Apple Issues Network Time Protocol Security Fix for OS X Users
Apple today released a new security update that’s designed to address a "critical security issue" with the Network Time Protocol service on OS X. Apple recommends that all Yosemite, Mavericks, and Mountain Lion users install the update "as soon as possible."
The update appears to address a problem that was highlighted by the U.S. Government on Friday, December 19 and originally discovered by the Google Security Team. The vulnerability has the potential to allow an attacker to execute arbitrary code using the privileges of the ntpd process.
Google Security Team researchers Neel Mehta and Stephen Roettger have coordinated multiple vulnerabilities with CERT/CC concerning the Network Time Protocol (NTP). As NTP is widely used within operational Industrial Control Systems deployments, NCCIC/ICS-CERT is providing this information for US Critical Infrastructure asset owners and operators for awareness and to identify mitigations for affected devices. ICS-CERT may release updates as additional information becomes available.
These vulnerabilities could be exploited remotely. Exploits that target these vulnerabilities are publicly available.
Products using NTP service prior to NTP–4.2.8 are affected. No specific vendor is specified because this is an open source protocol.
Apple has faced several vulnerabilities over the course of 2014, most recently releasing an OS X bash update in September to fix the “Shellshock” security flaw. Today’s security update can be downloaded from the Mac App Store.
Update: As noted by Reuters, this update marks the first time Apple has deployed an automatic security update, which can be installed without user authorization.
Popular Stories
There are concerning reports on Reddit that Apple's latest iOS 17.5 update has introduced a bug that causes old photos that were deleted – in some cases years ago – to reappear in users' photo libraries. After updating their iPhone, one user said they were shocked to find old NSFW photos that they deleted in 2021 suddenly showing up in photos marked as recently uploaded to iCloud. Other...
Apple today previewed new accessibility features coming with iOS 18 later this year, and this includes some new options for CarPlay. Apple highlighted three new features coming to CarPlay: Voice Control: This feature will allow users to navigate CarPlay and control apps with just their voice. Color Filters: This feature will make the CarPlay interface visually easier to use for...
The iMessage service that Apple users to send messages to one another appears to be down for some users, and messages are failing to go out or are taking an extra long time to send. There are numerous reports about the issue on social networks and a spike of outage reports on Down Detector, but Apple's System Status page is not yet reporting an outage. Update: Apple's status page says...
Apple today released tvOS 17.5, the fifth update update to the tvOS 17 operating system that came out last September. tvOS 17.5 comes two months after the release of tvOS 17.4. tvOS 17.5 can be downloaded using the Settings app on the Apple TV. Go to System > Software Update to get the new software. Apple TV owners who have automatic software updates activated will be upgraded to ...
At its Spring Update event, OpenAI announced that it will be releasing a desktop app for the Mac, as seen in the screenshot below. The app will be rolling out to ChatGPT Plus subscribers starting today, ahead of a wider launch "in the coming weeks." "With a simple keyboard shortcut (Option + Space), you can instantly ask ChatGPT a question," OpenAI's press release says. In addition, Voice...
Today is the official launch day of the new iPad Pro models, and these updated tablets mark the biggest feature and design refresh that we've seen for the iPad Pro in several years. We picked up one of the new 13-inch models to check out everything new. Subscribe to the MacRumors YouTube channel for more videos. When it comes to design, Apple is still offering 11-inch and 13-inch size options ...
Top Rated Comments
1.4? I can install it using my floppy drive.
You have to love that in 2014 people still equate hacking to unemployment.
Why would I do that? Snow Leopard works, and runs all my software properly. Later OSs add nothing of value to me, and, judging by comments on this board, causes problems that i don't currently have.
Yes it is, but apparently Apple no longer cares about the security of their Snow Leopard and Lion customers. You either upgrade your perfectly good software (if you can) or you're on your own.
Well, you could just buy a new Mac, which is what Apple wants you to do anyway.
As I've said numerous times before, no-one should expect eternal updates in terms of new features etc - that's what new versions of the OS are for, and what should attract users to upgrade. Of course it's unreasonable to expect Apple to develop new features for old OS versions that a few versions old.
However, when bad security vulnerabilities / flaws are discovered that apparently wouldn't take very much effort for Apple to patch, I think it's unconscionable to not provide security patches for machines that are otherwise still perfectly usable today other than having software Apple can't be bothered to support in the very slightest, narrow way. Apart from anything else, we know compromised machines are bad for everyone on the internet.
Are you aware that Software Support isn't the same as Hardware Support?