Security Update 2004-09-30

[wdlove]

This is the first time being aware of this update. It just shows that Apple is looking out for us. Curently I'm on a PC, sorry.

 

[settledown]

TITANIUMDUCKY....

Actually, it did seem to fix a problem I had where the Applications and Macintosh HD folders kept scrambling their icons.

Did your icons look like 4 really small folder icons all in side one icon??

This has been happening to me from time to time.

 

[Doctor Q]

All of these security updates make me wonder how many more security holes there are.

We don't really have to worry about how many security holes there are, only how many of them are known and being taken advantage of. So the only question is how soon you can and should get a patch after a security hole is discovered. Apple has chosen to close the holes fairly quickly with timely updates. That makes for more security updates, but doesn't indicate that there are more holes than if they let them collect and issued them in larger batches on a less frequent basis. As long as security updates take only a few minutes and involve a quick restart, Apple's scheme is better for us in the long run.

 

[FoxyKaye]

Actually, it did seem to fix a problem I had where the Applications and Macintosh HD folders kept scrambling their icons.

Thank goodness - I thought I was losing my mind, or that there was some low-level corruption going on that repairing permissions and doing various file restoration things couldn't fix. It's a silly, small, issue, but Jeez, I wish someone at Apple said something about this, it has been driving me nuts.

Good to know this handles the problem.

 

[Stewie]

versus my Windows XP box that forgot all peripherals, driver reinstalls required, and crashed on every major security update-- so happy to be m$ free!!

.. btw is windows media player reliable on OS X? I'd rather avoid MS totally having broken free after too many decades.

Try VLC and/or MPlayer. With these 2 (free) apps you should be able to play 99% of the windows media files and not have to worry about installing the player.

Although I have had no problems with windows media play on my powerbook, I avoid using it at all cost. Just on principle.

 

[_The_Man_]

It seems that nobody noticed the seriousness of the QuickTime issue. Because of a buffer overflow it alows the execution of arbitrary code hidden in a BMP image. That is the same as the JPEG exploit few weeks ago on Windows, just on a BMP file instead of a JPEG. So much about Apple security and quality control being better. I am sad to say this but Apple is begining to resemble Microsoft waay too much.

Just as the pigs began to look like humans... All of those who read Orwell's Animal Farm know what I'm talking about.

 

[billyboy]

It seems that nobody noticed the seriousness of the QuickTime issue. Because of a buffer overflow it alows the execution of arbitrary code hidden in a BMP image. That is the same as the JPEG exploit few weeks ago on Windows, just on a BMP file instead of a JPEG. So much about Apple security and quality control being better. I am sad to say this but Apple is begining to resemble Microsoft waay too much.

where do you get a bmp image with this one-click executable code from?

 

[karabunga]

Well after i installed it, my computer started to go at a snail's pace. Everything. it took me about 6-8 minutes to start up (it kinda got stuck at starting the login window, but it might have been stuck because it had to change screens), another 5 before i could click anything, then when i did click something i got the rotating frisbee for a while, then to open any application another 5. This has probably something to do with the update since i havent experienced this before i installed it.

i have a G4 imac 800Mhz running Mac OS 10.3.5

 

[_The_Man_]

billyboy: You could get it from anywhere. It's an image file as any other except the hidden code. You could get it by mail, load it somwhere on the internet or anytihing like that. That's why it's so dangerous. I don't know the exact details of the vunerabilty so I'd rather not go into details as I don't know if Safari loads it's pics via QuickTime, but I suppose it does. Luckily Apple fixed this soon enough, I have not yet seen a proof of concept let alone a real exploit on the net.

 

[C-Mezak]

Try repairing from the CD-ROM.

Eep!

From what I've heard that is not the thing to do. Especially after so many updates, the cd-rom based permission repairs are not going to be accurate. If its absolutely necessary, do it, but otherwise it might do mroe harm than good.

charlie

 

[melgross]

How Fast?

Actually, I'd say "yes", but the real answer is "no".

Windows Update runs automatically, and I occasionally get a pop-up from the system tray when I log in that says "New updates have been downloaded. Click here to install."

Why is this a joke? What are you doing wrong?

(and, when I download manually I typically get about 1 mega-byte per second from the Windows download servers....)

Aiden, a megaBYTE per second? Or a mega bit per second?

What is your broadband speed? It would have to be at least 9 mega bits per second (including overhead), but more likely 10 to get one megabyte per second

I also installed the update.

1 B/W G3
2 AGP G4
2 Digital Audio G4

All ok.

 

[bousozoku]

Eep!

From what I've heard that is not the thing to do. Especially after so many updates, the cd-rom based permission repairs are not going to be accurate. If its absolutely necessary, do it, but otherwise it might do mroe harm than good.

charlie

A broken Disk Utility on the hard drive isn't very good either, is it? At least, if it's possible to use the CD-ROM to repair Disk Utility on the hard drive to repair permissions afterwards, it would be a step in the right direction.

 

[iMan]

Update installed

All systems go.

Everything seems to run smoothly on my PB 15" 1.25

Still not used to all these security patches from Apple though...

 

[AidenShaw]

Aiden, a megaBYTE per second? Or a mega bit per second?

What is your broadband speed?

A pair of teamed OC-3 (310Mbps total) fibres to an OC-12 (622 Mbps) uplink.

That's at work, home is only a T-1.

 

[melgross]

A pair of teamed OC-3 (310Mbps total) fibres to an OC-12 (622 Mbps) uplink.

That's at work, home is only a T-1.

That's not fair Aiden. Want to share? I'm only at 3Mbps, though at least I'm on PPPOA not PPPOE.

 

[hoosker]

Do you have to apply the previous updates too?

I am not sure if you need to apply all the secruity updates in the order that they came available (does it matter) or whether applying the latest update includes all the previous updates too. In my situation I am behind several updates and not sure the correct way to go.

 

[melgross]

Applying security updates

I am not sure if you need to apply all the security updates in the order that they came available (does it matter) or whether applying the latest update includes all the previous updates too. In my situation I am behind several updates and not sure the correct way to go.

Generally, you cannot apply any update, security or otherwise, if a previous one is required first. These updates appear in the order that they were released. But, often this also means that they must be installed in that order as well.

If a newer security update appears that contains the previous one in it, then the previous update will not appear in your updates panel. If they do, then it is advised that you apply all of them.

You can always wait a few days before applying updates to ascertain whether they are "good". If not, Apple will usually pull it shortly after release.

A security update may not appear if you are using an older version of any software that the update is meant to secure. When, and if, you do update that software, then the security update will appear.

I hope this helps.

 

[hoosker]

Thanks melgross

That makes sense. I usually download the full installer vs directly update so I can update my computer at home too (modem at home-fast work connection). I try to keep my 2 G5s runnng at the same system to avoid problems but I do seem to get behind, and end up with several updates I have not applied and it does get confusing as to which ones I have applyed and which ones to apply first if there are several. Not to mention the apps and java updates too. If one was applied out of order would the installer be smart enough to know or would it matter? Or what if I had allready applied and update but forgot and tried to apply it again. It would help if each security update would list previously released updates that are required before the current one is applied. Going to Apples Security Update page does not seem to address this question.

 

[melgross]

UCP

That makes sense. I usually download the full installer vs directly update so I can update my computer at home too (modem at home-fast work connection). I try to keep my 2 G5s runnng at the same system to avoid problems but I do seem to get behind, and end up with several updates I have not applied and it does get confusing as to which ones I have applyed and which ones to apply first if there are several. Not to mention the apps and java updates too. If one was applied out of order would the installer be smart enough to know or would it matter? Or what if I had allready applied and update but forgot and tried to apply it again. It would help if each security update would list previously released updates that are required before the current one is applied. Going to Apples Security Update page does not seem to address this question.

If you update directly from the update control panel then Apple checks your machine to learn what updates you need, and only downloads those.

If you download updates from work and bring them home, then you are bypassing the control built into the system. Under those circumstances you might not have updates that you need, and some that you do have you might not need.

The best thing to do then is to open the Software update panel and let it find the new updates. If they coincide with yours, then install them in the order that they appear in the panel.

If you download a security update for the latest release of Java, for example, at work, because you have installed it there, but have not installed it at home, then the software update panel will show both the Java update as well as the security update for it.

Click on each update, and the panel will tell you what it is for.

If you have already applied any updates, even if you have installed them manually, then the software panel will see that, and they will not appear. The update itself will usually not re-install over itself, and SHOULD let you know if a newer one is already present.

But always let the software update panel check first. Then quit it.

 

[hoosker]

Software update panel--of course!

Yes I see what you mean using the Software update panel to determine what is needed even if you choose not to download (for any Mac that has a net connection that is -if my home computer was not connected it would not be so easy).

Great --I will try this method.

thanks again melgross

 

[melgross]

Re. Update Panet

We are here to serve.

 

[Kern]

Networking difficulties?

Has anyone experienced networking difficulties after installing Security Update 2004-09-30? I can't tell if ours are causal or coincidental. We installed the update and immediately lost the ability to see FileMaker Pro files over our LAN *and* access them through the web. Anyone have any ideas how to resolve this?

 

[dcollierp]

My Mail application on both computers respond better. I have noticed that when I clicked on the "File" menu in Mail there was a delay of 2-3 seconds before the menu would show. This problem was on both computers but with this update it is resolved. A nice unexpected treat!

 

[wdlove]

We don't really have to worry about how many security holes there are, only how many of them are known and being taken advantage of. So the only question is how soon you can and should get a patch after a security hole is discovered. Apple has chosen to close the holes fairly quickly with timely updates. That makes for more security updates, but doesn't indicate that there are more holes than if they let them collect and issued them in larger batches on a less frequent basis. As long as security updates take only a few minutes and involve a quick restart, Apple's scheme is better for us in the long run.

I agree Doctor Q, well said. That is important that they are on guard.

 

[jecrawford]

Mmm. I'll see what the reports are in a few more hours before I push the update button...

Have any cautious updaters tried SuperDuper from Shirt Pocket? (http://www.shirt-pocket.com/) with its Safety Clone feature. It looks as if it might help.

Any comments?

I have installed all Apple's updates regularly without any noticeable problems (but havn't yet used SuperDuper).

John