Techsurvivors

Archives => 2008 => Topic started by: gunug on August 01, 2008, 07:51:02 AM

Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: gunug on August 01, 2008, 07:51:02 AM
The headline says it all except all the tech pundits think Apple took too long (whatever):

http://www.infoworld.com/article/08/08/01/...DNS_flaw_1.html

It's worked 2 out of 2 times on 10.4 systems for me so far!
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: Highmac on August 01, 2008, 08:24:13 AM
Thanks Gunug - didn't even know about it until your post. Have now updated.

As usual on all my updates for quite a while now, the fans (G5 iMac) kick in before it loads the OS (the little daisy is still spinning) and keep running all the way through, even after it's finished loading everything. Click Restart in the Apple menu and on the second boot everything is hunky-dory.

I'm used to it now, but mention it here in case any newcomers are startled by it smile.gif
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: Gregg on August 01, 2008, 12:34:55 PM
Thanks for the heads up. I'm nabbing it via Software Update today!
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: krissel on August 02, 2008, 08:15:31 AM
The so-called 'BIND' problem regarding DNS servers being spoofed that has been in the news lately...

http://support.apple.com/kb/HT2647
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: Gregg on August 02, 2008, 10:01:12 AM
I sense a merger again...

http://www.techsurvivors.net/forums/index....showtopic=19395
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: gunug on August 02, 2008, 10:04:39 AM
I don't care if no one else does!
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: kbeartx on August 02, 2008, 10:39:47 AM
QUOTE(gunug @ Aug 2 2008, 10:04 AM) <{POST_SNAPBACK}>
I don't care if no one else does!


And I certainly don't care if Gunug doesn't! toothgrin.gif

PS - sorry about spelling your handle backwards; I just felt silly this AM and had to do it! Devilish2.gif

 - KB coolio.gif
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: Xairbusdriver on August 02, 2008, 12:56:03 PM
Read a piece from the Register yesterday complaining that the fix didn't apply to 'client' machines. But some responded that extremely few 'client' machines would ever be running as DNS machines, anyway. So, Apple fixed the problem for servers but didn't see a need to send it out to "the rest of us." I'll have to take the word of those who say it's not needed by our desktop/laptops. smile.gif But it provided another chance for some 'experts' to throw dirt at Apple and its tardiness...
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: sandbox on August 02, 2008, 02:14:37 PM
Rerun

05/24/2007, 4:35pm, EDT

QUOTE
Apple fixes Panther, Tiger vulnerabilities
Apple today issued a security update for Mac OS X 10.3.9 Panther Client and Server as well as Mac OS X 10.4.9 Tiger Client and Server, fixing numerous security holes in both systems. The update includes fixes related to Alias Manager, BIND, CoreGraphics, crontabs, fetchmail, file, iChat, mDNSResponder, PPP, ruby, screen, texinfo, and VPN. Specific vulnerabilities include the potential for attackers to mislead users into opening a substituted file, multiple holes in BIND, arbitrary code execution from opening a maliciously crafted PDF document, and more. Mac owners running these systems are encouraged to either update automatically via the "Software Update" menu item under the Apple Menu or by heading to Apple's website to download the security fix manually.

http://www.macnn.com/articles/07/05/24/app....os.x.security/
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: Xairbusdriver on August 02, 2008, 07:07:06 PM
Well, it's a "rerun" in the sense that it fixes some of the same vulnerabilities (including BIND), but this was SU 2008-5 as compared to the one last year ( SU 2007-5 ). I doubt that this will be the last SU to address the same problems. Hopefully each new one will be a better fix. I also doubt that there will ever be a final fix for most of these problems. At least for our client machines, they are not being used "in the wild." smile.gif
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: gunug on August 02, 2008, 07:58:37 PM
Apparently these guys think Apple Clients are still vulnerable:

http://db.tidbits.com/article/9721

Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: Xairbusdriver on August 02, 2008, 09:37:25 PM
They probably are if they are using their Macs as Domain Name Servers. Are you doing that? I seriously doubt it. smile.gif Do you know anyone who is? Maybe at your school?dntknw.gif Of course, the SU did much more than that, anyway and most of that does affect our machines.
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: krissel on August 02, 2008, 11:10:26 PM
Sorry gunug, I swear I looked for a thread on the subject but I guess I was too tired after being up all night.


Yeah, that's my excuse.  wink.gif
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: gunug on August 03, 2008, 12:51:14 AM
No big deal Krissel; I've done it several times now!  xABD, as to using a computer to do DNS we don't do that on MAC's; we did this in a Linux course that I went to but that was so we could learn the process.
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: sandbox on August 03, 2008, 03:28:30 AM
QUOTE(gunug @ Aug 2 2008, 08:58 PM) <{POST_SNAPBACK}>
Apparently these guys think Apple Clients are still vulnerable:

http://db.tidbits.com/article/9721


I just ran the terminal test on Panther and it's OK.
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: sandyman on August 03, 2008, 01:28:31 PM
QUOTE(sandbox @ Aug 3 2008, 09:28 AM) <{POST_SNAPBACK}>
QUOTE(gunug @ Aug 2 2008, 08:58 PM) <{POST_SNAPBACK}>
Apparently these guys think Apple Clients are still vulnerable:

http://db.tidbits.com/article/9721


I just ran the terminal test on Panther and it's OK.


It will not work if you use a router and use that as your DNS Server.

However the fact that you "Passed" suggests to me that your ISP has patched their DNS servers.

Sandy

Edit

I had a quick think about all this and it might be a good idea to upgrade your router's firmware if you are using one.  I use DD-WRT and they updated their firmware last week.  Sandy gets a kick where the sun don't shine for not checking sooner  whew.gif
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: sandbox on August 03, 2008, 03:23:40 PM
QUOTE(sandyman @ Aug 3 2008, 02:28 PM) <{POST_SNAPBACK}>
QUOTE(sandbox @ Aug 3 2008, 09:28 AM) <{POST_SNAPBACK}>
QUOTE(gunug @ Aug 2 2008, 08:58 PM) <{POST_SNAPBACK}>
Apparently these guys think Apple Clients are still vulnerable:

http://db.tidbits.com/article/9721


I just ran the terminal test on Panther and it's OK.


It will not work if you use a router and use that as your DNS Server.

However the fact that you "Passed" suggests to me that your ISP has patched their DNS servers.

Sandy

Edit

I had a quick think about all this and it might be a good idea to upgrade your router's firmware if you are using one.  I use DD-WRT and they updated their firmware last week.  Sandy gets a kick where the sun don't shine for not checking sooner  whew.gif


yup, just ran it off the modem.

I've had many routers given to me or that I found here and there, today I'm using this one http://www.netgear.com/Products/PrintServe...rs/WGPS606.aspx which doesn't work with DD-WRT, my last one did but I gave it away.

A friend brought one of these back from London, it was a gift from Belkin.

http://catalog.belkin.com/IWCatProductPage...oduct_Id=377018


this is the support page for DD-WRT
http://www.dd-wrt.com/wiki/index.php/Suppo..._Devices#Belkin
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: sandbox on August 03, 2008, 03:37:22 PM

Two Black Hat Talks On Apple Security Cancelled
Posted by kdawson on Sunday August 03, @08:04AM
from the can't-say-that dept.
Security Apple
An anonymous reader writes
QUOTE
"Two separate Apple security talks have been nixed at the last minute from next week's Black Hat security conference in Las Vegas. The Washington Post's Security Fix blog reports that Apple researcher Charles Edge was to present on flaws in Apple's FileVault encryption plan, but asked Black Hat to cancel the talk, citing confidentiality agreements with Apple. Then on Friday, Apple pulled its security engineering team out of a planned public discussion on the company's security practices — which would have been a first for Apple. 'Marketing got wind of it, and nobody at Apple is ever allowed to speak publicly about anything without marketing approval,' a Black Hat spokesman said."

http://it.slashdot.org/it/08/08/03/0031228.shtml
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: tacit on August 04, 2008, 05:46:57 PM
I think there's a lot of confusion and misunderstanding about this security flaw.

First of all, you do not need to apply the patch; the flaw in BIND will not affect you unless you are running your Mac as a name server, for example if you are the owner of an ISP and you use Macs as DNS servers. If you are just a consumer using your Mac, then patching your Mac makes no difference. The patch only affects if you happen to be running the name server software called BIND on your computer and using your computer as a name server.

The thing that tells if you are affected or not does not tell you if your computer is vulnerable. Your particular computer is never vulnerable if it is not running as a name server. Instead, that test tells you if your ISP has fixed the problem on their name servers. So it is possible that you may not apply the patch and you'll get an OK response from the test, or you may apply the patch and get a not OK response from the test, because the test does not test your computer at all. It tests the computers in your ISP's data center.
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: gunug on August 04, 2008, 06:25:22 PM
I talked to the official Apple Technician who works in our part of the state today and he confirmed that whatever risks there were have been patched and that only in the most extreme conditions would it every lessen the security in a client workstation anyway!  I didn't seek him out we were just in the same meeting!
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: sandbox on August 08, 2008, 01:44:19 PM
QUOTE(tacit @ Aug 4 2008, 06:46 PM) <{POST_SNAPBACK}>
I think there's a lot of confusion and misunderstanding about this security flaw.

First of all, you do not need to apply the patch; the flaw in BIND will not affect you unless you are running your Mac as a name server, for example if you are the owner of an ISP and you use Macs as DNS servers. If you are just a consumer using your Mac, then patching your Mac makes no difference. The patch only affects if you happen to be running the name server software called BIND on your computer and using your computer as a name server.

The thing that tells if you are affected or not does not tell you if your computer is vulnerable. Your particular computer is never vulnerable if it is not running as a name server. Instead, that test tells you if your ISP has fixed the problem on their name servers. So it is possible that you may not apply the patch and you'll get an OK response from the test, or you may apply the patch and get a not OK response from the test, because the test does not test your computer at all. It tests the computers in your ISP's data center.


Ops, your right.... and I don't run a name server any longer.  Thinking.gif
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: krissel on August 09, 2008, 03:00:25 AM
Well folks, seems as though the patch is not exactly flawless either:

http://www.nytimes.com/2008/08/09/technolo...xprod=permalink
Title: Yesterday's OS X Security Update patches DNS Flaw!
Post by: Xairbusdriver on August 09, 2008, 09:07:39 AM
See posts #10 & 12. wallbash.gif