Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Apple Releases macOS Big Sur 11.3.1 With Fixes for WebKit Security Issues

Populus said:
Don’t get me wrong, I’m glad Apple addressed a security flaw with a new update, but as others said on the iOS 14.5.1 post, didn’t Apple discover this over the two months of the beta? I made a clean install hoping 11.3 would last a while... I could have waited a week before making this clean install
Click to expand...

the exploit was not disclosed in time, apparently.
 
  • Like
Reactions: Populus
Havoc035 said:
It sounds like it’s time for a rewrite if that’s the case. The impact of bugs like these is always surprisingly big.
Click to expand...


For example, here is code that causes an Integer overflow:
C: 
nresp = packet_get_int();
if (nresp > 0) {
response = xmalloc(nresp*sizeof(char*));
for (i = 0; i < nresp; i++)
  response[i] = packet_get_string(NULL);
}

When nresp = 1073741824, and sizeOfChar = 4, the malloc allocates a 0-length buffer inside the memory given to the code. This causes the loop to start writing into the code. Things like this can't be checked by the OS - only by the compiler, or the original programmer who should do a check for the xmalloc size. Unfortunately, C doesn't check to make sure this is valid code.
 
  • Like
Reactions: throAU, Morod and parth
bbeagle said:
For example, here is code that causes an Integer overflow:
C: 
nresp = packet_get_int();
if (nresp > 0) {
response = xmalloc(nresp*sizeof(char*));
for (i = 0; i < nresp; i++)
  response[i] = packet_get_string(NULL);
}

When nresp = 1073741824, and sizeOfChar = 4, the malloc allocates a 0-length buffer inside the memory given to the code. This causes the loop to start writing into the code. Things like this can't be checked by the OS - only by the compiler, or the original programmer who should do a check for the xmalloc size. Unfortunately, C doesn't check to make sure this is valid code.
Click to expand...
Could we safely assume that a Webkit engine written in Swift would be much more secure in this regard? If so, do you think Apple is planning to code their own new engine -in Swift- in order to make their operating systems more secure?
 
But fer sure, this must be a 0.2 kB patch that takes 0.1 milliseconds to apply, and doesn't need a restart? What the actual frack are they DOING with all that data garbage, and what is taking so long to install this crap? It is a creeping rot that becomes worse with time.
 
  • Like
  • Disagree
Reactions: robotica, 9927036, WannaGoMac and 2 others
And why can't these star programmers not fracking TEST their code properly BEFORE they ship their stuff? It's not like there aren't tools available…
 
  • Disagree
  • Like
Reactions: 9927036 and TiggrToo
Biglethal69 said:
Man I don’t understand if you can’t trust apple with their updates and why don’t you go and buy a windows machine I’m sure you’ll enjoy their updates every day.🙈
Click to expand...
Nah, just install Linux, and your updates are done on the fly. Just restart and you are done. As it should be.

WHAT is it that that takes HOURS in putting some files in place? I just don't get it.
 
  • Disagree
  • Like
Reactions: Biglethal69, 9927036 and TiggrToo
DotCom2 said:
I got a notice right after updating that the "Amazon Music App" is dangerous and will damage my computer and that I should move it to the Trash! WTH! Since I never use it anyway, I did move it to the trash but WTH?
Click to expand...
That's one way to get rid of the competition
 
sdz said:
Why the hell do I have to restart my computer for a browser?
Now it makes sense that people are switching over to alternatives like Firefox/Chrome
Click to expand...
You don't. You have to restart your computer because WebKit is a framework used by almost every other application on your system.

My house has a door that criminals might be able to open. To fix the problem, I'm going to add a different type of door on the side of the house.
 
  • Like
  • Haha
Reactions: Aggedor, WannaGoMac and Unregistered 4U
careful guys, my cisco vpn anyconnect doesnt work now. It was working today on 11.3. Once I did the upgrade to 11.3.1 it no longer works. I'm on an M1 mini
 
StevieD100 said:
The simple answer is not to install the release until a few weeks have elapsed.
Click to expand...
That's fine at the individual consumer level, but when you're administering thousands of machines at the enterprise level, and security patches included in the 11.3 release are REQUIRED to be installed immediately, this is not an option.
 
  • Like
Reactions: Anthony Sullivan
Normally, I'd make light of complaining about product improvements, but the safest thing to say is Apple does NOT list every fix so as many people as possible will take it.
 
Apple overflow bug #32,912,366
Will we ever learn?
No. We don't have to. We're Apple.
 
I'm not pleased to have to do another big update merely a week after I ran a a 6+GB update.
Apple should coordinate these things better.
 
bluecoast said:
Does anyone know why the equivalent fix is around 130 MB for the iPhone but nearly 2.5 GB for the Mac?
Click to expand...
Probably needed to patch recoveryOS which has Safari built-in, but I don't believe recoveryOS supports delta updates so that would require flashing the whole recoveryOS image.
 
  • Like
Reactions: bluecoast
randyhudson said:
You don't. You have to restart your computer because WebKit is a framework used by almost every other application on your system.

My house has a door that criminals might be able to open. To fix the problem, I'm going to add a different type of door on the side of the house.
Click to expand...
We have been making doors for more than forty years. Why can't we get it right before we put it on the market?
 
  • Like
Reactions: Morod
11.3.1 seems to have fixed streaming audio to my stereo-paired HomePods. It was terrible with 11.3! Working great with this update. Whew!
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back