Attack exploits just-patched Mac security bug
Fix my browser, fan pleads
Agentless Backup is Not a Myth
If you haven't installed the latest security update for Mac OS X, now would be a good time.
A security researcher has released a proof-of-concept attack that exploits critical vulnerabilities that Apple patched on Thursday. The vulns stem from bugs in the Java runtime environment that allow attackers to remotely execute malicious code. Sun Microsystems patched the flaws early last month.
"I know that having a POC in hand bumps Apple's priority, so I sent them the POC and made them aware of the issue," said the researcher, Kevin Finisterre, a co-founder of security firm Netragard. "I honestly wanted my browser fixed."
Finisterre said he read through the patch details and researched where in OS X he thought the bug would be located. He sent the exploit to Apple employees on November 6, three days after Sun released a Java patch for Windows, Linux, and Solaris. Now that Apple has finally fixed the bug, he has gone ahead and made the code public.
The exploit is fairly rudimentary, but Finisterre said he plans to weaponize it soon. For the moment, browsers on unpatched systems that hit the exploit will crash. Behind the scenes, though, users will find their extended instruction pointers have been set to 0x41424344, a value that indicates a machine has been compromised.
The code will also exploit unpatched Windows machines, Finisterre said. Turns out Java's write-once-run-anywhere promise really is real. ®
COMMENTS
For Virtual Coup d'Etats Heroes .... Popular Pirates and Valiant Villains
Oh, and can you imagine what happens when such Savvy Ken migrates to foreign and/or renegade teams, if ignored in the home team dressing rooms?
Give it rest, please?
Why is it when they find a problem in Linux and OSX, then patch it, the world goes mental about it! "The sky's falling! The sky's falling!".
Problems on Windows? Yeah, yeah, just another problem, just another day, just another patch to heap on the others.
FFS! The marketers are the only ones who believe this tripe about Linux and OSX being perfect and having no problems, the rest of us in the real world know our Linux and OSX systems are riddled with imperfections!
Knock it off eh? Problem got found, problem got fixed. No story! Nothing to see!
actually...
Not quite: historically, Apple has lagged behind everybody else Java updates-wise.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
