Apple Computer has issued a new security patch to mend seven vulnerabilities in its Mac OS X operating system .
The vulnerabilities were discovered in the Safari browser, the e-mail program, the ColorSync system, and other parts of the OS.
Apple also noted that it has changed the naming scheme for security updates. Rather than a date format, it now will use a format based on the year and a sequence number, similar to Microsoft 's system for tagging patch updates.
Fixing the Holes
The dominant problems in the latest crop of vulnerabilities concern Safari and ColorSync.
The browser issue is caused by a feature designed to block pop-up windows, according to the Apple advisory. If the feature is not enabled, it is possible that malicious windows can be launched.
With the ColorSync flaw, malformed color profiles can overwrite a program, which could result in arbitrary code execution.
Another issue in the company's e-mail program, Mac Mail, has been addressed so attackers cannot identify information about a user's Ethernet networking hardware .
Security Standard
The number of vulnerabilities reported by Apple is not unusual for an operating system, said Thomas Kristensen, security researcher at Denmark-based Secunia.
"An operating system is a huge, complex thing, and there are bound to be many issues with it," he told NewsFactor.
Currently, and in the future, it might seem that there are more issues with OS X than with Apple's last system, OS 9. However, that is not actually the case, Kristensen said.
"Apple is using software that's used in other distributions, so when there's a problem with those, it will affect the OS X platform," he noted. "Also, more research is being done on OS X, so it's getting a stronger focus than past Apple platforms."
Address Line
"What is more important than the number of vulnerabilities is how a company deals with the issues," Kristensen said.
Apple's handling of such flaws has improved quite a bit during the last year, he added. The company now seems to have a much better policy in place for addressing future vulnerabilities.
"We'll see more focus on OS X in the coming years, so it's good that Apple has put an effective system in place," said Kristensen.
|