The Channel logo

News

By | John Leyden 29th May 2008 10:59

Apple mega update strikes out calendar bug

iPatch

Apple pushed out a bumper security and performance update on Wednesday that finally plugs a long-standing security hole.

Mac OS X version 10.5.3 updates open source components that Apple bundles with its software (such as Apache) as well as its own software and third party components. In total the software upgrade patches 22 modules, including a fix for a serious security bug in Apple's calendering application iCal.

Flaws in iCal that potentially created a means to inject hostile code onto vulnerable systems were discovered by Core Security back in January, and promptly notified to Apple. A protracted series of exchanges followed.

The dialogue revolved around whether the bugs were serious enough to patch and, if so, when Apple would issue patches. Eventually Core said it would publish an advisory on Wednesday (21 May) in the belief Apple was ready to release a fix on Monday (19 May). In the event, this update only came out on 28 May.

Apple now concedes that maliciously crafted iCalendar files might be used to smuggle malware onto unpatched systems. It credits Core Security with reporting the issue.

Other components of Mac OS X version 10.5.3 defend against other arbitrary code execution vulnerabilities, stomping on bugs in a Flash Player Plug-in for Mac OS X, Appkit and Mail. There's also fixes for a password disclosure vulnerability involving single sign-on and bugs in the kernel that might trigger unexpected system shutdown.

A full run-down of the security components of Apple's release can be found on its site here. ®

comment icon Read 42 comments on this article alert Send corrections

Opinion

Walking on water, image via Shutterstock

Chris Mellor

IDC stats reveal who's who in the backup appliance bearpit
Carry on Cleo

Gavin Clarke

Infamy, infamy, Amazon and Microsoft have all got it in for me!

Tim Anderson

Also signals stronger cross-platform tools, access to new markets

Features

Shouting match
Single market vs. rest of the world
hacker
Mostly it's financial crime. Here's what all the cool kids' terms mean in English
Apple logo. Pic: Blake Patterson
Plenty of bumps in the 40-year road for Mac makers
single pain of glass