Apple Mountain Lion 10.8.2 - lots of bug fixes, no known vices

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Together with the much-vaunted launch of the iPhone 5 last week came Apple's public release of its latest mobile operating system upgrade, iOS 6.

Not quite as widely-hyped as iOS6 was another system update that Apple released at the same time: OS X 10.8.2, the second major update to the Mountain Lion product.

With a couple of working days plus a weekend under its belt, OS X Mountain Lion 10.8.2 - and its sibling upgrades, Lion's 10.7.5 and Snow Leopard's Security Update 2012-004 - don't seem to have caused early adopters any major problems.

In short, it looks like a case of "no known vices."

And that raises the question, "Should I stay or should I go?"

I'd suggest, "Go!"

These latest OS X upgrades include 27 separately-documented fixes (not all of them apply to all OS X versions); overall, 95 different CVEs are dispatched, with 12 of the vulnerabilities annotated with the dreaded words "may lead to arbitrary code execution".

Here they are, coalesced into a single table:

Component OS Vulnerability CVEs fixed

* The initials S, L and M denote that the vulnerability affects Snow Leopard, Lion and Mountain Lion respectively.

* DoS stands for Denial of Service.

* RCE stands for Remote Code Execution.

As often happens with simultaneous upgrades to three different core versions of OS X, there isn't a one-size-fits-all download you can apply.

Mountain Lion users move to 10.8.2, which includes an update from Safari 6.0 to 6.0.1.

The Safari update is pretty important, as it fixes data leakage vulnerabilities in the browser front-end, as well as potential remote code execution holes in WebKit, OS X's core HTML rendering technology.

Lion users also get a new point release, going to 10.7.5, but don't get Safari 6.0.1 bundled in with it. That's a separate update, predictably called Safari 6.0.1.

On Snow Leopard, the security fixes don't change the OS version. You need Security Update 2012-004 and, like Lion users, the separate package for Safari 6.0.1.

Apple also published an iPhoto update at the same time: if you're on Mountain Lion, as I am, you'll find you have to go to 10.8.2 before you can get the "performance and stability improvements" promised by upgrading iPhoto.

By the way, the new version of OS X Mountain Lion was a 366MByte download; iPhoto on its own clocked in at 373MBytes.

I suspect Apple is trying to tell me something there - I just haven't worked out what it is yet.

Follow @duckblog
-

Tags: Apple, cve, DOS, Exploit, Lion, Mountain Lion, OS X, Patch, rce, Snow Leopard, update, vulnerability

View the original article here

Automatic daily security updates coming for OS X Mountain Lion

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

The new version of Mac OS X, Mountain Lion, is just around the corner and contains a feature which should go down well with security-minded end users.

AppleInsider reports that one of the new features included in OS X 10.8 Mountain Lion is automatic security updates.

That means that you will be able to configure any Macs you have that are running Mountain Lion to automatically check Apple's update servers on a daily basis (or when the computer is restarted) to see if a security update is available, and apply it without user interaction.

Of course, most days it is unlikely that Apple will have released a security update - but for those times when they have, this feature will hopefully reduce the window of opportunity for malicious hackers to exploit any vulnerabilities in OS X.

At its recent WWDC event, Apple revealed that its newest range of laptops are coming with a "PowerNap" feature, allowing security updates to be downloaded while the rest of the computer is in sleep mode.

This, alongside the removal of requiring the user to give permission for a security patch to be installed, should ensure that more Macs are kept more up-to-date.

Anything which makes that attack window smaller has to be good news for Mac users. So, well done Apple.

One thing that is interesting is that Apple claims to also be introducing a more secure connection to its update servers with Mountain Lion. Earlier this month it was revealed that the Flame malware had used a "man-in-the-middle" attack against the Windows update system.

Of course, in business environments the concept of automatic, silent updates to the Mac operating system may be less popular. Often organisations prefer to test a security update before rolling it out across a large number of computers, in case there are bugs or conflicts.

Furthermore, companies may not like the idea of lots of their Mac computers individually pulling down hefty security updates and gobbling up their internet bandwidth.

Presumably Apple will provide mechanisms for businesses to handle these issues when OS X ships next month.

Follow @gcluley

Image credit: AppleInsider

View the original article here