"Work Around:
Install 10.4.7 update
http://www.apple.com/support/downloads/"

"The article noted that Mr. Finisterre's intent is to show Apple where flaws lie in its operating system."

IMNotSoHO: Mr. Finisterre's intent is to help try to justify the continued existence of antivirus software research, on the Mac platform, which is, so far, devoid of real threats by damaging malware.

For years, I have been hearing that 'If Macs really become popular, then they will gain the attention of those who write viruses, and then you Mac users will have to shut up and accept that the Mac OS isn't really any more secure than Windows."

Well, if anything was going to goad malware developers into targeting Mac OS X, I think that Apple publicly and loudly flaunting the lack of Mac viruses would be just the ticket. Apple has been thumbing their noses, thusly, at viruses for more than a month, and this news is the closest thing to a real threat we have? oh... no... eek...

Oh, and as coaten was kind enough to point out, the problem has ALREADY BEEN FIXED. Yeah, I'm worried. BWA HA HA HA HA!!!

Quote

MOSiX Man wrote:
"The article noted that Mr. Finisterre's intent is to show Apple where flaws lie in its operating system."

IMNotSoHO: Mr. Finisterre's intent is to help try to justify the continued existence of antivirus software research, on the Mac platform, which is, so far, devoid of real threats by damaging malware.

For years, I have been hearing that 'If Macs really become popular, then they will gain the attention of those who write viruses, and then you Mac users will have to shut up and accept that the Mac OS isn't really any more secure than Windows."

Well, if anything was going to goad malware developers into targeting Mac OS X, I think that Apple publicly and loudly flaunting the lack of Mac viruses would be just the ticket. Apple has been thumbing their noses, thusly, at viruses for more than a month, and this news is the closest thing to a real threat we have? oh... no... eek...

Oh, and as coaten was kind enough to point out, the problem has ALREADY BEEN FIXED. Yeah, I'm worried. BWA HA HA HA HA!!!

So this guy writes code that "could" attack OS-X and posts it to "show Apple where flaws lie in its operating system". How is that different from someone who writes a Windows Virus like Sober and posts it on the net "to show where the flaws lie in Windows". I mean I can understand wanting to see these things fixed but posting them for anyone to exploit seems irresponsible at least.

When the very first incarnation of iDisk was started by Apple I noticed what looked to me to be a security risk. I sent a quiet message to Apple and noticed that within a few days it had been fixed. No muss, no fuss, and no blowing my own horn. This seems to smack more of "hey look at how smart I am" rather than an honest interest in improving the security of OS-X.

Had he previously notified Apple quietly? The story does not make it clear. It is entirely possible that he specifically held off on releasing the proof-of-concept code until Apple had released the fix. That is a responsible thing to do.

That said, a local exploit is hardly news. Unix has always been notorious for them (Windows hardly has a better track record). What would be significant is a remote exploit on a default (or reasonably forseeable) installation.

Quote

Ibn Rushd wrote:
I believe that we are very secure, and I am currently not worried. However, no OS is perfect, sooner or later some jerk is going to find our Achilles heal. At least Apple seems to be very quick in plugging the few problems that we had have.