#OS X MOUNTAIN LION 10.8.4 UPDATE#

(I did my 10.8.5 update early this morning: it may be only half a day, but so far, so good.)ДЇollow on Twitter for the latest computer security news.The appearance of Mountain Lion is essentially the same as Lion and Snow Leopard.

#OS X MOUNTAIN LION 10.8.4 PATCH#

That doesnвЂ™t force you to be bang up to date with Flash вЂ“ the September Patch Tuesday introduced 11.8.800.168 to fix remote code execution holes in the 11.8.800.94 вЂ“ but ensuring you are at the latest-but-one is at least a start. Safari will now refuse to use Flash plugins earlier than 11.8.800.94. To conclude, even though Macs donвЂ™t get malware (only kidding!), Apple has updated its plugin blocker following AdobeвЂ™s latest Patch Tuesday.

DL1569: Safari 5.1.10 for Snow Leopard.

DL1676: OS X Mountain Lion Update v10.8.5 (Combo).

DL1675: OS X Mountain Lion Update v10.8.5.

HT5921: Security content of Safari 5.1.10.

Some useful pages on AppleвЂ™s site include:

#OS X MOUNTAIN LION 10.8.4 SOFTWARE#

Neither Lion nor Mountain Lion need or receive this fix, as they are on Safari 6.ДЄs usual, you can grab AppleвЂ™s updates by simply clicking on the Apple Menu and choosing Software UpdateвЂ¦ or by downloading them as DMG files from AppleвЂ™s download site. (ClamAV is not part of the OS X 10.8 distribution.)ДЄlso, the oldest supported OS X version, 10.6, gets a separate update for a remote code execution hole in Safari, which moves to version 5.1.10. The list of fixes for 10.6 and 10.7 is similar to the list for 10.8.5, with the addition of a remote code execution flaw in ClamAV. (Privilege escalation.)ДЇor users on the still-supported earlier versions of OS X, namely Snow Leopard (10.6) and Lion (10.7), the latest fixes come as Security Update 2013-004, rather than as a point release. PHP isnвЂ™t the only server-flavoured component to receive security attention in 10.8.5, with fixes also shipped for the following applications usually found on servers: If youвЂ™re an OS X user, you may have been unaware that PHP was installed at all, since it is usually considered a server-side component.Д«ut it is present, and it was vulnerable, although it isnвЂ™t enabled by default, even if you turn on OS XвЂ™s built-in Apache web server.

The handling of QuickTime movies by QuickTime.

#OS X MOUNTAIN LION 10.8.4 PDF#

JPEG2000 decompression in PDF files by the ImageIO component.JBIG2 decompression in PDF files by the CoreGraphics library.Other significant patches include potential remote code execution holes in: ThatвЂ™s the bug we decribed as вЂњonly six characters from a crash.вЂќДЄlthough it probably deserved to be called a denial of service rather than merely вЂњan issue,вЂќ it was indeed more of an annoyance than a vehicle for cybercrooks.ДЄt any rate, itвЂ™s good to see it patched quickly. OS X Mountain Lion v10.8.5 also addresses an issue where certain Unicode strings could cause applications to unexpectedly terminate. Moving up the list, the not-a-security-fix I mentioned above is included, almost as an afterthought, as follows:

Presumably, Apple yielded to public pressure to fix this long-running hole, but, instead of taking all the sudo changes from the past few months, just backported the sudo -k fix to version 1.7.4p6, a much less risky change. Until 10.8.4, doing a sudo -k (which is supposed to deauthenticate you, and thus does not require a password), followed by setting the time to just after midnight on, would give you root access. Nevertheless, the sudo binary has been updated, and in my tests, the privilege escalation bug had vanished. The infamous sudo privilege escalation, documented and patched by sudo itself back in February and pointedly exposed on OS X by Metasploit last month, is no more.Д¬onfusingly, if you run sudo -V to check the version number, you might get the impression it hasnвЂ™t been updated, since 1.7.4p6a has the same core version string as the version shipped with 10.8.4 ( 1.7.4p6).

#OS X MOUNTAIN LION 10.8.4 FREE#

IвЂ™ll start with the free bonus patch, because IвЂ™m delighted itвЂ™s happened and I think you should know about it. There are 15 official security patches, one fix that Apple has appended to the list without explicitly admitting that it was a security issue, and one bonus patch that is mentioned on AppleвЂ™s website but not in its emailed security advisory. IвЂ™m calling it a security update, though itвЂ™s officially a full-on point release of OS X Mountain Lion, taking the 10.8 variant of AppleвЂ™s OS X to version 10.8.5.Д«ut with twice as many security fixes listed as regular bug fixes and improvements, IвЂ™m happy to call it a вЂњsecurity update,вЂќ if only in the hope youвЂ™ll feel a bit more urgency about deploying it.

Os x mountain lion 10.8.4