'Month of Apple Bugs' turns up 10 flaws so far

11.01.2007

But so far, at least, none of the disclosed vulnerabilities appear to be "showstoppers," Marcus said. In fact, the only flaws that appear to be "interesting" is one affecting QuickTime that allows for arbitrary code execution and an Adobe PDF flaw that affects multiple operating environments, including the Mac OSX, he said. "They are interesting because they affect products that are commonly and widely used." Marcus said.

The decision by Finisterre and LMH to publicly disclose flaws before giving Apple a chance to address them has raised the risk for users, Marcus said. But the efforts by an ex-Apple engineer named Landon Fuller to issue fixes for each of the flaws being disclosed is mitigating some of that risk, he said.

Fuller did not immediately respond to a request for comment. But his fixes and workarounds for the flaws are posted at landonf.bikemonkey.org/.

Apple itself has not released any patches for the flaws and did not discuss how it would respond to the disclosures. In a brief e-mailed statement, a spokesman for the company said that Apple "has a great track record of addressing potential security vulnerabilities before they can affect users," but did not offer any elaboration.

The statement also noted that Apple welcomes feedback on improving security for the Mac platform.