The Security Side of the Mac OS X 10.6.6 Update
Everyone is focusing on the fact that the Mac OS X 'Snow Leopard' 10.6.6 update comes with the Mac App Store. Few are focusing on the security side of the update – and for good reason I may add. The 10.6.6 update is rather unimpressive from a security point of view as it comes with a single security fix that affects Software Update.
Here are the details Apple released about this security fix:
“A format string issue exists in PackageKit's handling of distribution scripts. A man-in-the-middle attacker may be able to cause an unexpected application termination or arbitrary code execution when Software Update checks for new updates. This issue is addressed through improved validation of distribution scripts. This issue does not affect systems prior to Mac OS X v10.6.”
If left unpatched, this security issued could allow a man-in-the-middle attacker to cause an unexpected application termination or arbitrary code execution. Credit for uncovering this vulnerability goes to Aaron Sigel of vtty.com.
The aforementioned Mac App Store was announced by Apple back in December; at the time Apple said it would release the Mac App Store to the public (Mac OS X users in over 90 countries) on the 6th of January. That is precisely what happened – on the 6th of January the Mac App Store went live. Users who got the Mac OS X 10.6.6 update, a 115 MB update, got access to the Mac App Store which is home to more than 1,000 free and paid apps.
At the Mac App Store’s launch, Apple CEO Steve Jobs said “we think users are going to love this innovative new way to discover and buy their favorite apps.” Turns out he was right. Proof of that is the fact that in just one day after the launch of the Mac App Store, more than 1 million downloads were recorded. That prompted Steve jobs to say “We’re amazed at the incredible response the Mac App Store is getting. Developers have done a great job bringing apps to the store and users are loving how easy and fun the Mac App Store is.”
Here are the details Apple released about this security fix:
“A format string issue exists in PackageKit's handling of distribution scripts. A man-in-the-middle attacker may be able to cause an unexpected application termination or arbitrary code execution when Software Update checks for new updates. This issue is addressed through improved validation of distribution scripts. This issue does not affect systems prior to Mac OS X v10.6.”
If left unpatched, this security issued could allow a man-in-the-middle attacker to cause an unexpected application termination or arbitrary code execution. Credit for uncovering this vulnerability goes to Aaron Sigel of vtty.com.
The aforementioned Mac App Store was announced by Apple back in December; at the time Apple said it would release the Mac App Store to the public (Mac OS X users in over 90 countries) on the 6th of January. That is precisely what happened – on the 6th of January the Mac App Store went live. Users who got the Mac OS X 10.6.6 update, a 115 MB update, got access to the Mac App Store which is home to more than 1,000 free and paid apps.
At the Mac App Store’s launch, Apple CEO Steve Jobs said “we think users are going to love this innovative new way to discover and buy their favorite apps.” Turns out he was right. Proof of that is the fact that in just one day after the launch of the Mac App Store, more than 1 million downloads were recorded. That prompted Steve jobs to say “We’re amazed at the incredible response the Mac App Store is getting. Developers have done a great job bringing apps to the store and users are loving how easy and fun the Mac App Store is.”
