- Nokia's new N97 vs. the iPhone
- 10 Microsoft research projects
- Hard to get justice in MySpace case
- Smartphone smackdown: Storm vs. iPhone
- Apple removes antivirus support page
Apple has at last issued a patch for the DNS (Domain Name System) flaw considered one of the most dangerous vulnerabilities ever to affect the Internet.
On Friday, Apple posted a security advisory saying that the patch will fix Apple's implementation of the Berkeley Internet Name Domain (BIND) DNS server in Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.4 and Mac OS X Server v10.5.4.
The DNS flaw allows an attacker to execute a cache poisoning attack, where traffic to a legitimate domain name is redirected to a malicious one after an attack on a DNS server. The user can type in the correct name for a Web site, but get a fake one instead, which can enable a phishing attack. While some users might notice if they're directed to a odd-looking Web page, many people could be successfully fooled.
Apple is among a handful of companies that security experts have said moved far too slow in reacting to the DNS bug. Other vendors, including Cisco and Microsoft, had patches ready when the existence of the flaw was disclosed on July 8. But some network administrators have reported compatibility problems with those early patches.
ISPs and major vendors with either DNS software or DNS services applied patches after the flaw's discoverer, security researcher Dan Kaminsky, coordinated a secret patching effort.
Details of how to exploit the flaw were eventually leaked on July 21, making those with still-unpatched systems especially vulnerable.
Many ISPs still have not patched their systems, and Kaminsky said those companies are moving far too slow given the danger the vulnerability poses. Some attacks have been reported.
Apple has also wrapped a dozen other fixes in the security update. The fixes can be downloaded individually or the "software update" feature can be used in OS X to download the whole batch.
Rss FeedRss Feed
Partner Content
Brilliantly simple security and control solutions for email, web and endpoint
www.sophos.com
Stopping data leakage
Learn how to exploit your current security investment to control the information that flows into, through and out of your network.
Download the white paper.
Why detection rates aren't enough
Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.
Download the white paper.
Applications: taking back control
Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.
Learn more today.
Comments (2)
It's their I don't really care attitiudeBy Anonymous on August 1, 2008, 4:28 pmJust like their "Stoner Mac guy" in the Mac ads on TV, he has a "I don't really care" attitude much like the direction of the company these days. I am not surprised...
Reply | Read entire comment
Why Now???By Anonymous on August 1, 2008, 10:15 amWhy is Apple only doing the security patches now? Even though it's always better late than never, does this shows Apple's attitude to security issues concerning...
Reply | Read entire comment
View all comments