Apple Pushes Its First Automated Security Update To Squash Critical OS X NTP Flaw

When a computer vulnerability is revealed by both the Department of Homeland Security and Carnegie Mellon University Software Engineering Institute, I'd say there's a pretty good chance that it shouldn't be ignored. Apparently, Apple agrees. Today, the Cupertino firm released its first-ever forced update, taking advantage of a mechanism first rolled-out to OS X just a couple of years ago.

The software at fault is ntp, or network time protocol, which in older versions has a severe enough bug that could allow exploiters to gain control over a machine -- something that's no doubt helped by the fact that many routers don't restrict its port (123) in either direction.

NTP Network Time Protocol
Illustration of how Network Time Protocol works

While Apple seems to be getting the lion's share of the attention here, ntp isn't unique to OS X. In fact, this exact piece of software is also used on Linux systems. I don't personally use ntp, but I decided to check my distro's (Gentoo) repository to see if changes had been made.

Yesterday, there were a total of 12 ntp versions available; today, there are only three, including 4.2.8-r1 and a patched 4.2.6. Looking around, I can see that some distros beat Gentoo to the punch; both Ubuntu and Arch Linux released a patched ntp on Saturday.

Gentoo ntp Updates
Sign of ntp updates in one Linux distribution

On either Linux or OS X, it's best to make sure you're up-to-date. If you booted up OS X today and didn't see an automatic notification at the top-right corner, I'd recommend running the updater. In Linux, you can use your package manager to see if you're running at least 4.2.8, and if you're not, but did update, you should head to Google and see whether the version you are using is in fact vulnerable. If you see a version older than 4.2.6, you should consider yourself exposed.

At this point, Apple has no proof that any of its users have been exploited, but with a bug this severe, you sure don't want to rest on your laurels when it comes to updating.


Via:  Reuters
Show comments blog comments powered by Disqus