Apple Issues Network Time Protocol Security Fix for OS X Users

MacRumors · Dec 22, 2014

Apple today released a new security update that's designed to address a "critical security issue" with the Network Time Protocol service on OS X. Apple recommends that all Yosemite, Mavericks, and Mountain Lion users install the update "as soon as possible."

The update appears to address a problem that was highlighted by the U.S. Government on Friday, December 19 and originally discovered by the Google Security Team. The vulnerability has the potential to allow an attacker to execute arbitrary code using the privileges of the ntpd process.

Google Security Team researchers Neel Mehta and Stephen Roettger have coordinated multiple vulnerabilities with CERT/CC concerning the Network Time Protocol (NTP). As NTP is widely used within operational Industrial Control Systems deployments, NCCIC/ICS-CERT is providing this information for US Critical Infrastructure asset owners and operators for awareness and to identify mitigations for affected devices. ICS-CERT may release updates as additional information becomes available.

These vulnerabilities could be exploited remotely. Exploits that target these vulnerabilities are publicly available.

Products using NTP service prior to NTP-4.2.8 are affected. No specific vendor is specified because this is an open source protocol.

Apple has faced several vulnerabilities over the course of 2014, most recently releasing an OS X bash update in September to fix the "Shellshock" security flaw. Today's security update can be downloaded from the Mac App Store.

Update: As noted by Reuters, this update marks the first time Apple has deployed an automatic security update, which can be installed without user authorization.

Article Link: Apple Issues Network Time Protocol Security Fix for OS X Users

Michaelgtrusa · Dec 22, 2014

This one's probably well needed. I will install asap.

macintologist · Dec 22, 2014

Installed. Done. Easy peasy

AaronM5670 · Dec 22, 2014

macintologist said:
Installed. Done. Easy peasy

It's only 1.4MB (late 2013 iMac) so no problems whatsoever!

ghostface147 · Dec 22, 2014

AaronM5670 said:
It's only 1.4MB (late 2013 iMac) so no problems whatsoever!

1.4? I can install it using my floppy drive.

AaronM5670 · Dec 22, 2014

ghostface147 said:
1.4? I can install it using my floppy drive.

Yup!

Windlasher · Dec 22, 2014

You have to love the ingenuity / desperation of hackers. Instead of getting a job or writing code that would actually be useful and that people would pay for, they sit around figuring out the most obtuse ways to exploit a computer.

When a stupid game like Flappy Birds can make 20K per day, I'm hard pressed to believe that hacking computers and sending out SPAM is more profitable.

AaronM5670 · Dec 22, 2014

Windlasher said:
You have to love the ingenuity / desperation of hackers. Instead of getting a job or writing code that would actually be useful and that people would pay for, they sit around figuring out the most obtuse ways to exploit a computer.

When a stupid game like Flappy Birds can make 20K per day, I'm hard pressed to believe that hacking computers and sending out SPAM is more profitable.

Plenty of people out there that try with those scam eBay/PayPal/Apple emails and so on. It really is depressing just to know that there are some who dedicate almost all of their time to trying to reap from the misfortune of others online.

Slix · Dec 22, 2014

Good to see a security fix so quick. Installed, easy and quick.

logicstudiouser · Dec 22, 2014

Is Snow Leopard impacted?

cerote · Dec 22, 2014

Windlasher said:
You have to love the ingenuity / desperation of hackers. Instead of getting a job or writing code that would actually be useful and that people would pay for, they sit around figuring out the most obtuse ways to exploit a computer.

When a stupid game like Flappy Birds can make 20K per day, I'm hard pressed to believe that hacking computers and sending out SPAM is more profitable.

Sometimes they are not out there for the money. Some just want control of the computer to do stuff or to gain as much personal info they can for various reasons. Lots of money in that also in some markets. But yea they do find clever ways around a system through.

Windlasher · Dec 22, 2014

AaronM5670 said:
Plenty of people out there that try with those scam eBay/PayPal/Apple emails and so on. It really is depressing just to know that there are some who dedicate almost all of their time to trying to reap from the misfortune of others online.

I'm having a hard time believing that it is actually motivated by money as much as it used to be since there are so many (easier) ways to make money online.

I believe that it has to be some sort of degenerate psychosis created by the anonymity of the internet. People have evolved over the last 20 years or so as the internet evolved to take pleasure in the misfortune of others. Its almost like the thrill of hacking a computer and knowing that you have ruined lives without being caught is the thing and the money is just the icing on the cake.

scaredpoet · Dec 22, 2014

logicstudiouser said:
Is Snow Leopard impacted?

Yes.

On Snow Leopard you have two options:

1. Upgrade OS X
2. Install Xcode if you haven't already, and use brew, macports or compile the fixed ntp direct from source code to update it.

Junipr · Dec 22, 2014

Windlasher said:
You have to love the ingenuity / desperation of hackers. Instead of getting a job...

You have to love that in 2014 people still equate hacking to unemployment.

Badagri · Dec 22, 2014

cerote said:
Sometimes they are not out there for the money. Some just want control of the computer to do stuff or to gain as much personal info they can for various reasons. Lots of money in that also in some markets. But yea they do find clever ways around a system through.

Plus the fact it's a big game.

Four oF NINE · Dec 22, 2014

Done.

Thanks for the heads up, MR

J. Jizzle · Dec 22, 2014

Installed this update. No issues while installing.

OLDCODGER · Dec 22, 2014

scaredpoet said:
Yes.

On Snow Leopard you have two options:

1. Upgrade OS X
2. Install Xcode if you haven't already, and use brew, macports or compile the fixed ntp direct from source code to update it.

I simply turned off auto-update, and made a note to briefly turn it back on once a month.

duervo · Dec 22, 2014

Windlasher said:
I'm having a hard time believing that it is actually motivated by money as much as it used to be since there are so many (easier) ways to make money online.

I believe that it has to be some sort of degenerate psychosis created by the anonymity of the internet. People have evolved over the last 20 years or so as the internet evolved to take pleasure in the misfortune of others. Its almost like the thrill of hacking a computer and knowing that you have ruined lives without being caught is the thing and the money is just the icing on the cake.

Evolution takes a lot longer than a mere twenty years.

If that's all it takes, then I can't wait till I grow some gills so that I can finally breathe underwater.

At any rate, the type of people you describe did not "evolve" or change due to the Internet. They have always been the type of person they are, and if the Internet wasn't around, they would find some other way to satisfy whatever need they have.

nissan.gtp · Dec 22, 2014

nice and fast, no reboot. that's my kind of update

archtopshop · Dec 22, 2014

logicstudiouser said:
Is Snow Leopard impacted?

Yes it is, but apparently Apple no longer cares about the security of their Snow Leopard and Lion customers. You either upgrade your perfectly good software (if you can) or you're on your own.

Well, you could just buy a new Mac, which is what Apple wants you to do anyway.

tywebb13 · Dec 22, 2014

Here are the links:

Yosemite:

http://swcdn.apple.com/content/down...rhk71sugqqfuzgojq6lwg0s/NTPUpdateYosemite.pkg

Mavericks:

http://swcdn.apple.com/content/down...m82vcazio5r7p9wienvf8c/NTPUpdateMavericks.pkg

Mountain Lion:

http://swcdn.apple.com/content/down...71kg0zyyj7wza9kr140/NTPUpdateMountainLion.pkg

UPDATE:

Apple have now posted them onto their support website:

Yosemite:

http://support.apple.com/kb/DL1782

Mavericks:

http://support.apple.com/kb/DL1783

Mountain Lion:

http://support.apple.com/kb/DL1781

Yakibomb · Dec 22, 2014

nissan.gtp said:
nice and fast, no reboot. that's my kind of update

I didn't even have to quit any of my open apps, I wish more updates where like this

rdlink · Dec 22, 2014

ghostface147 said:
1.4? I can install it using my floppy drive.

Not your 1.2 floppy...

----------

archtopshop said:
Yes it is, but apparently Apple no longer cares about the security of their Snow Leopard and Lion customers. You either upgrade your perfectly good software (if you can) or you're on your own.

Well, you could just buy a new Mac, which is what Apple wants you to do anyway.

Snow Leopard is approaching being 6 years old...

Here's another option for you: Turn off automatic time synching on Snow Leopard.

ttss6 · Dec 22, 2014

My Mac notified me that it had already been downloaded and installed. Technology these days is so cool!

Apple Issues Network Time Protocol Security Fix for OS X Users

macrumors bot

macrumors 604

macrumors 6502a

macrumors 6502a

macrumors 601

macrumors 6502a

macrumors 6502

macrumors 6502a

macrumors 65816

macrumors 6502a

macrumors 6502a

macrumors 6502

macrumors 604

macrumors regular

macrumors 6502a

macrumors 68000

macrumors regular

macrumors 6502a

macrumors 68020

macrumors 6502

macrumors regular

macrumors 68030

macrumors 6502

macrumors 68040

macrumors 6502

Our Staff