Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Alexander said:
You probably don't have anything in your web directory with a resource fork, but you can also access the data fork:

Code:
http://localhost/dev/database_connector.php/..namedfork/data

and stare wide-eyed at the result. If you know the URL, you can also access files in password-protected directories like this.

Yikes, that is a pretty huge hole. I just tested it on another Mac site which I know runs OS X, and yep, it worked. I let the administrators know.

Honestly, this is the kind of stuff a lot of Mac and Unix users like to be smug about when it happens to Microsoft. We say they spent too much time adding features to their OS/apps and not enough time making it simple and secure. Yet here we are - HFS+ allows access to files in this manner as a convenient feature, but nobody thought of the numerous security ramifications. I'd be willing to bet that there's probably another exploit hidden here for another application. Apache is just one app that could potentially make use of this in a harmful way, and it happened because most systems that run Apache don't have this functionality, so the Apache people never thought about it. It took somebody this long to connect the dots and see the problem. How many other unconnected dots are out there?

Many of us wish Apple and Macs would become more popular - there are numerous benefits to this (better availability of software being chief among them). But what if this turns enough attention on OS X that exploits for these things start coming out before they are found and fixed? We may rue the day the Mac got popular...

Kudos to Apple for fixing it and notifying their users.
 
msconvert said:
try "cd /; sudo rm -R *" on an OSX machine, won't work.
Uhh, why don't you try that on your OS X system(s) as an admin user and report back what happens? 😉

And even without using sudo to gain temporary root access (by default) an OS X admin user is capable of doing quite a bit of damage because several important directories are admin-writable.
 
Just Ghost it

AidenShaw said:
Did he buy his MCSE or earn it? 🙄

NT/2K/XP/2003 include a Veritas-developed backup utility that can do the backups just fine.

The only wrinkle is that you can't restore the boot block from the standard backup utility, so you need to do a quick Windows install (which will create the low-level boot files), then restore your backup into another partition. Fixup "boot.ini" to point to the restored partition, and you're back...

I usually create a small (128 MB) partition as the first partition on the disk, then install Windows into a large second partition. This puts the funky boot files in the first partition, and Windows without the boot stuff into the second.




People, anyone that's worked with x86 computers for long at any REAL level of technical ability knows you can completely mirror a disk drive with Ghost. Fast and simple. Boot sector and all.
 
AndreMA said:
My personal belief is that OS X is inherently a more secure OS -- but it's just that: a personal belief.

I agreed, but I'm also justifiably afraid if you look at the exploits possibly if Apache wasn't patched. Sure it's not usually something your average mac consumers would implement fully but OSX makes it just easy enough that someone COULD poteintially turn on by mistake. Possible, but not probable IMHO.

I believe that we are more secure on most ends right off the box, but with un-expertly tweaking the system or even just by moving some crucial folders a mac running OS X can be made as vulnerable as the Windows machines. There simply hasn't been a major hacking attempt... yet.

I don't know what would've happened if there was a major attack against OS X. What I do know is that even if we comphensate the market share with all of the Mac virii (old AND new), it would still only be a small percentage of what Windows' monthly new virii counts. That's good news!

That said, controlled hardware and OS is a mixed blessing, limiting the Mac's poteintial to blow up (pun intended) like our Microsoft counterparts but afford us a little it more security and reliability. I can live with that.

Remember, if the hardware and OS were not so critically controlled in by Apple, the modern computing margin between the two platforms are essentially very small (and closing thanks to OS X). What makes a Mac a Mac is no longer either hardware or software. Macs remain different essentially thanks to their different design and usability philosophy, nothing but.

I'm not saying that Windows is better or that Mac is less secure, but the predominant non-productivity user-base of PC is gamers, who are by definition "people with time on their hands". Mac users are almost purely using their Macs for productivity reasons. Gaming exploded the PC marketshare. And since a high end gaming rig is as expensive (if not a LOT more) than your high-end Dual G5s, it really is not a monetary concern. So it depend on which side you want to take each has advantages.

I just hope we never have a chance to prove ourselves to an attack.

My logic is based on a perceived pattern I pulled out of my arse:
1. Gamers = curious and creative people.
2. Most HCR gamers has too much time on their hands (barring developpers).
3. Most gamers are PC users.
4. HRC gamers wants to "0Wn j00"
5. Hacking = takes a lot of time, and can be equated to "real-life gaming".
6. Hacking requires a lot of creativity (real hacking not "script kiddies").
7. Most exploits are found on a PC based system.
8. Hackers wants to own your system (take over)

Conclusion: Games induce hacking, ergo "Gamer = Hackers".

Now I know it's a flawed hypothesis, it's not eaven reciprocically true (important to verify your theory, but I ignore it here) but the patterns are hard to ignore (let alone quite funny lol). And since Mac = little games, there are less Mac specific gamers (most Mac gamers game on a PC box). Less Mac gamers = less Mac hacks.

Jokes aside, I'm just glad my PB is a little safer. Now if someone can prevent coffee to damage my keyboards...
 
tfaz1 said:
Safari timeout issue still unresolved. Everyday I meet more and more people sufferning though this bug. Very JV, if you ask me.

This isn't a Safari issue. Its a lookupd issue. Lookupd is the DNS resolver that OS X uses. This is a bug that has existed even since the OS X 10.0 Public Betas. However, only now is it coming to the fore due to change in the DNS data being sent on the internet as well as changes in how we browse.

I personally fixed this issue myself by changing the info our DNS server provides to the clients on our network. Its been proven to fix this issue - however its only available to people who know BIND and UNIX in general.

I do know that 10.3.7 may have some updates for lookupd, but even then it may not be 100%.
 
akac said:
I personally fixed this issue myself by changing the info our DNS server provides to the clients on our network. Its been proven to fix this issue - however its only available to people who know BIND and UNIX in general.
Can you point to a discussion of this? I don't see it on afp548.com...

Interestingly, I used to experience this bug a lot more when we ran MacDNS under OS 8. I'm not sure if I've seen it in my office since we moved DNS to our Xserve.
 
StarbucksSam said:
I'm very glad Apple is staying on the ball- but we have had a LOT of these lately. Is something unusual going on?

That "something unusual" is userbase growth. This is the year of the mac. If history repeats itsself we are MOST LIKELY going to start seeing viruses and security attacks aimed at the macintosh platform. If we don't I'll be very surprised. I still believe we have years and years of freedom before it ever gets bad as it is today on windows. But I also macintosh will never be as riddled with viruses and security holes as windows is today.
 
Ysean said:
People, anyone that's worked with x86 computers for long at any REAL level of technical ability knows you can completely mirror a disk drive with Ghost. Fast and simple. Boot sector and all.

Yes, and other options as well (several Ghost clones, "Drive Image" by PowerQuest(Symantec)).

I knew of those, but kept my response to tools in the XP disto from MS, no 3rd party.

BTW, I think that the term "mirror" is usually interpreted to mean a RAID-1 setup - a second drive is kept up-to-date in real-time to the original. In the case of a drive failure - you're covered. If there's a software failure or virus problem - you instantly have bad data on both copies. Not good.

I usually see the term "bare metal restore" (BMR) used to refer to a backup that can be applied to a new system (or disk) that's just been unwrapped and installed - and recreates the original system exactly. Or, in this case, applied to an unbootable or completely trashed system to exactly restore a previous state.

The better BMR products (Veritas' "for pay" version comes to mind), allow you to synthesize the BMR image from your standard daily incremental and full backup schedules. "Ghost", "Drive Image" and others require a shutdown and a special BMR-ready backup pass. Great for major milestones, but not so good if the disaster happens after 3 months of 24x7 production.
 
Toe said:
Can you point to a discussion of this? I don't see it on afp548.com...

Interestingly, I used to experience this bug a lot more when we ran MacDNS under OS 8. I'm not sure if I've seen it in my office since we moved DNS to our Xserve.

The answers on how to do this were posted on the Apple discussion forums on OS X Server I think. Also there are some StepWise articles on some netinfo parameters one can make to help other lookupd issues.
 
Update worked fine

I have updated three Macs. Two with client OS X and one OS X Server. No problems on any of them (iMac G5 20'', TiPowerBook G4 800, Power Mac G4 400).
 
Updated my G5 dualie last evening - smooth sailing, with no perceived difference in performance. But my coffee tastes even better than usual this morning - thanks much, Apple! 😛
 
No problems here with my 17" 1.25 GHz G4 iMac - running as good as ever! (Not that I was expecting anything to change with an update of this nature.)
 
Update Success

~Shard~ said:
No problems here with my 17" 1.25 GHz G4 iMac - running as good as ever! (Not that I was expecting anything to change with an update of this nature.)

No problems noted on either of my real G-series.

(Summer 2001) iMac G3-600
2002 QuickSilver G4-733
=-=
My G3-400 upgraded OBM can't run OSX. 🙁

O-ld
B-eige
M-ac
... 1997 PowerMac 6500 Sonnet L2 G3-400 🙂
=-=
JJ
 
Doga said:
Updated my G5 dualie last evening - smooth sailing, with no perceived difference in performance. But my coffee tastes even better than usual this morning - thanks much, Apple! 😛

What type of coffee do you drink? This update must really be something to improve the taste of a morning coffee. 😀
 
Toe said:
I agree with your sentiment, but just want to quibble with two of your points...

First, unless they changed it recently, OS X does give admin rights to the first user... how else would you set up an admin unless somebody already has admin rights? Apple has tried to make the Unix user-based architecture transparent to users still stuck in the Classic world of undifferentiated user/system.

I'd also take issue with the idea of tweaking resulting in good security for Win 2K or XP. I know a MCSE who really knows his stuff and who spent weeks locking down a Win2K web server (he read all the MS whitepapers, followed all the procedures, ran all the supplemental analyzers and updaters, applied third-party extra measures, updated and secured all of those, etc.). His server got smacked the moment he went live with it... turns out a new, lethal virus (which specifically targeted a newly-found exploit in his intrusion-detection system) had come out just as he was flipping the switch. Took down his whole ISP for the day, and ruined the entire OS on his weeks-of-effort server. 😡

Sorry. I wasn't clear. Admin on Windows doesn't == admin on OS X from what I understand. Admin on XP is literally, what others are calling root access. So when I say OS X doesn't give you admin rights I should have been more clean in saying OS X doesn't give you the same rights XP/2K gives you out of the box.

As for the MSCE (A title that is becoming more and more useless each year because it demonstrates that you can pass cookie cutter tests not that you KNOW YOUR THING.) screwing up a W2K web server. I'm assuming he was using IIS. In which case no matter how much tweaking and securing you do to the system it its going to be a freaking nightmare. Simply unless forced to you don't use IIS. You use Apache. Anyone who uses IIS deserves every headache they get from it and every hack they have to scramble to repair.
If you aren't talking IIS then yes. Yes you can tweak a system so it’s very secure.
 
I just installed the update, and now my eMac takes ages to start, and a lot of the Apple apps like Mail and Safari no longer works. I had to use Firefox to get online. Any advise what to do to fix this? (No, I did not make a backup before the upgrade . . .)

🙁
 
Hosed my PowerBook...

Since the update, all iMacs G3 CRT, G3 LCD, G4 LCD work.. however, the PowerBook G4 12" is hosed.. can't get past "Login window starting"...

A genius at the Cucamonga Apple store says the same thing happened with his 12". Be sure to keep your 10.3 disks handy if owning a PBook G4. You may end up having to do an archive and install maneuver to correct your new flaptop.. err screwed laptop.

:O
 
affected office?

*** Nevermind. It seemed that my PB was having issues accessing my FW drives. When I finally was able to unmount them, everything started working fine. ***

Hi All,

I just updated my PB with the this update, and now it take forever for microsoft word 2004 to start up. When I normally start word, it brings up the initial window to pick my last work item, or load a new one. Now that window sits there, not responding. I would say it sits there for 5 minutes before everything works again.

Anybody else with this issue?

Kimo
 
Looks like I'll have to leave this update for a while on my 17' imac G5.

God, I feel like such a chicken.. 😱 😉

/asif
 
Looks like my problems were caused by corrupt fonts. As a last effort before reinstalling, I threw a way some of my fonts and now things seems to be back to normal. 🙂
 
no exciting news lately....

really slow these days....

oh btw the security update worked fine on my new powerbook G5
 
I installed the security update on a G3 iBook, no problems. It is running normally.

I installed the update on the 450 DP G4. Then when I went to make backups to Zip 100, the process stopped midway. It would would allow a restart. So I had to do a force quit of the finder. Then it restarted OK on its own. System Optimizer X was performed this morning, it's operating normally now.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.