Previewed at WWDC, launching in the fall.
Apple's OS X 10.10.2 to Fix Security Vulnerabilities Exposed by Google's Project Zero
Google's security team, Project Zero, this week disclosed to the public several security vulnerabilities in OS X, some three months after the issue were shared with Apple (via Ars Technica). While Apple has not commented officially on the issues, it appears one has already been patched and iMore reports the remaining two are fixed in OS X 10.10.2, which is currently in developer testing.
Project Zero works to discover security vulnerabilities of various operating systems and software, giving their owners 90 days notice to patch the issues before publishing their findings to the public. In their markup of Apple's OS X, problems involving memory corruption, kernel code execution, and a sandbox escape were all discovered by the team. Ars Technica notes:
But as pointed out by iMore, Apple's incoming OS X 10.10.2 update does indeed include fixes for the remaining two vulnerabilities exposed by Project Zero.
Project Zero works to discover security vulnerabilities of various operating systems and software, giving their owners 90 days notice to patch the issues before publishing their findings to the public. In their markup of Apple's OS X, problems involving memory corruption, kernel code execution, and a sandbox escape were all discovered by the team. Ars Technica notes:
At first glance, none of them appear to be highly critical, since all three appear to require the attacker to already have some access to a targeted machine. [...]As the 90-day deadline hit during the week, the group began posting its findings online. Google's notes suggest one of the vulnerabilities was fixed with the release of OS X Yosemite, while the other two remained unaddressed.
Still, the exploits could be combined with a separate attack to elevate lower-level privileges and gain control over vulnerable Macs. And since the disclosures contain proof-of-concept exploit code, they provide enough technical detail for experienced hackers to write malicious attacks that target the previously unknown vulnerabilities.
But as pointed out by iMore, Apple's incoming OS X 10.10.2 update does indeed include fixes for the remaining two vulnerabilities exposed by Project Zero.
[B]ased on the latest build of OS X 10.10.2, seeded [Wednesday] to developers, Apple has already fixed all of the vulnerabilities listed above. That means the fixes will be available to everyone running Yosemite as soon as 10.10.2 goes into general availability.Google's Project Zero has been disclosing significant security vulnerabilities for a number of months now, previously discovering a few significant Windows issues and sharing them online. The project shines light on much-needed fixes to various operating systems, but sometimes undercuts the point of security, as in that Windows case that's left users' systems more vulnerable with the publicized knowledge before Microsoft could properly fix it. Still, the 90-day window before public disclosure is intended to give companies time to fix the issues while also giving them incentive to do so in a timely fashion.
Tags: OS X 10.10.2, Project Zero
[ 195 comments ]
Top Rated Comments
(View all)
47 months ago
Google is playing dirty.
How?
They could expose the issue without the 90 day grace period if they wanted to be dirty.
47 months ago
Anyone hear that that explosion at Cupertino?
The irony that Android right now is biggest botnet source in the world right now because of crap level security and upgrade policy... That I could have 100+ separate security patches for Microsoft in one year... Makes Apple pretty secure from any derision from the likes of Google or Microsoft.
47 months ago
Google is playing dirty.
You mean by communicating that OS X has security holes, how's that dirty? It will now at the very least get addressed by Apple
47 months ago
You mean by communicating that OS X has security holes, how's that dirty? It will now at the very least get addressed by Apple
Because they have holes in their own OS that remain open for months that they don't report on. Before a company starts searching for and reporting flaws in someone else's product, that should devote those resources to fixing their own mess.
47 months ago
Google has a disingenuous agenda on this. Where are all the hundreds of issues with Andriod, Chrome OS, gmail, etc? They will not mention them. Should Microsoft or Apple publish Google's issues after 90 days. The list would be very long.
47 months ago
How about Google actually fix their own bugs?
Pretty annoyed at Google at the moment considering Lollipop's widely reported issues and bugs such as this which they consider obsolete, but clearly aren't (reproducible on Macbook Pro Retina Late 2013 + Yosemite 10.10.1): https://code.google.com/p/android/issues/detail?id=39548
Those in glass houses...
Pretty annoyed at Google at the moment considering Lollipop's widely reported issues and bugs such as this which they consider obsolete, but clearly aren't (reproducible on Macbook Pro Retina Late 2013 + Yosemite 10.10.1): https://code.google.com/p/android/issues/detail?id=39548
Those in glass houses...
47 months ago
I disagree with this. Just because a security vulnerability hasn't been publicized doesn't mean it doesn't exist, and that black hat hackers can't find out about it.
I submitted a vulnerability regarding Apple's online store to Apple. They requested that I not share information about the vulnerability and said they were working on fixing it. I imagine Apple could similarly respond to Project Zero and tell them something along the lines of "we will fix it within 30 days, please don't publicly comment on it now." when the 90 day deadline is approaching, and I imagine Project Zero would respect that, if they truly are well meaning.
47 months ago
Its funny how so many people are shooting the messenger. Regardless of how it came to light, the fact is Apple needs to address this (like any security concern) yet, this thread has turned into an argument on how bad google is.
47 months ago
Nice heads-up from a company who has the most buggiest OS of them all.
Let's others report all the bugs and security holes in Android and give them 90 days.........
Actually, Google is totally cool with that. In fact, they encourage it.
From http://www.google.com/about/appsecurity/ :
"If you believe you have discovered a vulnerability in a Google product or have a security incident to report, go to goo.gl/vulnz to include it in our Vulnerability Reward Program. If you have a vulnerability report for Android, email security@android.com. For Chrome vulnerabilities, use the Chromium bug tracker. Upon receipt of your message we will send an automated reply that includes a tracking identifier. If you feel the need, please use our PGP public key to encrypt your communications with us.
We believe that privately notifying vendors about vulnerabilities in their software, and setting reasonable disclosure deadlines in accordance with the severity of the bugs, is good for the overall security of Internet users."
[ Read All Comments ]
Apple CEO Tim Cook recently donated 23,215 shares of Apple stock to charity, according to a filing with the U.S. Securities and Exchange Commission released today. At the stock's current closing...
iOS 12 introduces Notification Grouping, a long-awaited feature that groups all of the notifications from a single app together in one neat bundle that prevents the Lock screen from becoming overly...
Costco, the world's second largest retailer behind Walmart, recently confirmed that it now accepts Apple Pay and other contactless payment methods at all of its 750 warehouse locations in the...
Fortnite could launch on Apple TV at one point in the future, according to a new discovery by the @StormLeaks Twitter account late yesterday. As reported by esports and gaming website Dexerto,...
Google today updated its Wear OS iPhone app [Direct Link] and Google Fit Android app with a new redesign that emphasizes closing a set of rings, similar to Apple's Activity app. Every day, Google...
In an ongoing effort to boost sales in India, Apple is reportedly planning to upgrade its authorized reseller locations in five to six
"extremely prominent locations" in India's...
Apple has added two China-based manufacturers to its list of MacBook chassis suppliers in an effort to push down prices quoted by Taiwan-based makers, according to a new report today by DigiTimes.
...
With watchOS 5, Apple has added support for WebKit, which is designed to allow you to view content from the web right on your wrist, something that's entirely new to the Apple Watch.
...
