Apple Has A Hole In MAC OS X

Apple has failed to fix a bug in its Mac OS X operating system that allows processes to bypass the sandbox protection in place.

The flaw was discovered by Anibal Sacco and Matias Eissler from Core Security Technologies. They let Apple know about the problem on 20 September, and while Apple acknowledged their submission, it said that it did not see any security threat, forcing the Core Security Technologies team to publish the report to the public this month.

The problem appears to be with the use of Apple events in several default profiles, including the no-network and no-internet ones. When Apple events are dispatched a process can escape the sandbox, which could be exploited by hackers.

The vulnerability could lead to a compromised application restricted by the use of the no-network profile gaining access to network resources through the use of Apple events to execute other applications that are not restricted by the sandbox, making it a significant security threat.

Only the more recent versions of Mac OS X are vulnerable to this bug, including 10.5.x, 10.6.x, and 10.7.x. Those using 10.4.x are safe from the exploit.

Source…

Microsoft Resumes WP7 Update

Microsoft has begun updating Samsung’s Windows Phone 7-based smartphones again, after earlier technical problems forced a stop to the process, it said in a blog post Wednesday.

The update was initially announced Feb. 21, and doesn’t provide any new functionality, but rather improves the software update process itself, according to Microsoft.

However, after some users of Samsung phones began experiencing problems, Microsoft decided to temporarily suspend the update program.

The problems have been pinpointed and fixed, the blog post said, but it didn’t provide any details on what the issues were. At the same time, Microsoft has continued to update Windows Phone 7-based smartphones from other vendors. Read More…