Apple patch fiasco invites trouble

Original URL: https://www.theregister.com/2005/08/19/apple_patches/

It's just a matter of time...

Posted in Channel, 19th August 2005 09:53 GMT

According to the Apple website, Security Update 2005-007 was released to the public on August 12, 2005. And, as with all of their recent security updates, it is available to all Apple customers free of charge. I'm sure none of you reading this article will argue with me about that being a good thing.

For those of you that remember, Apple included some security patches in their release of Mac OS X Panther in 2003. These security patches were originally exclusive to Panther, and users of Mac OS X Jaguar were unable to obtain these updates without paying for an upgrade to the newer version. Whether this was done intentionally or not is still a mystery, as updates were released for Jaguar after various discussions in the media and within the security industry caused enough backlash to force a change.

What's interesting here is that Apple has chosen to release updates for both the most and second-most current release of their operating system since this initial incident in 2003. As an example, this most recent Security Update contains updates for Tiger (10.4.x), as well as Panther (10.3.x). This is a good thing, and shows that the Apple product security team is making changes and evolving to fit the needs of their customers.

However, Apple still has a long way to go. The time that it takes Apple to release patches for some publicly disclosed vulnerabilities in open source components of their operating systems is nothing less than abysmal, and it's only a matter of time before continued evolution of their security practices can be preemptive, and not reactionary.

We'll release when we're ready

On the Apple Product Security web page, the following is written with regard to Apple's policy on security notifications for their products.

"For the protection of our customers, Apple does not disclose, discuss or confirm security issues until a full investigation has occurred and any necessary patches or releases are available."

This policy is similar to that used by Microsoft, who only recently began to release interim "Security Advisories" for certain events, including the public confirmation of vulnerabilities for which no patch is available.

The fact is, these operating system vendors can take a long time to patch security vulnerabilities once they're notified of the problem. Unfortunately, there's a big difference between Apple and Microsoft when it comes to bugs in their operating system. I would argue that Microsoft is in a far more advantageous position, oddly enough, because their operating system doesn't contain so much open source software.

Time to patch

As can be seen on the eEye Digital Security Upcoming Advisories web page, Microsoft is currently sitting on a substantial number of vulnerabilities, including a critical issue that was disclosed to them nearly five months ago.

The closed source and un-shared nature of the Microsoft Windows code base gives Microsoft the luxury of taking such a long time to patch vulnerabilities that are reported to them. They can spend a year developing, testing, and rolling out patches, and aside from the group of people that reported the issue, as well as perhaps a small group of black hats that have also discovered the issue (they're out there somewhere), the public and majority of would-be attackers will be clueless as to the nature of the vulnerability, and as such, are unable to exploit it.

Apple, on the other hand, is in a different boat. Many of the vulnerabilities that affect OS X are open source, and as such, technical information regarding the issue is publicly disclosed on a different timeline, and more importantly, a timeline that's completely out of Apple's control.

This situation is a virtual gold mine for attackers. When important vulnerabilities are publicly released on one timeline, and then patched on another, a window of opportunity is created where attackers can develop exploits for OS X using publicly announced vulnerabilities, for which no vendor-supplied patch is available. Attackers are handed the vulnerabilities on a silver platter, and the open source nature of the affected components takes all of the guess work out of the vulnerability itself. Sure, exploiting the vulnerability may be another story, but more than half the battle is lost when an attacker already has a component to attack, and knows that he will likely be provided the luxury of several months (or in some cases longer) before a patch is available for the operating system that he's targeting.

Let's look at some real-world examples of this window of opportunity for the vulnerabilities patched in Apple Security Update 2005-07:

The MIT Kerberos 5 Administration Library Add_To_History Heap-Based Buffer Overflow Vulnerability, disclosed on December 20, 2004. That's almost an eight-month window.
Two other heap-related vulnerabilities in MIT Kerberos disclosed on July 12, 2005. Just over a one month window.
The LibXPM Bitmap_unit Integer Overflow Vulnerability, disclosed on March 2, 2005. That's almost a five month window.
The Zlib Compression Library Decompression Buffer Overflow Vulnerability, disclosed on July 21, 2005. Almost a one month window.

Sure, these vulnerabilities aren't prime candidates for Windows-esque mass and widespread exploitation, however, if I used OS X, this data wouldn't exactly make me feel very comfortable.

The future is before us

Apple's OS X operating system is continuing to become more and more popular. In fact, the next computer that I buy for my wife will almost certainly be a Mac. However, there is a price to popularity. The more popular something becomes, the more attractive of a target it is for black hats. And with Apple's forthcoming transition to Intel-based hardware, it's only going to get worse. Ultimately, hacking OS X will no longer be the "Black Art" that it is today.

On the Windows front, vulnerabilities are being exploited very quickly after they're announced publicly. Most of the time, Microsoft has the luxury of releasing patches at the same time the vulnerabilities are disclosed, but this still doesn't abate the forthcoming onslaught of exploitation. What does Apple have to look forward to when they start to receive this sort of attention?

The one thing that OS X does have going for it is a solid foundation, so we can be reasonably sure that it won't face the quantity and severity of vulnerabilities that we've seen littered within Windows. But there will be vulnerabilities, and some of them will be severe, and with the current patching speed for OS X, this paints a pretty scary picture.

In the end, once OS X starts to receive serious attention by black hats, Apple's security team will need to seriously shape up their patch release schedule. Only time will tell if this will be a preemptive change, or a reactionary one.

Jason Miller manages the Focus IDS area for SecurityFocus and is a threat analyst for Symantec Corporation.