Apple DNS patch doesn't patch Mac clients
Tiger, Leopard (still) wide open
Agentless Backup is Not a Myth
Apple was widely skewered for being among the last to fix a gaping security hole in the net's address lookup system that could allow the wholesale hijacking of users' internet connections. And now that the company has finally got around to issuing a patch, there's just one problem: it doesn't work on client versions of Mac OS X.
That's the vast majority of Mac installations.
Researchers from security firm nCircle and the SANS Institute both report that fully patched versions of Tiger (10.4.11) and Leopard (10.5.4) remain vulnerable even after running a bevy of patches Apple released Thursday. Other vendors, including Microsoft, Sun Micro, released similar patches weeks ago.
Both researchers found that OS X clients fail to adequately randomize DNS source ports, allowing attackers to poison the caches of DNS servers that run on the operating system.
"So Apple might have fixed some of the more important parts for servers, but is far from done yet as all the clients linked against a DNS client library still need to get the workaround for the protocol weakness," SANS handler Swa Frantzen wrote.
Given the ultra-insular culture at Apple, it's hard to know why engineers chose to patch some Mac versions and not others. It's possible they reckoned clients handle so few DNS queries that it didn't make sense. Or they may have overlooked it.
There's also the issue of performance. Macs use the popular Berkeley Internet Name Domain program to handle domain-name lookups, and Paul Vixie, the person who oversees the project recently said the DNS patch can slow down lookups under heavy loads.
It's not likely we'll find out why clients remain vulnerable to one of the most critical security bugs to come around in years. Apple representatives haven't answered a single one of our security-related queries in more than 18 months. ®
COMMENTS
@ Duncan
Seems like you are a case of Murphy's law of tools ...
If all you know is a hammer, then every other tool will look like a hammer, too, or at the very least belong to the family of hammers. Of course, your own hammer will always be a better hammer than all the other hammers. After all, how on earth are you supposed to drive a nail with that hammer they call a pencil.
Unix wouldn't be Unix without BSD
The reason why BSD and its modern derivatives are sometimes considered to be "real Unixes" and not just "Unix like" is that AT&T Unix incorporated a large amount of BSD code, not the other way round. Unix would not be Unix without BSD. In many areas BSD was the driving force and AT&T was the follower.
It is the irony of the lawsuit AT&T brought against the University of Berkeley that it revealed there was far more BSD code in AT&T Unix (thousands of files) than there was AT&T code in BSD (3 files). After the lawsuit was settled, Berkeley replaced the remaining AT&T code but AT&T continued to incorporate the BSD code.
Yes, BSD contains AT&T Unix code, but after the cleanup, only that code which AT&T took from BSD in the first place.
@ Duncan
"lets agree they belong to the same family?"
Not really. In the realm of operating systems, the term family is commonly used such that BSD systems are one family and GNU/Linux systems are another family.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
