Feeds

Apple security lags (again) with critical Java patches

A month late, an OS short

Providing a secure and efficient Helpdesk

Comment Apple is once again playing security catch-up to the rest of the computing world, this time with an update for the Leopard version of its Mac operating system that patches critical holes in Java that were fixed on competing systems 29 days ago.

The patch updates Leopard to Java versions 1.6.0_15, 1.5.0_20, and 1.4.2_22, which Java creator Sun Microsystems released on August 5. No doubt, the four-week turn-around time is better than an update from June, when Apple trailed Sun by six months, but it's still problematic.

What's more, according to these specifications Apple posted in June, Tiger - the Mac OS X version that predated Leopard - continues to use Java versions 1.5.0_19 and 1.4.2_21, the same buggy iterations it warns could allow attackers to hijack end-user machines.

"Multiple vulnerabilities exist in Java 1.5.0_19, the most serious of which may allow an untrusted Java applet to obtain elevated privileges," Apple said in Thursday's advisory. "Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user."

The advisory uses the same language to warn about vulnerabilities in Java 1.4.2_21.

It wouldn't be surprising for Apple to issue an update patching vulnerable Tiger machines soon. But a delay is nonetheless problematic in that it's a tacit admission from Apple - a company that repeatedly flogs the security superiority of its products - that an OS it continues to support is susceptible to vulnerabilities even its own engineers say puts its users at considerable peril.

The larger issue is that Apple continues to lag well behind its peers in fixing critical security bugs in a piece of software that runs on a majority of the world's computers and whose mantra is "write once run anywhere."

The Apple marketing machine can say what it wants about the supposed security of its products. And as we pointed out last week, the company has plenty to be proud of in Snow Leopard, its latest and greatest Mac OS. But until the company does a better job of keeping up with the rest of the pack updating OS X Java, Mac users are being needlessly exposed to serious threats. And no advertising campaign can change that. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.