August 12th, 2009
Apple drops (another) Mac OS X security patch
Less than a week after fixing 19 Mac OS X security vulnerabilities, Apple is on the patch treadmill again.
The company released Security Update 2009-004 to fix a solitary BIND vulnerability that could lead to denial of service attacks. Apple warns:
A logic issue in the handling of dynamic DNS update messages may cause an assertion to be triggered. By sending a maliciously crafted update message to the BIND DNS server, a remote attacker may be able to interrupt the BIND service. The issue affects servers which are masters for one or more zones, regardless of whether they accept updates. BIND is included with Mac OS X and Mac OS X Server but it is not enabled by default.
[ SEE: Apple warns of Mac attack risk via image files ]
The patch addresses the issue by properly rejecting messages with a record of type ‘ANY’ where an assertion would previously have been raised.
Just yesterday, Apple shipped a new version of its Safari browser to fix six documented security problems.
Ryan Naraine is a journalist and security evangelist at Kaspersky Lab. He manages Threatpost.com, a security news portal. Here is Ryan's full profile and disclosure of his industry affiliations.
For daily updates on Ryan's activities, follow him on Twitter.
Subscribe to Zero Day via Email alerts or RSS.
