Apple OS X update plugs 20 security holes

Apple's latest update fixes the recent Leap-A and Safari security vulnerabilities in Mac OS X

Apple has released a security update that patches 20 holes in its OS X operating system and bundled applications. 

Malware writers have released several high profile viruses in recent weeks, and security experts disclosed last week that they had found a critical security hole in the operating system.

"The update fixes the recently reported Leap-A and Safari security vulnerabilities," an Apple spokesman told vnunet.com.

The Safari vulnerability was exposed last week by German researcher Michael Lehn. The flaw could allow an attacker to launch arbitrary code on a Mac computer running the Safari browser through the use of a specially crafted website. 

The Apple security update also contains a fix for a vulnerability in relation to the Safari flaw. It affects the way that the operating system unpacks and executes meta data in certain types of archives.

This could be exploited in combination with the Safari vulnerability or by persuading a user to open an email message containing a specially crafted archive file.

The update also changes some OS X security settings to protect users against worms such as Leap-A that were detected last month.

The worm spread through Apple's iChat instant messaging client by sending a file to the buddies in a user's contact list, warning users when they are downloading unknown or unsafe file types through the use of a feature called Download Validation.

The same feature is also used in the Mail application, but in this case attackers could disguise a file's type to bypass the security feature. The update closes this loophole.

Less severe vulnerabilities have also been repaired, such as a flaw in Directory Service that allows local users to create and manipulate files as a root user.

Attackers could have exploited another design flaw in the way that the software handled IPsec to launch a denial of service attack against virtual private networks.

Users can install the update through the auto update feature in the operating system or by downloading the patch from Apple's website here. 

• Silicon Valley Sleuth: Apple rises to the security challenge