Funky Apple Updates after 2007-0002 (Fixed?)

Published: 2007-02-16
Last Updated: 2007-02-18 19:44:42 UTC
by Joel Esler (Version: 4)
0 comment(s)
/** I am an Apple fanboy, so I am not picking on Apple **/

That being said, it seems we have found a buggy little feature of OSX after installing Security Update 2007-0002.

It asks us to reinstall Security Update 2007-0001 and iTunes/Quicktime update of 7.0.2.

Now, we have been testing this on many OSX Machines, it appears to be isolated to:

  • PPC Arch Only (We haven't been able to reproduce on Intel based machines)
  • 10.4.8 (We can't reproduce on 10.3, only 10.4) and
  • Those machines that are patched to 2007-0001 level

We are actually testing one machine right now that is a fresh build from CD, upgraded a month ago to 10.4.8, and that machine is having many problems even getting to the point where it is able to download Security Update 2007-0001, let alone version 0002.
  • It had problems with Installing the latest Java update but succeeded after a second try
  • It cannot complete the download of iTunes+Quicktime 7.0.2 (download freaks out halfway)
  • It does download Security Update 2007-0001, but fails to install it 
  • It never was allowed to download Security Update 2007-0002 so far
The /var/log/install.log file looks like this:
/System/Library/CoreServices/Software Update.app/Contents/MacOS/Software Update: Distribution: iTunes + QuickTime
/System/Library/CoreServices/Software Update.app/Contents/MacOS/Software Update: Distribution: Security Update 2007-001
/System/Library/CoreServices/Software Update.app/Contents/MacOS/Software Update: JavaScript error "Value undefined (result of expression system.ASUEnumerateProducts) is not object." while running "__choice_su_visible"
/System/Library/CoreServices/Software Update.app/Contents/MacOS/Software Update: __choice_su_visible returned error: Value undefined (result of expression system.ASUEnumerateProducts) is not object./System/Library/CoreServices/Software Update.app/Contents/MacOS/Software Update: JavaScript error "Value undefined (result of expression system.RegistryQueryStringValue) is not object." while running "__choice_su_visible"/System/Library/CoreServices/Software Update.app/Contents/MacOS/Software Update: __choice_su_visible returned error: Value undefined (result of expression system.RegistryQueryStringValue) is not object.admin auth received to install
<--endlogfile-->

As of this time we have filed a bug with Apple, if you have any comments, can reproduce the error, can't reproduce the error (CHECK YOUR VERSIONS), please write in.

UPDATE: As of 17:00 EST, Clicking on Software Update again does not show the older updates.  It appears Apple has fixed the problem

Joel Esler
http://handlers.sans.org/jesler
Keywords:
0 comment(s)

SpamAssassin Release version 3.1.8

Published: 2007-02-16
Last Updated: 2007-02-16 19:44:47 UTC
by Joel Esler (Version: 3)
0 comment(s)
Looks like a new version of SpamAssassin (SA) came out yesterday, version 3.1.8.  Take a look at the advisory here. 

This looks like a maintenance AND security release.  It patches CVE-2007-0451, a "possible DoS due to incredibly long URIs found in the message content".  According to fellow handler, Bojan, SA can be made to suck up large amounts of memory and CPU processing an e-mail message with the appropriate URL in the body.  Also, note that versions 3.1-3.1.7 are thought to be vulnerable, it is unclear whether earlier versions are also affected,.  The upcoming 3.2 release will also contain the fix.

Time to patch!

Joel Esler
http://handlers.sans.org/jesler
Keywords:
0 comment(s)

New Challenge - Charlotte's Web Site

Published: 2007-02-16
Last Updated: 2007-02-16 18:10:27 UTC
by Ed Skoudis (Version: 1)
0 comment(s)
Salutations, challenge fans!  I just posted a new challenge to test your skills over at Ethical Hacker dot Net.  This time around, I've weaved a web for you to untangle, set in the after-story of Charlotte's Web.  This book is one of my favorites and features a spider named Charlotte who has to save Wilbur the pig by building spider webs with words like "Terrific" and "Some Pig" in them.  In my challenge, you'll get to match wits with Lurvy, the farm hand, and decipher Charlotte's new plan to save Wilbur.  Answers are due by March 16, 2007.  Access the challenge here.

--Ed Skoudis
SANS Instructor
Handler, Internet Storm Center
Keywords:
0 comment(s)

Comments

What's this all about ..?

Anonymous

Dec 3rd 2022
9 months ago

password reveal .

Anonymous

Dec 3rd 2022
9 months ago

<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure:

<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.

<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission

Anonymous

Dec 26th 2022
8 months ago

https://thehomestore.com.pk/

Anonymous

Dec 26th 2022
8 months ago

<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>

Anonymous

Dec 26th 2022
8 months ago

<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>

Anonymous

Dec 26th 2022
8 months ago

https://defineprogramming.com/

Anonymous

Dec 26th 2022
8 months ago

https://defineprogramming.com/

https://defineprogramming.com/

Dec 26th 2022
8 months ago

Enter comment here... a fake TeamViewer page, and that page led to a different type of malware. This week's infection involved a downloaded JavaScript (.js) file that led to Microsoft Installer packages (.msi files) containing other script that used free or open source programs.
distribute malware. Even if the URL listed on the ad shows a legitimate website, subsequent ad traffic can easily lead to a fake page. Different types of malware are distributed in this manner. I've seen IcedID (Bokbot), Gozi/ISFB, and various information stealers distributed through fake software websites that were provided through Google ad traffic. I submitted malicious files from this example to VirusTotal and found a low rate of detection, with some files not showing as malware at all. Additionally, domains associated with this infection frequently change. That might make it hard to detect.
https://clickercounter.org/

https://defineprogramming.com/

Dec 26th 2022
8 months ago

Enter corthrthmment here...

rthrth

Jan 2nd 2023
8 months ago

Login here to join the discussion.


Diary Archives