Jump to content
The Inquirer-Home

OSX vulnerable to malicious attacks again

Heap overflow leaves Apple naked
Friday, 19 September 2008, 10:05

INSECURITY OUTFIT Intego has discovered a critical bug that leaves OSX vulnerable to malicious attacks.

Indeed, Apple's QuickTime player reportedly fails to properly process extended media streams. This shocking deficiency leads to nasty heap overflows that occur in QuickTime Player, iTunes and Mail.

The media streaming error also affects a number of Web browsers running on the platform, including Safari, Internet Explorer and Firefox.

The serious flaw has apparently left QuickTime vulnerable to infected media files designed to execute malicious code or crash a browser.

It should be noted that Club Cupertino issued its latest QuickTime band-aid only last week. In addition, OSX Leopard 10.5.5, released on 15 September, fixed a whopping 33 bugs, nine of which enabled remote code execution.

Is that laughter we hear from Redmond? ยต

L'Inq
Channel Web

Share this:

Comments
give me a break

No one ever said it was a perfect system. That always comes from those who really have Apple-envy. Still Apple shows itself to be better than the others, not perfect.

posted by : Joey D., 19 September 2008 Complain about this comment
Smug users.

Someone needs to take advantage of this situation promptly and create some malware sites that exploit these weaknesses. I don't usually promote destructive things but it would be a perfect tool to wipe the smug smiles of Apple users that think the platform is free from viruses and security problems. Something in the wild that propagates like Melissa or Blaster. -3

posted by : Leggir, 19 September 2008 Complain about this comment
If Redmond are laughing...

...then Rightly so.

I look forward to Linux being taken up on a wider basis, because then all the smug gits would have the smiles wiped off their faces when they realise that actually, they're not perfect either.


posted by : Matt Whitfield, 19 September 2008 Complain about this comment
where are the apple fanboiz??

What a shock to see no apple fanboiz vomitting their hatred over L'INQ?! 
I think they've grown up & have started seeing things beyond what meets their sick 'n' skewed eye!

posted by : Metal Might, 19 September 2008 Complain about this comment
Stereotypical BS

"Someone needs to take advantage of this situation promptly and create some malware sites that exploit these weaknesses."

You're a dick. You're not only a dick you are a childish dick & "the Inquirer" is a place for all of you whiny little bastards to hang out with like minded losers. How about pulling Bill Gates' dick out of you're mouth.

posted by : JZ, 19 September 2008 Complain about this comment
"Vulnerable"?

Every OS is "vulnerable" in some way. The question is, how many actual Macs have been compromised with ANY of these vulnerabilities? Anyone, anyone? Buehler?

Oh, right, NONE! There is not now and has never been an active infestation of Mac OS X. Period. The reason, Mr Hater, that there is no Melissa or Blaster for Macs is because the Mac architecture is different in its approach. Neither M or B, even if re-engineered for the Mac, would work against the Mac OS.

I have had a fixed IP, a network of four Macs and no firewall or antivirus for a decade now. No viruses, no malware, no attacks. And I surf and download with reckless abandon! My Windows machine, on the other hand must be fastidiously updated, with Windows updates, antivirus definitions and kept OFF the WWW as much as possible. 

Yesterday a friend downloaded a "keygen" off a website and tried to run it and his machine was compromised immediately. Dumb, yeah. I had to wipe it and reinstall Windows to fix it. And this is an everyday occurrence for the average Windows user. 

Sure, my XP is relatively safe, because I know how to secure it, but I have to take steps to do so, steps that are outside the normal operation of Windows and I only use it to test web designs, so my XP is not subject to the same exposure that most Windows machines are.

Will there be a successful Mac virus someday? I'm sure there will as no system, however well designed, is invulnerable. But so far OS X is far safer to run than Windows. Flamers, name one widespread successful Mac attack before flaming, otherwise, WinTards STFU.

JoeL

posted by : joeldm, 19 September 2008 Complain about this comment
Yeah Right

You MS hacks keep on gloating while I use the best OS around, OS X. Our supreme leader will make sure any problems get fixed and we thank the hacks at Intego for finding this for us. All hail Apple and all things OS X. There, how's that for a fanboy post?
LOL
I still love my Mac and OS X even though I have a DRM infected Vista rig for games.

posted by : regulas, 19 September 2008 Complain about this comment
@Matt Whitfield

I don't get it. What did Linux do? Why even mention Linux when the situation has nothing do to with it? 

This is a Quicktime problem. Had you actually taken the time to READ the original article in the link; you'd realise that the problem affects both Windows and OSX versions. 

Quicktime is an Apple solution; as such its Apple's responsibility to fix the problem.

Linux has their own weaknesses and issues they need to address. They're a bit behind. But they're getting there...

The problem with "The Inquirer" authors, is that they tend to sensationalise something for no reason other than to provoke a deliberate response or emotion. 

Its a standard "web journalism" tactic. Create emotional feelings via provocation. (often to get someone worked up over nothing)...Its all about getting page hits. ie: Ad dollars!

posted by : aussiebear, 19 September 2008 Complain about this comment
The sky is falling!

Wow. A software bug! Any existing exploits in the wild? Didn't think so. Please return to your regularly scheduled program...

posted by : T, 19 September 2008 Complain about this comment
????

I have been on Mac's since 1997. Haven't had ONE, not one virus, adware, malware, or overflow anything. So, here is your Mac fanboy talking smack right back. Were are the bugs???? Haven't seen it happen to me or the 10+ people I have gotten to get a Mac in the past 11 years. They all run various OS X installs from .2 to .5.5. So whatever, Apple usually fixes these things before it effects anyone. Like I said, haven't been affected by anything as such reported or any other variant issue on a Mac ever. 

The only way I would have known about this issue, is from reading about it. Cause with 99.99999999% certainty, it wouldn't have effected me at all. 

Now I will get back to work on my slow a$$ PC with 2 quad core intel chips and 4gig's of ram running XP Pro 64bit. If I could hack this Dell box to run OS X I would. But alas, I can't do that. :(

posted by : Dj P, 19 September 2008 Complain about this comment
@Matt

And how, exactly, is a virus on Linux supposed to propogate itself? It would not only have to trick people into downloading it, the virus maker would have to convince the user to give the virus super-user access for it to accomplish anything major. If it didn't receive super-user access, it would take someone somewhere between noob and adept user to get rid of it.

So, every single person who had an active copy of the virus would have an excellent chance of guessing what the problem program is when they start having problems.

That is a lot of negatives, negatives piled on negatives, which causes a logarithmic decrease in the chance of things that are needed to happen to actually happen in order to make the virus active.

Yeah, unless someone finds a bug that let's them remotely give themselves super-user access, I think I'm pretty safe on my high horse.

posted by : Jason Goatcher, 19 September 2008 Complain about this comment
RULz!

MAC's RULLLLLLLLz!!!!

I'm smug!!!!!!!!!

Bot
Mac Fanbot

(couldn't resist :)

posted by : ex2bot, 19 September 2008 Complain about this comment
Indeed

I'm using an Apple iMac with OS X and I have had viruses, malware, crashes, etc...
Oh hang on a minute! I remember now, that was BEFORE I switched to a Mac!
Sorry, my mistake.

You know what is [really] tiring? This constant war of words between people using Windows, Mac OS and Linux... I use all three, and all three have their uses. Just grow up already, you don't like something? Well, don't use it then.

posted by : ChrisInBelgium, 20 September 2008 Complain about this comment
Vulnerable

My security recommendations are thus:

Cover all windows with 1" plate steel, not only do windows let people see inside, but employees can see outside. Bad idea.

Remove all batteries from laptops and shut down all electricity. A computer that is off is more secure.

Remove all employees ears, eyes and each individual's larynx. An employee that can hear, see and talk is a potential risk. Consider removing fingertips to avoid Braille use in particularly sensitive areas.

Sequester all employees in house. interaction with family and friends can be dangerous and must be avoided.

As a last resort in highly secure areas inside your company it is recommenced that the deceased be used as they are quite adept and keeping their secrets. You local cemetery will have a large supply of these. It is preferred that you use corpses that have been interred for at least 50 years or more.

posted by : mathue, 20 September 2008 Complain about this comment
CPU matters

It turns out that the x86 line of CPUs seems to like being exploited more than others. A single byte in the stack frame can run as a real program (without tripping other protections) while nearly every other CPU needs much more on the stack to work. Combine `hat with most C buffer overflows tend to involve just one byte, it makes them very dangerous compared to sparc, mips, power and everyone else.

posted by : haxOr, 22 September 2008 Complain about this comment
@people @me

I mentioned Linux because we had OS X smugness which is now starting to have the shine taken off it, and I am quite looking forward to have that happen with Linux too.

Like the comment 'unless someone finds a bug which allows them to give themselves super user privileges' - that bug probably exists somewhere. You just have a lot less people trying to find it.

And the 'how many viruses has the mac had? none' - perhaps you should take off the rose tinted sunglasses.

http://antivirus.about.com/od/macintoshresource/Macintosh_Viruses_and_Mac_Virus_Resources.htm


posted by : Matt Whitfield, 22 September 2008 Complain about this comment
Advertisement
Subscribe to the INQ Newsletter
Sign-up for the INQBot weekly newsletter
Click here to sign up Existing user
Advertisement
INQ Poll

Christmas computer sales

Will you be buying a new computer this Christmas?