The Mac Observer

Skip navigational links

You're viewing an article in TMO's historic archive vault. Here, we've preserved the comments and how the site looked along with the article. Use this link to view the article on our current site:
Mac OS X Software Update Vulnerability Found

Mac OS X Software Update Vulnerability Found

by , 1:40 PM EDT, July 8th, 2002

Security Focus Online posted a brief bug report on a security vulnerability within Mac OS X's Software Update application. The security hole could allow a malicious application to be installed with root authentication while pretending to be another "official" update from Apple. Root access is a Unix term that refers to having complete control over a computer, and user access to "root" is turned off by default in Mac OS X (see our tutorial on enabling root for more information). From the report:

Summary:

Mac OS X includes a software updating mechanism "SoftwareUpdate". Software update, when configured by default, checks weekly for new updates from Apple. HTTP is used with absolutely no authentication. Using well known techniques, such as DNS Spoofing, or DNS Cache Poisoning it is trivial to trick a user into installing a malicious program posing as an update from Apple.

Impact:

Apple frequently releases updates, which are all installed as root. Exploiting this vulnerability can lead to root compromise on affected systems. These are known to include Mac OS 10.1.X and possibly 10.0.X.

An example exploit of this vulnerability is documented and at the current time there is no work around. This vulnerability affects all versions of Mac OS X.

The Mac Observer Spin:

Security vulnerability such as this may seem like a small piece of news, but the implication of how such a hole could be exploited is great. An unsuspecting user could check for updated software today and find a software update titled "Mac OS X 10.1.6 Update." That user would probably without thinking start the download and installation, entering the admin password in the process. This gives the "update" full access to the machine and the opportunity to really muck things up.

For a long time Apple products have seemed to be void of security vulnerabilities -- at least when compared to Microsoft offerings. Now that we have entered the age of Mac OS X, a good deal more attention is being devoted to Apple and the Macintosh platform by all types of people. This will bring more viruses, more security holes found, and more security holes exploited by malicious individuals. Apple has so far made an excellent effort to plug these holes as quick as possible, something our friends in Redmond might take to heart.

Recent Headlines - Updated October 21st

Tue,8:51 PM
GTAT Announces ‘Amicable Parting’ of Ways with Apple
6:50 PM
How I Came to Own and Sell a TAM Probably Owned by Jony Ive
5:01 PM
Adobe KnowHow: Learn Photography From The Best for $29.99
4:49 PM
How To Get Ready For iOS 8.1 [Update]
2:59 PM
Chuck La Tournous and Chris Breen to Speak at NJMUG’s 30th Anniversary Tuesday
2:24 PM
Don’t Upgrade to Yosemite or iOS 8.1 Before You Read This Column
2:06 PM
TMO Daily Observations: 2014-10-21
12:29 PM
How Apple Pay Mitigates Breach Fatigue
10:50 AM
How to Enable Apple’s SMS Relay on your Mac or iPad
9:43 AM
Apple Earnings Smackdown Ranks Analyst Predictions
Mon,9:52 PM
Apple Q4 Earnings Sliced And Diced
8:21 PM
Apple Q4 MacBook Sales Hit Record Breaking Numbers, Jump 25 Percent
  • __________
  • Buy Stuff, Support TMO!
  • Podcast: Mac Geek Gab
  • Podcast: Apple Weekly Report
  • TMO on Twitter!