Feeds

Tardy Apple finally releases DNS patch

Cache from chaos

High performance access to file storage

Apple has finally gotten around to defending against a high-profile Domain Name System flaw, days after security researchers called it out for dragging its heels on releasing a patch.

The Mac OS X security update issued by Apple on Thursday defends against the infamous DNS poisoning issue, discovered by security researcher Dan Kaminsky, by implementing source port randomisation. The update addresses the Apple end of a cross vendor patching effort by updating the Berkeley Internet Name Domain (BIND) DNS software bundled with Apple's operating system.

Patching efforts to thwart cache poisoning exploits, which arise from security shortcomings in the DNS protocol itself rather than coding errors by individual vendors, began on 8 July. The Internet Systems Consortium, which maintains BIND, was among the vendors that worked together with Kaminsky in secret beforehand and made patches available from day one. Apple's update some three weeks later comes only after the flaw has become the target of active exploitation by hackers.

Successful exploitation of the flaw allows miscreants to redirect surfers to potentially malicious websites in a way that leaves users unaware anything has gone awry. Security watchers hammered Apple for failing to do its bit earlier this week, a factor that may well have accelerated the availability of Apple's update.

Apple's Security Update 08-005 also addresses a range of lower profile security flaws, including flaws in CardonCore and CoreGraphics that each pose a code injection risk, as explained in an overview by security notification firm Secunia here. The software also includes an upgrade to PHP 5.2.6, available as a stand-alone update since 1 May, and fixes for flaws in Apple's implementation of OpenSSL.

Various flavours of the update are available for systems running Mac OS X Server versions 10.4 and 10.5 as well as Mac OS X 10.4.11 and Mac OS X 10.5.4. Apple's summary of the update can be found here.

Apple's developers have had a lot on their plate of late - not least fine-tuning version 2 of the iPhone software and dealing with a series of problems involving the .Mac-to-MobileMe migration - a factor that may account for its delay in updating its software to deal with the DNS patch, Apple watchers note. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
Oz bank in comedy Heartbleed blog FAIL
Bank: 'We are now safely patched.' Customers: 'You were using OpenSSL?'
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.