MacDailyNews - Where Mac news comes first

They finally fixed Chess!!!

W00t!

Dec 15, 08 - 01:43 pm Comment from: HMCIV

@Radius

I am junking my Nintendo Wii as soon as I get home.

Dec 15, 08 - 01:43 pm Comment from: Scott

Fix my iChat cam freezing please!!

nice!! mobileME syncs from MAC -> Cloud now work like they should! yay!

MDN: beyond. as in beyond belief they finally fixed this

just installed it... hopefully my Time Machine errors will be gone
*cross fingers*

Why oh why Setup Assistant kicks in after this update as though I just performed full OS install?

MDN: areas, as "Apple, there are still areas to be improved"

It feels snappier.

Dec 15, 08 - 02:00 pm Comment from: Jubei

I'm feeling snappy right now, and I don't even have it loaded yet.. Getting it right now.

The snappiness is overwhelming! I'm gonna snap!

Safari still reporting to Google about every website you visit, despite turning off the option in Safari preferences.

Looks like we will have to alter our etc/hosts file to block our computers from accessing Google's servers for complete privacy.

Dec 15, 08 - 02:04 pm Comment from: Jubei

Actually its labeled wrong by Apple the Combo Update is about 669MB download.

Finder version 10.5.8?

My update says it is a security update. Maybe the OS update will come after the security. (73.2mb)

Impact: Attempting to launch unsafe downloaded content may not lead to a warning

Description: Mac OS X provides the Download Validation capability to indicate potentially unsafe files. Applications such as Safari and others use Download Validation to help warn users prior to launching files marked as potentially unsafe. This update adds to the list of potentially unsafe types. It adds the content type for files that have executable permissions and no specific application association. These files are potentially unsafe as they will launch in Terminal and their content will be executed as commands. While these files are not automatically launched, if manually opened they could lead to the execution of arbitrary code. This issue does not affect systems prior to Mac OS X v10.5.

This exploit has been in existence for several years and finally Apple fixes the root cause of the problem.

It was called the Metadata exploit.

Shame it took Apple so long to get to it. Wonder how many people have been exposed?

Basically it worked like this.

1: Download a file and double-click on it thinking it's a file, movie or picture. (Which it might well have.)

2: Terminal launches and runs a hidden program and/or installing in your startup items or elsewhere to auto-launch upon login.

3: This hidden process monitors your system for a time until you enter your admin password, which it captures and proceeds to gain root access.

Pron pictures/movies, files from p2p networks and friends were especially susceptible to carrying this malicious exploit.

Apple's "verification" process is quite limited, as files can be transfered to one another. So this is really no help.

I wonder if this update will unify the (macbook in my case) driver base. I want to swap my 2006 macbook hd into my new unibody macbook without driver issues.

Dec 15, 08 - 02:20 pm Comment from: thethirdshoe

It's going onto 4 machines. I only want to download it once.

To reduce your exposure to exploits.

Never run as admin, the standard install of OS X.

Instead:

A: Create a new user and give them Admin access.

B: Log out of your current Admin and log into the new Admin user

C: Change the first Admin to Standard User and log in use that.

What's nice about this is if you make any System changes, software installs, app folder changes etc, you have to provide a Admin password.

You don't have to log out either.

However if your using cloning software or system change software, do log in to Admin.

Anyone who has locked down Terminal via permissions or folder lockdown will find OS X updates now REPLACE Terminal back in the Utilities folder REGARDLESS. This was the prefered method to block this exploit for many years. Hopefully now Apple has finally fixed the issue.

Dec 15, 08 - 02:21 pm Comment from: Bob

Is the spotlight icon different? Or is it just me...

I still haven't figured how to sync my Entourage contacts with my iPhone (which arrived yesterday). For some odd reason, Entourage calendar events etc has its own button but Entourage contacts just doesn't exist. Anyone got a clue here? Oh btw, did they repair Spotlight? I mean, can one sort by size in column view now?

It's going onto 4 machines. I only want to download it once

Same make and model for all 4 machines, you can download once. Otherwise use Software Update.

Update server is slammed at this time.

Seems like Dashboard loads much quicker.

Dec 15, 08 - 02:36 pm Comment from: Dan

" Improves printing for the Adobe CS3 application suite."

Adobe CS4 shipped Oct 18th.

Dec 15, 08 - 02:41 pm Comment from: Tommy Boy

@ Radius: Fixed Chess? I wish. My Mac still beats me every time.

Dec 15, 08 - 02:41 pm Comment from: LordRobin

Wouldn't an exploit that opens Terminal be kind of obvious to anyone that was paying attention? First, the Terminal icon would appear in the dock and bounce, then Terminal would come up to the top and a window would open, then text would appear in the window.

Now, once that happened, there may be commands that could be entered in Terminal to hide the window, and I suppose that it could quit Terminal when it was done. But still, that initial Terminal activation would be really blatant.

I would say that the only people at serious risk for this exploit would be the technically unsavvy. (Unfortunately, these are the same people who have trouble taking measures to prevent this kind of thing.)

------RM

Update went smoothly, feels snappier, or it could be my new 64GB SSD I installed over the weekend. Only $127 at Geeks.com. Doubled my random read and write score on XBench, compared to my old 7200rpm drive.

I now have two machines stuck at "Configuring installation"

G5 iMac and late 2007 Macbook Pro.

MW: young - I'm not getting young waiting for the install to finish.

@Dan

Quote:

" Improves printing for the Adobe CS3 application suite."

Adobe CS4 shipped Oct 18th.

Unquote.

Some of us are still using CS3 applications.

What still no fix for the time problem when using Boot Camp.

It is a major pain in the ass to have to fix the clock ever time I switch between operating systems, (For some reason I can't reach the internet time servers to have this done automatically when I am at work.

Nope, only a security update. But the 4 computers updated are PPC. Haven't done the Intel

ditto, I can't believe that Apple doesn't fix their own search machine. Now everyone needs Houdaspot just because apple forgot about size, creation date, modified etc. Way to go Apple.

Any improvement to Airport is a good thing.

It it the Mac's weakest link - I'd like to say "good bye"!

I may actually use my 10.5 disk now. The box has been gathering dust waiting for this day. It's hard to leave all my classic software behind though (even if I never use any of it).
1.25 g4 mini

First, the Terminal icon would appear in the dock and bounce, then Terminal would come up to the top and a window would open, then text would appear in the window.

The Dock could be hidden and yes the window could appear fast and disappear with Terminal quitting.

Even if one caught it and suspected something, the code could be installed.

Here is the very old advisory about this exploit, the test has been removed because of so many people using it to play tricks on people.

notice it says

"NOTE: The update does not completely fix the vulnerability as it is still possible to trick users into opening malicious shell scripts (masqueraded as a safe file type) in ZIP archives. Do not open files in untrusted archives."

The Apple patch at the time didn't fix the issue, a download warning later on wasn't any help and Apple just thought the problem was fixed when it wasn't completely fixed. Hopefully now the issue was fixed, but the test page is gone to verify.

http://secunia.com/advisories/18963/

Notice on this page

http://secunia.com/advisories/product/96/?task=advisories

the list of fixed and open exploits for OS X and how long the MetaData Exploit has gone untreated as "Extreme"

How and why did Apple go for so long without a fix is unknown.

Flash CS4 now crashes when working with text – just fantastic. I'm on a PPC G5.

@ Sara regarding Entourage sync:

To sync Entourage contacts with an iPhone you have to turn on sync with Address Book and the same with the calendar function. Go to Entourage Preferences to turn that on.

Beware, however, that the whole Entourage/Apple sync system has some very odd behaviors. Hopefully, recent updates from both Microsoft and Apple have fixed these problems, but I'm not holding my breath.

@ Paul TMSG and the others trying to scare everyone and general bring everyone down on what should be a day of rejoicing ....

Your comments are overblown and not really relevant. Only an ass takes the opportunity when a fix is announced to moan about how it took so long to fix it. Your mother might have told you about such things. It's called "Looking a Gift Horse in the Mouth" and is generally frowned upon and only practised by a-holes.

If you read the vulnerability descriptions carefully, the malicious file can't even be disguised as another file (as was kind of implied in the first description by "Paul ...").

You basically have to download a zip archive on LimeWire or something (illegal to start with), it has to have a bunch of files in it so that the malicious one is not so visible (most likely a program folder, so illegal again). Then you have to unzip the file, not noticing that it started terminal and all kinds of things are happening in background (so you have to be a total novice at downloading and using illegal files as well because this is the very moment when anyone with any sense would be hyper-vigilant). Then you have to do nothing for about a week or two until the system asks you for your master password which the thingie you left running in the background will then steal.

Anyone caught by this security flaw soundly deserves to have their system taken down. Anyone who actually looses data because they are further stupid enough not to have a backup deserves to lose that data.

With a bug this serious, it's possible that up to five people got caught with it!!!!

Oh Noez! :0

Dec 15, 08 - 04:31 pm Comment from: TowerTone

Now my bra is un-snappier!
Wait....

Man, Time Machine gets an error that reads "the backup disk image could not be mounted.", it still won't connect to the server, and, Time Capsule can't backup any of my info. Any suggestions?

yes, fix Spotlight!

I'll never understand why everyone rushes to be the first one to download and install an update before waiting a while to find out what new issues and problems are cause by it. Patience is a virtue, people.

Same here, MacBook 2007 stuck @ Configuring Installation. PowerMac Quad upgrade went smooth

RE :: Chester

When you buy a Mac, you are automatically hired by Apple to do the beta testing for them!

It's in the fine print.

I came to Mac in August and I got more issues with MAC then Windows... My friends Macbook just went after 3 years... Not sure if Apple is progressing or regressing.

Hope this makes iTunes usable again!

scrolling in the iTunes store=computer explodes

I will be very upset if this update screws up the video drivers. BF1942 was useless under 10.5.5

Dec 15, 08 - 05:21 pm Comment from: sparkplug

Also stuck at "Configuring Installation."

iMac 8.1
Mac OS X 10.5.5

I've downloaded and installed the update. No problems so far.

Mine stuck as well but I restarted and re-downloaded the update and it installed fine.

No problems downloading and installing on my Macbook Air (October release). All looks good.

Dec 15, 08 - 05:44 pm Comment from: GmanMac

All good here. Intel iMac.

Marco:

You have more issues, not you got more issues. The word is than. Not then, than. And it's Mac, not MAC, although you get 1/2 credit for using it correctly once. Your friend's Macbook, not friends Macbook.

What are you, 12?

MDN Magic Word: level, as in, what is the highest grade level you achieved?