RE: Mac OS X vulnerabilities ['Virus checked"]

["Thor Larholm" <thor@pivx.com>]

Graham,
 
Thank you for the feedback.
 
I can't locate any new patches or updates through the software update tool on 
our 10.2 systems, and Apples security site (which I now received the URL to) 
mentions nothing about these security updates for OS X 10.2
 
The only way for any Mac OS X 10.2 user to stay secure is to pay Apple for an 
upgrade to Mac OS X 10.3, there are simply no patches for these vulnerabilities 
in 10.2 even though 10.2 is affected.
 
 
Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/ - Get our research, join our mailinglist

        -----Original Message----- 
        From: graham.coles@retail-logic.com 
[mailto:graham.coles@retail-logic.com] 
        Sent: Wed 10/29/2003 2:14 AM 
        To: bugtraq@securityfocus.com; Thor Larholm 
        Cc: 
        Subject: Re: Mac OS X vulnerabilities ['Virus checked"]
        
        


        I usually download main updates (10.2.8) and security patches from
        http://www.apple.com/downloads/macosx/apple
        
        There's also an automated update from within OS X which will check
        for and install patches automatically.
        
        These are non-chargeable updates, I believe the price you quote is
        for a single user copy of Mac OS X.
        
        Regards,
        
        Graham Coles
        
        
        
        
                                                                                
                                                              
                              "Thor Larholm"                                    
                                                              
                              <thor@pivx.com>          To:       "@stake 
Advisories" <advisories@atstake.com>, <bugtraq@securityfocus.com>    
                                                       cc:       
<product-security@apple.com>                                                 
                              28/10/2003 19:23         Subject:  Re: Mac OS X 
vulnerabilities ['Virus checked"]                               
                                                                                
                                                              
                                                                                
                                                              
        
        
        
        
        I couldn't find any security contacts on apple.com that didn't look
        fee-based so
        I am asking here in response to these latest disclosures of security
        vulnerabilities in Mac OS X.
        
        When most vendors are notified of security vulnerabilities in their
        products,
        they produce a patch for the affected versions of the software and
        distribute it
        for free. Does Apple plan to distribute a free patch for these security
        vulnerabilities to Mac OS X 10.2, or will my clients have to spend $129 
per
        workstation (the single user upgrade price) to have their Apple computer
        stay
        secure?
        
        
        Regards
        Thor Larholm
        PivX Solutions, LLC - Senior Security Researcher
        http://pivx.com/larholm/ - Get our research, join our mailinglist
        
        
        > ----- Original Message -----
        > From: "@stake Advisories" <advisories@atstake.com>
        
        > Subject: Mac OS X Long argv[] buffer overflow
        > This is fixed in Mac OS X 10.3
        <snip 
http://www.securityfocus.com/archive/1/342735/2003-10-25/2003-10-31/0
        >
        
        > Mac OS X Systemic Insecure File Permissions
        > This is fixed in Mac OS X 10.3
        <snip 
http://www.securityfocus.com/archive/1/342725/2003-10-25/2003-10-31/0
        >
        
        > Mac OS X Arbitrary File Overwrite via Core Files
        > This is fixed in Mac OS X 10.3
        <snip 
http://www.securityfocus.com/archive/1/342730/2003-10-25/2003-10-31/0
        >