Apple releases iTunes, Front Row, iPhoto, Security updates

Apple this afternoon released software updates for iTunes, Front Row, and iPhoto to coincide with new Front Row software features announced at Tuesday's media event. Security updates were also issued for both Mac OS X Tiger 10.4.5 and Mac OS X Panther 10.3.9.

iTunes 6.0.4

With iTunes 6, you can preview, buy, and download over 3,000 music videos and hit TV shows on the iTunes Music Store and sync your music and purchased videos with iPod to enjoy on the go. To watch purchased videos, you must have QuickTime 7.0.3 or later and Mac OS X 10.3.9 or later. iTunes 6.0.4 (19.5MB) addresses stability and performance issues related to Front Row.

Front Row 1.2.1

With Front Row, you can enjoy full-screen music, photos, videos, and DVDs on your Macintosh using a simple Apple remote control. This Front Row 1.2.1 (5.5MB) improves compatibility with iTunes and iPhoto sharing.

iPhoto 6.0.2

iPhoto has always been the best way to easily import photos from your digital camera, organize them for fast retrieval, and then share them with family and friends. iPhoto 6.0.2 (13.7MB) resolves several minor issues with playing shared slideshows in Front Row.

Security Update 2006-001 Mac OS X 10.4.5 (PPC)

Security Update 2006-001 (12.5MB) is recommended for all users and improves the security of the following components: apache_mod_php, automount, Bom, Directory Services, iChat, IPSec, LaunchServices, LibSystem, loginwindow, OpenSSH, rsync, Safari, and Syndication.

Security Update 2006-001 Mac OS X 10.4.5 (Intel)

Security Update 2006-001 (22.5MB) is recommended for all users and improves the security of the following components: apache_mod_php, automount, Bom, Directory Services, iChat, IPSec, LaunchServices, LibSystem, loginwindow, OpenSSH, rsync, Safari, and Syndication.

Security Update 2006-001 (10.3.9 Client)

Security Update 2006-001 (25.3MB) is recommended for all users and improves the security of the following components: apache_mod_php, automount, Bom, Directory Services, IPSec, LibSystem, loginwindow, perl, Safari.

Security Update 2006-001 (10.3.9 Server)

Security Update 2006-001 (38.6MB) is recommended for all users and improves the security of the following components: apache_mod_php, automount, Bom, Directory Services, IPSec, LibSystem, loginwindow, perl, Safari.

Follow AppleInsider on Google News

17 Comments

wgauvin

said about 18 years ago

From Apple's website

Mail
Available for: Mac OS X v10.4.5, Mac OS X Server v10.4.5

Impact: Download Validation fails to warn about unsafe file types

Description: In Mac OS X v10.4 Tiger, when an email attachment is double-clicked in Mail, Download Validation is used to warn the user if the file type is not "safe". Certain techniques can be used to disguise the file's type so that Download Validation is bypassed. This update addresses the issue by presenting Download Validation with the entire file, providing more information for Download Validation to detect unknown or unsafe file types in attachments.

Safari, LaunchServices
Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.5, Mac OS X Server v10.4.5

Impact: Viewing a malicious web site may result in arbitrary code execution

Description: It is possible to construct a file which appears to be a safe file type, such as an image or movie, but is actually an application. When the "Open `safe' files after downloading" option is enabled in Safari's General preferences, visiting a malicious web site may result in the automatic download and execution of such a file. A proof-of-concept has been detected on public web sites that demonstrates the automatic execution of shell scripts. This update addresses the issue by performing additional download validation so that the user is warned (in Mac OS X v10.4.5) or the download is not automatically opened (in Mac OS X v10.3.9).

iChat
A malicious application named Leap.A that attempts to propagate using iChat has been detected. With this update for Mac OS X v10.4.5 and Mac OS X Server v10.4.5, iChat now uses Download Validation to warn of unknown or unsafe file types during file transfers.

WOHOO! They didn't take long to fix that. Still, it shouldn't of been the problem in the first place

Edit: added info about iChat

chrisg

said about 18 years ago

While Safari/Mail/iChat now warns you the resulting file still looks like an image/movie/etc. Nothing is done to show you that there is code in the file. If you just mindlessly click the "Download" button (Like most people do since it seems Safari warns you about everything you download) the file doesn't get auto run but a File.jpg will still be on your Desktop which you might come to later and double click to see what the heck it is. And boom.... Terminal opens your home directory all gone... hope you had a backup.

They should warn you if a image is trying to open in Terminal.... not something you would normally do.

wgauvin

said about 18 years ago

Quote:

Originally posted by ChrisG
While Safari/Mail/iChat now warns you the resulting file still looks like an image/movie/etc. Nothing is done to show you that there is code in the file. If you just mindlessly click the "Download" button (Like most people do since it seems Safari warns you about everything you download) the file doesn't get auto run but a File.jpg will still be on your Desktop which you might come to later and double click to see what the heck it is. And boom.... Terminal opens your home directory all gone... hope you had a backup.

They should warn you if a image is trying to open in Terminal.... not something you would normally do.

I agree, it comes down to the fact that these files have an associated 'Open with' doesn't match the default open with for the file type, this is what ultimately needs to be addressed.

boardwalk2

said about 18 years ago

Strange problems with Front Row "Shared Music" after the update. Complains latest iTunes is required to see Shared Music even though iTunes is 6.0.4, the latest. Front Row->Photo->Shared Photos sees the Photos/Albums/Slide Shows in networked Macs. So Front Row is aware of Bonjour, but some reason iTunes is not able to work with it. However, on the regular desktop iTunes detects Shared Libraries and play music from networked macs. Even strange is when iTunes is playing music from networked mac, going into Front Row and selecting next track, volume, etc. works fine. So there is a bug in the "Shared Music" part of Front Row. Running this on a iMac Intel. Networked macs are G4 and G3 iMacs.

dr_gonzo

said about 18 years ago

They're still not fixing the problem that the file's type is identified purely by the extension name. What happens if the "open safe files" option is unchecked? The user will download the file and then double click it. Finder still shows the shell script as a movie/image/whatever.

This is requires a trivial fix too. The 3 following changes would prevent this existing security problem from appearing ever again:

1) Instead of the system identifying a file type from its extension, it should identify it by its magic number (see man file for an explanation of this).

2) An icon of a normal file should not be changeable. If the icon of an image is set to something different, the icon should be used for all icons.

3) Executable files' icons should have a little image on them to show that they're executable in the same way that aliases have a little arrow on them to show that they are aliases.

I wonder why Apple don't fix this security hole once and for all.