Apple Security Patch Flubs DNS Fix - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Infrastructure // PC & Servers
02:02 PM
Connect Directly

Apple Security Patch Flubs DNS Fix

Despite Apple's patch, the fix for the DNS cache poisoning vulnerability is far from done, according to a SANS security researcher.

Apple on Thursday released Security Update 2008-005, a collection of 17 fixes for security vulnerabilities in its Mac OS X operating system.

Among the fixes is what looks to be a patch for the DNS cache poisoning vulnerability that security experts spent most of July warning about.

But according to security researcher Swa Frantzen from the SANS Internet Storm Center, Apple's fix hasn't quite done the trick.

"Apple might have fixed some of the more important parts for servers, but is far from done yet as all the clients linked against a DNS client library still need to get the workaround for the protocol weakness," Frantzen said in a blog post.

The issue appears to be that despite Apple's patch, BIND under OS X is incrementing the ports it uses to communicate DNS information in a predictable pattern.

With the premature disclosure of details about the vulnerability 10 days ago and the subsequent appearance of exploit code, US-CERT and the rest of the security community urged immediate repair of vulnerable DNS software.

Unlike other companies that moved swiftly to deal with the problem, Apple dragged its feet. Three weeks after security researcher Dan Kaminsky warned about the flaw on July 8, Apple still had not dealt with the issue, prompting widespread criticism.

"With active exploit code available in a common attack tool, it is imperative that Apple fix this vulnerability," wrote Rich Mogull and Glenn Fleishman in TidBits on July 24. "Due to their involvement in the process and the ability of other vendors to fix their products in a timely fashion, it's hard to imagine any possible justification for Apple's tardy behavior."

Aside from the ineffective fix to BIND, the DNS software used by Mac OS X, Thursday's patch includes fixes for the following Mac OS X components: Open Scripting Architecture, CarbonCore, CoreGraphics, Data Detectors Engine, Disk Utility, OpenLDAP, OpenSSL, PHP, QuickLook, and rsync.

Among these, the most serious issues fixed involve CarbonCore, CoreGraphics, OpenSSL, and QuickLook. If exploited, the vulnerabilities in these components could lead to arbitrary code execution.

Security Update 2008-005 applies to Mac OS X Server 10.4, Security, Mac OS X 10.4.11, Mac OS X Server 10.5, and Mac OS X 10.5.4. It can be downloaded from Apple's Web site or through the Software Update control panel in Mac OS X.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
Top 10 Data and Analytics Trends for 2021
Jessica Davis, Senior Editor, Enterprise Apps,  11/13/2020
Where Cloud Spending Might Grow in 2021 and Post-Pandemic
Joao-Pierre S. Ruth, Senior Writer,  11/19/2020
The Ever-Expanding List of C-Level Technology Positions
Cynthia Harvey, Freelance Journalist, InformationWeek,  11/10/2020
White Papers
Register for InformationWeek Newsletters
Current Issue
Why Chatbots Are So Popular Right Now
In this IT Trend Report, you will learn more about why chatbots are gaining traction within businesses, particularly while a pandemic is impacting the world.
Flash Poll