Apple May 2016 Mac OS X Updates

Apple Mac OS X Updates

Happy Apple Patch Monday! Today’s, Apple May 2016 Mac OS X Updates impact Mac OS X including El Capitan 10.11.5, Security Update 2016-003 for Mavericks 10.9.5 and Yosemite 10.10.5, and Safari 9.1.1. In total, there were 77 vulnerabilities fixed including many high risk vulnerabilities that should be remediated quickly

OS X 10.11.5 and Security Update 2016-003

The last Mac OS X Security Update was on March 21 and today’s release of OS X 10.11.5 and Security Update 2016-003 brings fixes to 67 vulnerabilities across OS X Mavericks 10.9.5, OS X Yosemite 10.10.5, and OS X El Capitan 10.11. As with previous security updates the majority of vulnerabilities are only fixed in El Capitan. Here is the breakdown of vulnerabilities fixed by OS X version:

  • 12 in Mavericks 10.9.5
  • 13 in Yosemite 10.10.5
  • All 70 fixed in El Capitan 10.11

With Apple’s latest version focus, it is very interesting to explore the vulnerabilities that were fixed in the older versions. Included in that mix are vulnerabilities where:

  • Application that can determine the kernel memory layout
  • Attacker in a privileged network may execute arbitrary code with user assistance
  • Malicious XML, website, or web content may lead to arbitrary code execution

The last category is most interesting as malicious websites or files are useful for hackers to social engineer their way onto a system.

From the vulnerabilities only fixed in El Capitan, there is of note for the exploitability and impact. The first is a vulnerability in QuickTime (CVE-2016-1848) where opening a maliciously crafted file may lead to arbitrary code execution. This is interesting in that social engineering could be employed to get a user to click on video file such as using a headline of the day that would be enticing to watch such as “Funny Quotes from Donald Trump” and bad things ensue (quite literally in the case of a malicious video).

There are many other vulnerabilities, but the true severity and impact is obscured by Apple’s limited information. That said, there is plenty of reasons to update quickly.

Safari 9.1.1

Safari 9.1.1 applies to Mavericks 10.9.5, Yosemite 10.10.5, and El Capitan 10.11.5. This is a minor update with 7 vulnerabilities fixed including 5 where arbitrary code could be executed by visiting a malicious website. Such vulnerabilities are hooks for Phishers to use to bait users to visit malicious websites and compromise their systems. One other vulnerability is a minor risk in that it prevents fully deleting browsing history. The final vulnerability (CVE-2016-1858) is moderate risk where visiting a malicious website may disclose data from another website. If you have any doubt, make sure Safari is up to date quickly as the 5 arbitrary code vulnerabilities will undoubtedly be useful for targeting users.

Other Updates

Apple usually releases updates for everything at once and this release is no different. There were also updates for iOS (9.3.2), watchOS (2.2.1), tvOS(9.2.1), and iTunes (12.4).

Summary

This month’s updates do little to entice users to want to update their systems in terms of new features. That said, Apple will push them down unless a user explicitly avoids it. There is enough critical vulnerabilities in these updates that all organizations should ensure all Mac OS X systems are up to date quickly.

Flash Zero Day Closure, or maybe not…

FlashPlayerLogoIt was a confusing week for those tracking the Adobe Flash Player update.  Let me summarize what happened and what may still be lingering.

Flash Player did announce an Advisory on Patch Tuesday (APSA16-02) announcing a Zero Day vulnerability (CVE-2016-4117) which was detected in exploits in the wild.  The update for the Zero Day did not drop on Patch Tuesday.  Instead it was released on Thursday this week (May 12th) as bulletin APSB16-15.

As many of you are familiar with already, updating Adobe Flash Player is not a simple matter of updating a single product.  If you are running Internet Explorer, Chrome and Firefox and are using the Flash Player Plug-In you could have three more variations of Flash Player that need updating to fully resolve the vulnerabilities in a new release.  That is where the confusion set in this week.

On Patch Tuesday, Microsoft released MS16-064, which was the Critical update for Adobe Flash Player as it is bundled in Windows OS and IE versions.  This update documented the 24 fixes initially planned for release by Adobe in bulletin APSB16-15, but did not include the Zero Day vulnerability (CVE-2016-4117).  Today (Friday May 13th) Microsoft re-released MS16-064 to address the slight version update that included the exploited vulnerability.

What is a bit uncertain at the moment is Chrome.  When Flash Player updates occur, Chrome also needs to be updated to support the newer version of the Flash Player Plug-In.  The Chrome update this week came out before the Flash Player Zero Day was resolved.  Does this mean that they are only supporting the initial drop similar to Microsoft releasing on Patch Tuesday?

I will be doing my typical Patch Tuesday Round Up next week and will try to have answers by then on if there is still a bit of Zero Day hanging on the spring breeze or if we are good.

For updates like this and more relating to Patch Tuesday check out our webinars page for upcoming Patch Tuesday webinars and on-demand playback of previous Patch Tuesday webinars and presentations for download.

Tech Summit Preview: Shavlik Protect Advanced Features

shavlik-technical-summit-logo-640

Think you are a Shavlik Protect expert? Whether you are a Protect veteran or a noob, we would like to expand your expertise during the Shavlik Technical Summit at Interchange in Las Vegas on May 24-25. There are many Shavlik Protect advanced features we will go into including (but not limited to) predictive patching, content updates, distribution servers, scheduled reporting, rollups and other advanced features, including those new to version 9.2.

We know Protect is quick and easy to setup and configure, but there is so much more under the surface. One of our goals is to demystify many of the advanced features that will maximize the value of Shavlik Protect in any environment. We hope to introduce you to capabilities you didn’t even know existed and help you understand how to implement Shavlik Protect’s advanced features in your environment.

We’re bringing some of our best engineers and product managers together to mind meld with you during a few days of training and extracurricular activities. Look forward to seeing you there.

May Patch Tuesday 2016

ShavlikMay_PATCH02fMay’s Patch Tuesday has a few juicy surprises for us. On the Microsoft side, there is one vulnerability being exploited in the wild that affects both Internet Explorer (MS16-051) and Windows (MS16-053).  Additionally, two public disclosures will raise concerns with Internet Explorer (MS16-051) and .Net Framework (MS16-065). We also have a Zero Day in Flash Player from Adobe that has caused some confusion considering Adobe just published an Advisory page (APSA16-02) stating the update resolves CVE-2016-4117, which was reported to Adobe by a researcher at FireEye, a security firm. We are also seeing Microsoft publish MS16-064, a bulletin to update Adobe Flash Player plug-in support for Windows and Internet Explorer; which has details of APSB16-15, including 24 CVEs that will be included in the update. So, the question is, why did Adobe not release the update?  Will Microsoft end up pulling the bundled version in MS16-064 when the Adobe bulletin releases next week?

In total, Microsoft released 16 bulletins today, eight critical and eight deemed important. There are also 33 unique CVEs being resolved, including one Zero Day that affects two bulletins and two public disclosures.

Today, Adobe released bulletins for Adobe Reader, Cold Fusion and an advisory for Flash Player that should see a bulletin release as soon as this Thursday. The two bulletins resolve for a total of 85 CVEs. With the addition of Flash Player later this week, if the Microsoft bulletin is accurate, it should bring the total to 109 CVEs resolved from Adobe this month.

MS16-051 is a critical update for Internet Explorer and Windows resolving five total vulnerabilities, including one known exploited (CVE-2016-0189) and one public disclosure (CVE-2016-0188).  The vulnerability that has been exploited can be used in user-targeted attacks such as through a specially crafted website designed to exploit the vulnerability through Internet Explorer or ActiveX controls marked “safe for initialization” in an application or Microsoft Office document that hosts the IE rendering engine.  The attacker gains equal privileges to the logged-on user, so running as less than administrator will mitigate the impact of exploitation.

It is recommended to get your IE updates rolled out quickly this month. For those running less than the latest IE version available for the OS its installed on, be aware that Microsoft reduced support in January to only update the latest version available on supported Operating Systems.

MS16-053 is a critical update for Microsoft Windows that resolves two vulnerabilities, including the known exploited (CVE-2016-0189).  This OS update is another that’s recommended to rollout as quickly as possible this month as it affects older versions of the OS and VMScript and JScript versions. The vulnerability that has been exploited can be used in user-targeted attacks such as a specially crafted website designed to exploit the vulnerability through Internet Explorer or ActiveX controls marked “safe for initialization” in an application or Microsoft Office document that hosts the IE rendering engine.  The attacker gains privileges equal to the logged on user, so running as less than administrator will mitigate the impact of exploit.

The other five critical updates from Microsoft affect Office, SharePoint and Windows OS. These bulletins should be tested and implemented within two weeks to reduce exposure.

MS16-065 is an important update for .Net Framework that includes a public disclosure. It is recommended to add this update to the two-week rollout list this month. A public disclosure means an attacker has additional knowledge, making CVE-2016-0149 more likely to be exploited. The vulnerability is an information disclosure in TLS/SSL that could enable an attacker to decrypt encrypted SSL/TLS traffic. To exploit the vulnerability, an attacker would first have to inject unencrypted data into the secure channel and then perform a man-in-the-middle attack between the targeted client and a legitimate server.  On network this may be harder to achieve, but users who leave the network could be at higher risk of exposure to a scenario where this type of attack is possible. Keep in mind, Microsoft recommends thorough testing before rolling out to production environments.

Adobe Reader APSB16-14 is rated as a priority two, but resolves 82 vulnerabilities. By sheer force of numbers, we are suggesting this update be considered a higher priority. As a result, be sure it is tested and put into effect within four weeks.

Adobe Flash Player only released an advisory today, but it included high-level details of a vulnerability that has been detected in exploits in the wild. If information gleaned from MS16-064 is accurate, this Zero Day will be accompanied by 23 additional CVEs, with the release expected on May 12th. With this in mind, the recommendation is to roll this update out immediately.

With Adobe Flash Player it’s important to keep in mind there are multiple updates that need to be installed in order to fully address the vulnerabilities, including Flash Player, Flash Plug-Ins in Internet Explorer (MS16-064), Google Chrome (expect an update when APSB16-15 releases later this week) and for FireFox.

Join us tomorrow for the May Patch Tuesday webinar where we will discuss the bulletins in more detail.

Shavlik Tech Summit Preview: Patch Management Best Practices

Patch Management Best Practices at the Shavlik Technical Sumit 2016

Shavlik has been in the business of patch management for a very long time. From HFNetChk to Shavlik Protect, Shavlik Patch, and now Shavlik Empower, we’ve spent a long time building industry-leading patch management solutions. Along the way, we’ve built up a lot of expertise around patch management best practices. By now, we hope you’ve seen our Patch Tuesday analysis and webinars as well as insights on 3rd party applications, and Apple Mac OS X updates. It’s overdue that we have a face to face to share our cumulative knowledge on patch management best practices and we have just the event to do that.

At the Shavlik Technical Summit at Interchange in Las Vegas on May 24-25, we want to share our insights on patch management best practices so you can have a better understanding of how to address the process, people, and technology to keep your environment secure and stable. We’ll spend time helping you understand our products, but more importantly the processes and approaches to maximize success. We will also discuss how top vendors release patches, potential pitfalls, and changes that are coming. It’s not too late to register, so join us in Vegas and let us help you become a patch management expert for your company.