US Government warns of Apple flaw

Daily Newsletters

Sign up to ZDNet UK's daily newsletter.

Topics

Apple, Mac OS X

NEWS

The US Government has added its weight to warnings about a vulnerability in Apple's Mac OS X.

The US computer emergency response team, US-CERT, issued an alert on Thursday, reporting a failure in the way OS X handles corrupted disk image files for Macs using the DMG format. CNET News.com first reported the vulnerability on Tuesday.

A disk image is a digital representation of the contents and structure of a storage device such as a CD or DVD. According to US-CERT, the vulnerability in OS X may allow an attacker using malformed DMG files to corrupt system memory in a way that could allow arbitrary code execution or cause a denial of service.

The news of the vulnerability has caused fierce debate among Mac supporters and detractors. Various News.com readers were incensed that the vulnerability had been reported as remotely exploitable, reasoning that to download a DMG file would require user interaction.

The researcher who found the vulnerability claimed it is remotely exploitable as Apple's Safari browser can be set to automatically open DMG files downloaded from external sources. The researcher claimed this can be prevented by changing the browser preferences and deactivating the functionality for opening "safe" files after downloading.

However, the US-CERT vulnerability note said the organisation was "currently unaware of a practical solution to this problem".

Talkback

Ah... the US Government has issued a warning. How comforting. This from the organization that told us that the internets were a series of tubes.

Why don't they focus on governing? Or has that become too difficult for them in this day-and-age?

moofer 24 November, 2006 22:17
Reply

Mac OS X is being targeted because Vista is about to be released. Microsoft is scared, it knows its operating system sucks, but instead of making theirs better, they are hoping to make the Mac OS X look bad.

The fact is Malware & Viruses exist and have destroyed many a PC.

There are very few PC users online today who have not had gotten a virus.

The fact is there is no Malware or Viruses for the Mac OS X.

There are no Mac users online today that have experienced a virus on Mac OS X... ever. This may change someday, and perhaps it has, but it still leaves the majority of us untouched.

Almost every person for a PC. None, or virtually none for the Mac.

The majority of people aren't into computers enough to realize that all these "flaws" security firms find are completely different from the actual viruses that bring down systems for Windows XP. And the fact that most PC owners have enjoyed a virus, while mac users remain untouched.

Security companies have vested interested in getting people scared, to sell anti-virus programs.

Another "flaw" link: http://www.securityfocus.com/brief/366

mbookmeyer 25 November, 2006 17:33
Reply

Time and time again ZDNET, how about a balanced approach for a change?

So you actually have to download and open a corrupt .dmg file? Remember one of the latest updates from Apple disables the 'open'safe' attachments' option by default so the only scenario where this could be exploited would be:

1: The user re-enables the 'safe attachemnts' option
2: The user downloads a crafted .dmg file

Hardly a remotely exploitable flaw, how about a fair and balanced comparison between the ongoing windows holes and serious vulnerabilities compared the handful of minor issues on OSX?

Give us a break ZDNET, get out of M$'s pocket.

longmover 26 November, 2006 12:22
Reply

Mac's have always had a great reputation for minmal exploits to the OS. Zdnet should be careful in how their reporting is placed into media without really checking through the facts of the flaws, that are released from Cert & other reporting agencies of computer flaws ... etc

Mircosoft will have the biggest share of flaws because it is the most widely used, if Macs was the most widely used it would be probably the most vulnerable OS.

The model between the two OS'es are totally different, so it's like comparing apples & oranges..

I would like it if Zdnet would take a more balanced way of reporting flaws in computer systems & not use headlines to cause extreme concern, when there is not that type of concern to the general computer user.

1000270967 27 November, 2006 13:36
Reply

Hi all,

Totally agree with the points about how the Mac platform has proven to be massively more secure than Windows. However, I'm afraid I don't accept that we've misreported this story. Perhaps it would help if I gave a little background information.

We initially decided not to cover the reported flaw earlier in the week, as we didn't want to make a big deal out of what appeared a minor problem. However, US-CERT's intervention meant that we couldn't ignore this issue, as I felt we had a responsibility to draw it to our readers' attention.

In an attempt to balance the story, we pointed out that some US readers had already weighed in and argued that the vulnerability wasn't serious.

Those of you who think we're rabidly pro-Microsoft could check out <A HREF="http://www.zdnet.co.uk/talkback/0,1000001161,39284841-39001084c-20083039o,00.htm">this talkback</A>, whose author sees an anti-MS bias. Hopefully the truth is nearer the middle.

Thanks for your comments :)

Graeme
News editor

Graeme Wearden 27 November, 2006 15:05
Reply

Is the headlines often can be too sensationalist, making the average user believe they might be in danger of something affecting them.
When in reality, nothing of the sort will actually happen for the majority of users. As they know howto get what they need.
Messing around with other things in their OS, which they don't understand, they don't want to do, as they don't know what they are doing, so they don't tend do it, they often ask an expert for advice to help them out.

Human behaviour and computers mean, the majority don't do more than they have been shown or have to do get the job done.

I'm not Anti-Microsoft nor pro them. They are ubiquitous and have worldwide presence. So even with a poor security model to their OS, it's out there and doing jobs & running businesses. They will be attacked every second & other OS'es will be attacked too. It's just Microsoft is easygame for anyone with any evil deed to do damage and make them look real bad. Microsoft is working on improving their security but I don't feel they will ever succeed in my opinion of achieving Bsd's unix record of exploits.

Mac OS & Linux have known holes & they are patched as soon as possible, these patches with the massive code base underneath even the patches create new holes.

To create fear in OS'es is not a good thing to do. I suggest create understanding of what needs to be done to have safe computing practices & advise users, howto help themselves protect themselves from whatever the issue(s) are to their computers.

Why not when writing have a 'fix' as part of the article, then this put's the user at ease of what to do to help themselves.

I only suggest to Zdnet keep the sensational reporting for things that can be sensational and worthy of the headline. Other than that keep this kind of reporting lower key.

1000270967 28 November, 2006 00:31
Reply

Firstly I'd like to thank Graeme for replying to my comment, it's good to know you guys are listening :)

I wish it wasn't the case but time and time again ZDNET articles on any potential OS X flaws are dramatised to the extreme. I'd just like to see less drama and more reasonable articles on all non-windows platforms.

How about an article comparing the number and frequency of Windows/MS flaws against OS X? I'd like to see a graph of windows viruses and malware v's Apple's for example...! Something an uneducated user can look at and get a reasonable, balanced view of the differences in security and stability of the two rivals.

Going on your headline you'll lead users to believe that potential flaws such as this are in the same league as some of the big all-timers in windows, this just isn't the case....

longmover 28 November, 2006 12:45
Reply

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

  • Login

Will not be displayed with your comment

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

Get ZDNet UK's daily newsletter

Enter your email address to sign up

ZDNet UK Live

Marg Menzies Harrison

Another grammar faux pas is the improper use of "you". When sitting down down in a restaurant, for example, I get cringe when the waitress...

37 minutes ago by Marg Menzies Harrison via Facebook on 10 flagrant grammar mistakes that make you look stupid
zdnetukuser

And NOW, folks, for Canonical's next trick... Kubuntu is late. Here's a pencil. Draw your own conclusions. cf.:...

1 hour ago by zdnetukuser on Linux Minterface
Moley

@kevinmchapman. The discussion here reflects the very significant number of users who really do like the traditional menu system and who wish to...

3 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint
kevinmchapman

Er, no... It is an efficient means of finding the application/file/setting you need in one place. The icons are a simply a fallback for when you...

5 hours ago by kevinmchapman on A tale of two distros: Ubuntu and Linux Mint
TerryRK

Isn't the provision of a text based search an admission by the developers that the mass of icons approach does not work? I don't need to use a...

6 hours ago by TerryRK on A tale of two distros: Ubuntu and Linux Mint
kevinmchapman

"Unity and GNOME 3 both abandon the old text-based cascading menus in favour of a graphical icon-driven system." Point truly missed. Both use a...

6 hours ago by kevinmchapman on A tale of two distros: Ubuntu and Linux Mint
TerryRK

whs001 - Thank you, I'm glad you liked the article. I absolutely agree with you on your first point. I should perhaps have made it clearer that...

7 hours ago by TerryRK on A tale of two distros: Ubuntu and Linux Mint
Dennis Nilsson

If we allow corporate interest to dictate the way our government circumvents due process against foreign entities then we should accept the same...

8 hours ago by Dennis Nilsson via Facebook on ACTA stumbles in Germany
GHar123

I totally dislike pirating of works, I fear that artists will be deterred from creating works if they think that they are going to get ripped off....

9 hours ago by GHar123 on ACTA stumbles in Germany
JCB33

How dare film makers, artists or anybody that invests in creativity stop us pirating their works for free. I want to be able to walk into my local...

15 hours ago by JCB33 on ACTA stumbles in Germany
Moley

@GrueMaster. I prefer horses for courses rather than one size fits all. I, and I suspect most other computer users, do not really wish to have...

17 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint
greycynic

The product that scares me every time I have to use it is the Office 2007 version of Excel. The first bug that I found was applying the median...

17 hours ago by greycynic on Ten flawed products that derail productivity
GrueMaster

Nice review and very informative. One thing I'd like to add (in reply to whs001's 1st question), the main reason to have the same interface from...

19 hours ago by GrueMaster on A tale of two distros: Ubuntu and Linux Mint
Frederick Wrigley

I'be been using Mint 12 since the RC came out, and I am far more happy with the Cinnamon, the Mate, and, yes (with extensions), theGnome 3...

19 hours ago by Frederick Wrigley via Facebook on A tale of two distros: Ubuntu and Linux Mint
bdantas

Excellent article. One small correction, though--although a fresh installation of Linux Mint 12 will, indeed, provide the user with a version of...

20 hours ago by bdantas on A tale of two distros: Ubuntu and Linux Mint
Alan Ralph

In related news, the ISPs club together to get the members of the Home Affairs Select Committee (ya goofed on that part, ZDNet UK) copies of "The...

21 hours ago by Alan Ralph via Facebook on MPs urge ISPs to take down terrorist material
Alan Ralph

In related news, the ISPs club together to get the members of the Home Affairs Select Committee (ya goofed on that part, ZDNet UK) copies of "The...

21 hours ago by Alan Ralph via Facebook on MPs urge ISPs to take down terrorist material
Moley

For Gnome 2 die-hards, it is possible to add icons to the bottom panel (or top top panel, if you prefer) which provide the exact Gnome 2...

21 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint
ramwellian

Your comments would seem pretty naive and immature. Your 'solution' appears to be, "gee, let's all just give in to the hackers and give them...

22 hours ago by ramwellian on Cloud computing security: no more oxymoron?
BugStalker

"Interesting thought ... If you installed Win7 as a dual boot on a machine that previously only had Linux, and it wrecked your Linux installation,...

22 hours ago by BugStalker on Windows 7 Declares War on GRUB