RSSAt long last, Apple patches its Java vulnerability
By Angela Gunn | Published June 15, 2009, 5:59 PM
After nearly a year, Apple has chosen to issue patches for a notorious security flaw in Java long since addressed by other operating systems. The move follows the release late last month of a zero-day release by a security researcher frustrated by the lag in Apple's response to the problem, not to mention a blitz of highly negative press coverage (here and elsewhere) for a company that has historically claimed its products to be more than ordinarily secure.
Both Java 1.4.2_18 and Java 1.5.0_16 have been known to contain multiple vulnerabilities for quite some time. Those vulnerabilities could if exploited allow an attacked to gain elevated privileges on a system, from which s/he could execute other attacks, scoop up sensitive information, or undertake any of the usual sorts of mayhem. The problem was especially dangerous because it was "purely Java" in nature. That is, an exploit could be written in Java and executed on any platform running it -- Windows, Mac, whatever.
Patches are available for both OS X users running 10.5.7 and later and for those on 10.4.11 and later, and your friends at Betanews suggest that you do not wait for Apple to push this update to you. Updating will require that you close all your browser windows.
One San Francisco researcher took matters into his own hands last month, Noting in a glum blog post that "it seems that many Mac OS X security issues are ignored if the severity of the issue is not adequately demonstrated," Plausible Labs' Landon Fuller released proof-of-concept code showing just how easy the problem was to exploit. It's unclear whether Fuller's action, the combined efforts of the tech press, or a general cold wind from outside One Infinite Loop impelled Apple to make the security effort.
If you read BN and see the name Internetworld, you usually know what to expect and he/she/it never fails. It is ironic that one side of the ledger, some are critical of Bn for being Pro or anti MS and then you have Internetworld who lives in a world that is ,well, who knows.
As to this issue, I expect from any computer manufacture an approach that sees their programs in light of the old cliché of "there is no such thing as an unsinkable ship". By this I mean that no one will ever create a program or OS that is invulnerable to attack. ain't gonna happen. What it comes down to is market share. When a company has to issue between 50 and 70 patches some of which go back some time to fix security, I don't care if it is MS or Apple, they are not doing their job.
The problem is not with those who go to DEFCOM conventions but those that are hidden and I am sure they are now fast at work at finding ways around the fixes and also now looking at the cell phone industry. So I expect or rather demand that companies take an ASAP approach to fixing vulnerable parts when it is brought to their attention. Apple's failure is inexcusable and gives lie to what their slick ads tell you. If MS does the same thing then I would slam them also. Frankly, I am tired of this Bs debate of Apple versus MS and want both companies to step up and quit the "we're not talking game" and fix the damn issues.
We have enough problems dealing with the stupidity of idiots taking laptops out of sensitive building with sensitive info on them and then losing them to also have to deal with companies that bury their heads in the sand and don't move quickly on security issues.
If we are going to take an unified approach on copyright, patent, or trademark reform or everyone gathering together to take a giant pee (lacey panties optional) on the DMCA and throwing it out then it seems to me that we should also take an unified approach on security which, I believe is only going to get worse.
So to those that are pro-apple or pro-MS or pro-whatever, wake up and smell the roses or the s*** these companies sometimes throw our way as they ignore the increasing problems of security.
Score: 2
|"When a company has to issue between 50 and 70 patches some of which go back some time to fix security, I don't care if it is MS or Apple, they are not doing their job."
Let's see you design a modern Operating system that does better.
We arguably have some of the most secure Operating systems released ever, as far as net enabled. In their default states, most of the top-tier desktop and server operating systems are reasonably secure from remote attack. It is the user at the local machine and the apps they run that we scramble to fix things for these days.
If IE was never bundled with Vista, you would have an OS that would rarely need a reboot for the majority of its existence.
Score: 0
|Aw, who else but Angela Gunn could have been selected to write this article. As of late, at any and every opportunity, she won't miss a chance to slander all things Apple.
As I said before, if you're running Mac OS X you were secure from day one with or without this "security" update. A Mac will stand the the test of time. As long as you're on a Mac you've got no worries.
Score: -7
|Going to break my own please-don't-feed-the-trolls rule here to note that if Apple had been as diligent about patching as I and other members of the press have had to be about leaning on them to do it, I could have been done writing about this foolishness long ago.
And I speak for many when I encourage you to stick with that "as long as you're on the Mac you've got no worries" thing you do. People like you keep security reporters like me busy... and, heaven help you, amused. Any way we could convince you not to patch at all, since you seem to believe you don't need to do so?
Score: 5
|I've been a Mac user since 1993 and I do have worries: the firewall that repeatedly prompts me for answers to the same questions, the Safari browser (I use Firefox) which repeatedly gets sets to automatically open files despite my changing the setting, and Apple's unwillingness to attack security issues first.
It just doesn't make sense that they can't integrate security fixes, especially when the open source community (and Sun in this case) has done the work, within a reasonable time.
Score: 0
|apple fixing suns bugs makes about as much sense as apple fixing adobes bugs. implementing updates should still be timely, but put the blame where blame belongs. it's suns bug.
Score: 0
|Yes. And Sun made the necessary repairs months ago; it was up to Apple to implement, as it was up to Microsoft and so forth.
Score: 0
|"but put the blame where blame belongs."
A great phrase indeed.
Right up there with;
"Make sure you know what you're talking about before opening your pie-hole." :p
Score: 0
|Sun takes care of the Windows, Linux, and Solaris versions of Java and Apple takes care of their own.
When Sun finishes, Apple should be applying the fixes right away, and Apple was helping Adobe to complete their CS3 on Mac OS X because Adobe can't seem to help themselves.
Score: 0
|I'm going to go ahead and speak for Fatty since he is away from his desk:
Fatty: This is simply negative news that Microsoft paid for you to release. Apple is flawless and it is all I buy since I am unable to configure all my drivers for Linux. Microsoft's Bloatware has all sorts of problems.
Thanks!
Score: 0
|Ok, this made me laugh, I've seen Fatty's posts.
I'm not sure what is more entertaining at times, the articles, or the responses. Both are win sometimes :)
Score: 0
|The lackadaisical attitude generally stems from the fact that OS X users haven't yet been shell-shocked into spastic paranoia by the devastating virii that all too commonly rack Windosed machines.
Score: 0
|commonly? if you mean 9 years ago it was common, i'd agree with you, today? not so much, but i welcome the continued switch of those brain dead users into the world of Apple
Score: 0
|No artfuldoga or whatever the heck you call yourself, he meant today, like June 15th 2009. Millions of PCs out there still aren't patched with the latest Microsoft patches nor are they protected by bloated anti-virus software, hence the lucrative worldwide botnet networks and growing problem of rootkits.
Please get a clue before posting... or just get a Mac and be done with malware and security problems altogether.
Score: -4
|you kind of just have to laugh, any other company would of had article after article written bashing them for putting users at risk... alas, this is Apple
Score: 2
|There have been several articles on various sites, but Apple tends to wait until that moment to plan some action.
Since the patch was around 150 MB for me, I can't imagine that they've just started working on things since the bad press, but they certainly didn't think to release the security update ahead of the other fixes. They continue to put users at risk until reality hits the fan and with more users than ever, they need to put more than a single intern on such issues.
Score: 0
|Yeah, for sure, folks like to say that Apple doesn't have the virus and malware problems because nobody uses Apple; hence giving a pass to Windows since we all know and appreciate that the world runs on Windows. We're not a bother because no one cares; there would be no fun to write crap to foul up Apple's system. Who would even know?
Actually, there would be a nice benefit for the hacker/whacker community to bust in to Apple, after all, it is UNIX. Unix runs the banks, the world's big data bases, the foreign fund transfers, the space program, nuclear reactors, most all university databases, Social Security, the big insurers, medical databases of all ilk, the government in general, the DOD databases, et al. Actually, I think there is more to this than "nobody cares."
Score: 0
|