New in OS X: Get MacRumors Push Notifications on your Mac

Resubscribe Now Close

Apple's OS X 10.10.2 to Fix Security Vulnerabilities Exposed by Google's Project Zero

Friday January 23, 2015 7:56 am PST by Mitchel Broussard
Google's security team, Project Zero, this week disclosed to the public several security vulnerabilities in OS X, some three months after the issue were shared with Apple (via Ars Technica). While Apple has not commented officially on the issues, it appears one has already been patched and iMore reports the remaining two are fixed in OS X 10.10.2, which is currently in developer testing.

macbook_air_yosemite
Project Zero works to discover security vulnerabilities of various operating systems and software, giving their owners 90 days notice to patch the issues before publishing their findings to the public. In their markup of Apple's OS X, problems involving memory corruption, kernel code execution, and a sandbox escape were all discovered by the team. Ars Technica notes:
At first glance, none of them appear to be highly critical, since all three appear to require the attacker to already have some access to a targeted machine. [...]

Still, the exploits could be combined with a separate attack to elevate lower-level privileges and gain control over vulnerable Macs. And since the disclosures contain proof-of-concept exploit code, they provide enough technical detail for experienced hackers to write malicious attacks that target the previously unknown vulnerabilities.
As the 90-day deadline hit during the week, the group began posting its findings online. Google's notes suggest one of the vulnerabilities was fixed with the release of OS X Yosemite, while the other two remained unaddressed.

But as pointed out by iMore, Apple's incoming OS X 10.10.2 update does indeed include fixes for the remaining two vulnerabilities exposed by Project Zero.
[B]ased on the latest build of OS X 10.10.2, seeded [Wednesday] to developers, Apple has already fixed all of the vulnerabilities listed above. That means the fixes will be available to everyone running Yosemite as soon as 10.10.2 goes into general availability.
Google's Project Zero has been disclosing significant security vulnerabilities for a number of months now, previously discovering a few significant Windows issues and sharing them online. The project shines light on much-needed fixes to various operating systems, but sometimes undercuts the point of security, as in that Windows case that's left users' systems more vulnerable with the publicized knowledge before Microsoft could properly fix it. Still, the 90-day window before public disclosure is intended to give companies time to fix the issues while also giving them incentive to do so in a timely fashion.

Tags: OS X 10.10.2, Project Zero
[ 195 comments ]


Top Rated Comments

(View all)

Avatar
bawbac
59 months ago

Google is playing dirty.


How?
They could expose the issue without the 90 day grace period if they wanted to be dirty.
Rating: 37 Votes
Avatar
Keirasplace
59 months ago

Anyone hear that that explosion at Cupertino?


The irony that Android right now is biggest botnet source in the world right now because of crap level security and upgrade policy... That I could have 100+ separate security patches for Microsoft in one year... Makes Apple pretty secure from any derision from the likes of Google or Microsoft.
Rating: 16 Votes
Avatar
maflynn
59 months ago

Google is playing dirty.


You mean by communicating that OS X has security holes, how's that dirty? It will now at the very least get addressed by Apple
Rating: 15 Votes
Avatar
genovelle
59 months ago

You mean by communicating that OS X has security holes, how's that dirty? It will now at the very least get addressed by Apple


Because they have holes in their own OS that remain open for months that they don't report on. Before a company starts searching for and reporting flaws in someone else's product, that should devote those resources to fixing their own mess.
Rating: 14 Votes
Avatar
jay_app
59 months ago
Google has a disingenuous agenda on this. Where are all the hundreds of issues with Andriod, Chrome OS, gmail, etc? They will not mention them. Should Microsoft or Apple publish Google's issues after 90 days. The list would be very long.
Rating: 13 Votes
Avatar
JeffiJers
59 months ago
what about fixing wifi issues? they can't do that right?
Rating: 11 Votes
Avatar
admmasters
59 months ago
How about Google actually fix their own bugs?

Pretty annoyed at Google at the moment considering Lollipop's widely reported issues and bugs such as this which they consider obsolete, but clearly aren't (reproducible on Macbook Pro Retina Late 2013 + Yosemite 10.10.1): https://code.google.com/p/android/issues/detail?id=39548

Those in glass houses...
Rating: 11 Votes
Avatar
genovelle
59 months ago

I disagree with this. Just because a security vulnerability hasn't been publicized doesn't mean it doesn't exist, and that black hat hackers can't find out about it.

I submitted a vulnerability regarding Apple's online store to Apple. They requested that I not share information about the vulnerability and said they were working on fixing it. I imagine Apple could similarly respond to Project Zero and tell them something along the lines of "we will fix it within 30 days, please don't publicly comment on it now." when the 90 day deadline is approaching, and I imagine Project Zero would respect that, if they truly are well meaning.

They should first expose the holes in Android that they refuse to patch or can't.
Rating: 8 Votes
Avatar
maflynn
59 months ago
Its funny how so many people are shooting the messenger. Regardless of how it came to light, the fact is Apple needs to address this (like any security concern) yet, this thread has turned into an argument on how bad google is.
Rating: 7 Votes
Avatar
macsmurf
59 months ago

Nice heads-up from a company who has the most buggiest OS of them all.
Let's others report all the bugs and security holes in Android and give them 90 days.........


Actually, Google is totally cool with that. In fact, they encourage it.

From http://www.google.com/about/appsecurity/ :
"If you believe you have discovered a vulnerability in a Google product or have a security incident to report, go to goo.gl/vulnz to include it in our Vulnerability Reward Program. If you have a vulnerability report for Android, email security@android.com. For Chrome vulnerabilities, use the Chromium bug tracker. Upon receipt of your message we will send an automated reply that includes a tracking identifier. If you feel the need, please use our PGP public key to encrypt your communications with us.

We believe that privately notifying vendors about vulnerabilities in their software, and setting reasonable disclosure deadlines in accordance with the severity of the bugs, is good for the overall security of Internet users."
Rating: 6 Votes

[ Read All Comments ]