directory.
Occasionaly they will also require modify permissions.
Obviously. I guess I misspoke. One app that is giving me a huge headache is Autocad, which is only because I don't have time to research what it really needs access to. So I found a vbs script that will allow you to make a shortcut to an app using the "run as" feature of XP, but without needing to type in a su user/password. Kind of a pain, and I'm not too sure how secure of a solutoin that really is, but it works. The password is in plain text, which is of course a problem, except that my parents aren't too swift with this sort of thing and would never figure to look at the shortcut for the su username and pass (thankfully). They do enough damage with spyware.
Aqua-Soft Forums