The Mac Observer

Skip navigational links

You're viewing an article in TMO's historic archive vault. Here, we've preserved the comments and how the site looked along with the article. Use this link to view the article on our current site:
Security Firm Tires of Waiting for Apple Fix, Publishes iCal Security Flaws

Security Firm Tires of Waiting for Apple Fix, Publishes iCal Security Flaws

by , 9:15 AM EDT, May 22nd, 2008

After attempting to work with Apple for several months on what it claims are serious security flaws in iCal, security firm Core Security Technologies (CST) published the flaws late on Wednesday. The company published notice of the bugs, along with sample proof-of-concept code, and a log of contacts between Apple that debate the severity of the flaws and threaten publication unless Apple commits to a date for fixing the flaws.

According to CST, the flaws, "discovered in the iCal application may allow un-authenticated attackers to execute arbitrary code on vulnerable systems with (and potentially without) the assistance from the end user of the application or to repeatedly execute a denial of service attack to crash the iCal application."

The company also said that exploiting the vulnerabilities is possible via a client-side attack with user assistance, which means getting the victim to click on a specially crafted .ics file. Worse, it would also be possible to exploit the flaw if someone has the ability to modify or add a calendar file on a CalDAV server to which the victim was subscribed.

According to the log of contacts with Apple CST published, the firm first notified Apple of the flaws January 20th, 2008. Over the following months, the two companies exchanged contacts that acknowledged the flaws and debated their severity. CST maintained throughout the exchanges that they were serious flaws, but delayed publishing them as Apple asked for additional time.

Apple eventually told CST that it would release a security fix on May 19th, 2008, and Core set May 21st as the final date for publishing the flaws. As the 19th came and went without that update, CST followed through and published the information on its own Web site.

There has traditionally been some friction between security firms and operating system vendors, usually Microsoft or Apple. The former tend to want patches released ASAP and the publicity of having found the flaws, while the OS vendors want to be able to take as long as they feel they need to dealing with the problem without having to worry about the pressure of having the flaw known.

This has occasionally led to actions such as those of CST, where the security firm or white hat hacker releases the information after tiring of awaiting action from the vendors.


Warning: include(/usr/local/etc/httpd/sites/macobserver.com/htdocs/forums/extension.inc) [function.include]: failed to open stream: No such file or directory in /var/www/bbm/macobserver.com/ee2/www/htdocs/comments/comments.php on line 108

Warning: include() [function.include]: Failed opening '/usr/local/etc/httpd/sites/macobserver.com/htdocs/forums/extension.inc' for inclusion (include_path='.:/usr/share/php5:/usr/share/php') in /var/www/bbm/macobserver.com/ee2/www/htdocs/comments/comments.php on line 108

Warning: include(/usr/local/etc/httpd/sites/macobserver.com/htdocs/forums/common.) [function.include]: failed to open stream: No such file or directory in /var/www/bbm/macobserver.com/ee2/www/htdocs/comments/comments.php on line 110

Warning: include() [function.include]: Failed opening '/usr/local/etc/httpd/sites/macobserver.com/htdocs/forums/common.' for inclusion (include_path='.:/usr/share/php5:/usr/share/php') in /var/www/bbm/macobserver.com/ee2/www/htdocs/comments/comments.php on line 110

Warning: include(/usr/local/etc/httpd/sites/macobserver.com/htdocs/forums/includes/bbcode.) [function.include]: failed to open stream: No such file or directory in /var/www/bbm/macobserver.com/ee2/www/htdocs/comments/comments.php on line 112

Warning: include() [function.include]: Failed opening '/usr/local/etc/httpd/sites/macobserver.com/htdocs/forums/includes/bbcode.' for inclusion (include_path='.:/usr/share/php5:/usr/share/php') in /var/www/bbm/macobserver.com/ee2/www/htdocs/comments/comments.php on line 112

Fatal error: Call to a member function sql_query() on a non-object in /var/www/bbm/macobserver.com/ee2/www/htdocs/comments/comments.php on line 532

Recent Headlines - Updated May 23rd

Wed, 8:28 PM
Apple Context Machine Podcast - ACM 205: Apple Tax Hearings & Samsung’s Delusions
5:23 PM
Product News - Apple Updates iTunes & QuickTime for Windows, Windows 64
2:50 PM
Quick Look Review - Designed by M’s AL13 Aluminum Bumper Is For The iPhone 5 Purist
2:02 PM
News - Penguin Agrees to $75M Payout in ebook Price Fixing Settlement
1:00 PM
In-Depth Review - An iPhone Veteran Evaluates a Samsung Galaxy Note II
11:13 AM
TMO Appearances - Jeff Gamet Discusses Apple Taxes on MacVoices
10:25 AM
Analysis - Corporate Tax Reform Needs to Start in the US, not Ireland
8:25 AM
TMO Quick Tip - iOS Mail: Archive or Delete Individual Emails
Tue, 8:16 PM
Analysis - Apple to Senate: We Comply with the Law - Change the Law
5:10 PM
The Back Page - Samsung’s Delusions of Relevance
2:11 PM
Native Instrument Releases Abbey Road 50s Drummer
12:47 PM
News - Senator Paul: Stop Bullying Apple

The Mac Observer Reader Specials

  • Support TMO, Buy from Amazon, MacMall and The Apple Store

  • __________
  • Buy Stuff, Support TMO!
  • Podcast: Mac Geek Gab
  • Podcast: Apple Weekly Report
  • TMO on Twitter!