Apple Fixes Perilous DNS Vulnerability

On August 1, 2008, Apple released a patch to fix a problem relating to the implementation of the BIND (Berkeley Internet Name Domain) DNS server. The issue affects Mac OS X Server v10.4.11, Mac OS X v10.4.11, Mac OS X Server v10.5.4 and Mac OS X v.10.5.4.

Apple also released some more fixes for a set of other critical vulnerabilities in the Mac operating software. One of them fixes a QuickLook bug that could lead to an execution of arbitrary code upon loading a malware-laden Microsoft Office document.

Furthermore, Apple has updated its Data Detectors Engine in Mac OS X to rectify an issue that results in a sudden termination of application when a user uses Data Detectors to view a maliciously created message.

Problems with OpenSSL and OpenLDAP where a remote attacker might be allowed to cause a sudden application break down have also been addressed. Rsync has been updated to rectify a problem due to which files external to the software root could be viewed or overwritten with malicious content.

Further, an integer overflow in handling of PDF files could cause a stack-based buffer overflow. And accessing malware-infected PDF files could lead to the execution of an arbitrary code or sudden termination of application. Thus, the recent update takes care of these problems via additional verification of PDF files.

Besides, the DNS vulnerability allows an attacker to launch an attack against a DNS server to cause a cache poisoning of a genuine domain name so that traffic flowing to it is diverted to a malware-laden domain. Consequently, if a user enters the correct address of a site, he gets a bogus one with which a phishing operation could be carried out. While some surfers might notice themselves being redirected to an unintended page, many could be effectively duped.

However, ISPs and leading providers of either DNS software or DNS services deployed patches after the vulnerability's discoverer Dan Kaminsky, Security Researcher, coordinated a patching effort, as reported by PCWorld on August 1, 2008,

Nevertheless, many ISPs still haven't applied these patches and some companies like Apple too have been slow in responding to the DNS bug, said Kaminsky.

Related article: Apple Patches QuickTime 13 Month Old Flaw

» SPAMfighter News - 08-08-2008

All SPAMfighter products offer a free trial!

SPAMfighter is a free spam filter for Outlook, Outlook Express,Windows Mail, Windows Live Mail and Thunderbird.

Optimize your Slow PC for better performance. Try FREE scan now

Disk space recovery
and disk optimization. Try FULL-DISKfighter free

SPAMfighter Exchange Module is a Spam filter for Exchange server - Free 30 days trial.

Remove Spyware with SPYWAREfighter - Free 30 days trial

Antivirus software for your Windows PC - Free 30 days trial