6 ms·

About the security content of macOS Catalina 10.15.5

82 points by vngzs 6y ago

vngzs 6y ago
The Apple product security team just submitted this to the Full Disclosure mailing list[0]. There's a Python arbitrary remote code execution flaw addressed in this update (CVE-2020-9793). The same flaw is present in iOS as well[1][2]. [0]: http://seclists.org/fulldisclosure/2020/May/53 http://seclists.org/fulldisclosure/2020/May/53 [1]: http://seclists.org/fulldisclosure/2020/May/49 http://seclists.org/fulldisclosure/2020/May/49 [2]: https://support.apple.com/en-us/HT211168 https://support.apple.com/en-us/HT211168
- JonathonW 6y ago
  The Python vulnerability has been removed from the iOS vulnerability list on Apple Support... iOS does not ship Python, so it was likely included by mistake.
  - vngzs 6y ago
    Ah, it has! That explains my confusion about why Python is even present on iOS. There's still a good meat of interesting vulnerabilities here, but many of the interesting ones have hidden details for now. I'm looking forward to when the full CVEs come out.
  - snazz 6y ago
    Yes. There was also a Zsh vulnerability mistakenly included in the iOS list.
- mistrial9 6y ago
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492 .. leads to https://bugs.python.org/issue39503 https://bugs.python.org/issue39503 which is no-big-deal https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9793 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9793 .. is cloaked.. but personally I am sceptical of "giant ball of fixes" with "urgent/required priority" that actually "do other things the vendor wants besides the advertised fix" and "aggrandizes obscure vulnerabilities as a security treadmill"
- saagarjha 6y ago
  This is also available through https://lists.apple.com/mailman/listinfo/security-announce https://lists.apple.com/mailman/listinfo/security-announce.
bgorman 6y ago
Is this a normal disclosure? I just purchased a Mac but the list of potential kernel exploits seems much higher than I would expect in a point release.
- iphone_elegance 6y ago
  yeah, apples software has the same flaws as everybody elses ( especially safari )
- barkingcat 6y ago
  Apple has as many kernel exploits as any other, software is not perfect. macOS has a long history of many many security patches in point releases, sometimes the release notes run into the tens of pages. The point of view you should take is that the company that doesn't issue security fixes (or issues very few comparatively) is the one you should be worried about: They are not better, they just don't fix anything and leave you vulnerable instead.
  - skrtskrt 6y ago
    I haven't used Windows since I needed it for obscure engineering software in college, but I did find that the frequency of security updates combined with Windows reputation made me feel more uneasy rather than positive. I felt less like "Oh good they're being proactive" and more like "Do they introduce 3 vulnerabilities for every one they fix?"
    - tpetry 6y ago
      Bit the bonus is microsoft is patching these vulnerabilites at best every two weeks. For macos you have to wait for the next minor release which may take a lot longer.
      - acdha 6y ago
        Apple has shipped out-of-band security updates quickly — they must have an internal process for weighing severity versus the user fatigue from shipping frequent updates.
snazz 6y ago
I've noticed that Apple has started releasing Darwin sources more often. This is a really huge improvement for security research, since it lets outside researchers see the mitigations and fixes that Apple made to kernel security vulnerabilities quicker. This way, incomplete or otherwise incorrect fixes can be reported to Apple before that kernel version has been in the wild for a long time.
- saagarjha 6y ago
  As someone who maintains mirrors of Apple's open source releases: eh. They had a week a couple months back where they deleted the download links for every old version of XNU; they've been OK for the last few weeks on opensource.apple.com itself but opensource.apple.com/tarballs has been slow to update for all projects (I even sent them an email about it!) And it's important to note that a lot of the actual security features that the system relies on (such as much of the sandboxing code) is not included in the open source release at all.
  - snazz 6y ago
    I've been using https://github.com/clemensg/xnu https://github.com/clemensg/xnu to look through the releases and there's definitely been an uptick recently (although that particular repo was suddenly updated after I made an issue).
    - saagarjha 6y ago
      I keep mine at https://github.com/apple-open-source-mirror https://github.com/apple-open-source-mirror, but I have not updated it as the new dyld-733.8 tarballs aren't linked yet and I like to keep them all in sync :(
  - tannhaeuser 6y ago
    Sorry to hijack but would you know a way to run Darwin from sources as an OS for testing Mac builds (backend and command-line apps without GUI)? Clang and/or gcc would be a plus to have. I've looked at the PureDarwin project but that doesn't seem to provide anything I could use. Apple's update treadmill, notarization, SIP, and other tightening makes Mac OS an increasingly annoying and expensive/time-consuming platform to port software to.
rcarmo 6y ago
Still no news about the mail data losses since 10.15.0... Ah well.
- allenbrunson 6y ago
  i held off upgrading to catalina for as long as possible, due to the mail bug and other issues, like the removal of itunes, which broke all my applescripts. alas, xcode is one of my bread-and-butter apps. recent versions require catalina, so i had to switch. due to the mail data loss bug, i bought a third-party mail client. it's good to support small developers, i guess?
- yborg 6y ago
  What is this bug? I've been using Mail on Catalina for the last 6 months and haven't noticed any problems.
  - rcarmo 6y ago
    I assume I was downvoted out of spite or by someone who's not aware of this: https://mjtsai.com/blog/2019/10/11/mail-data-loss-in-macos-10-15/ https://mjtsai.com/blog/2019/10/11/mail-data-loss-in-macos-1... Michael Tsai has been keeping track of this since October, and regularly comments on this with every Catalina update, like the last one: https://mjtsai.com/blog/2020/05/27/macos-10-15-5/ https://mjtsai.com/blog/2020/05/27/macos-10-15-5/
- mmariani 6y ago
  Run fsck on your disk. I had the same problem, digging into it I found APFS had hopelessly corrupted my disk, its snapshots, and the time machine backups. In the process I not only lost mail and other files, but I had unexpected app crashes and casual kernel panics. Once I found the corrupted files I had to log in into single user mode to remove them as I couldn’t even as root when logged as usual. Don’t forget to delete your APFS snapshots, if you don’t the problem will quietly sneak in again. After that you’re safe to make a new snapshot and a new backup. Why didn’t Apple just give us ZFS instead of the shitshow APFS is?
- apple4ever 6y ago
vinay_ys 6y ago
This seems like a very large release with lots of security fixes. Wonder if Apple is releasing the security fixes quickly enough after it is found and reported or are they batching these fixes into a larger and fewer release and in doing so are they putting users at risk unnecessarily for longer duration.
- saagarjha 6y ago
  Here's the list for 10.15.4: https://support.apple.com/en-us/HT211100 https://support.apple.com/en-us/HT211100. This one does not seem unusually large.
LordFast 6y ago
Does Catalina have more security issues? Or are we just talking about them more than before?
- quantummkv 6y ago
  Just more talking. The kind of bugs and their number are not that far off from windows or linux systems.
- saagarjha 6y ago
  Looks about the same as usual.
daneel_w 6y ago
If you are a Mojave user please exercise caution when installing Security Update 2020-003 for Mojave, which was released together with Catalina 10.15.5. This update annulled my user's password. I couldn't log back in again once the update was installed. I had to use the original administrator account of my macOS setup in order to reset the password. While searching for information on the problem I came upon another Mojave user who experienced the same problem. Twice... https://forums.macrumors.com/threads/login-password-screws-up-after-security-update-2020-002-and-2020-003.2227824/ https://forums.macrumors.com/threads/login-password-screws-u...
jwiley 6y ago
I wonder why patches for individual security updates are pushed out individually instead of following the hard release process? We moved away from that in the web / app space decades ago, it's hard to imagine saying "guys, we need to wait 3 months to fix an SQL injection vulnerability to avoid churn." Also...Mac updates are theoretically 'automatically installed', but somehow I have to notice and update, enter my password, and agree to restart and occasionally terms of service for every update which feels clunky.
cglong 6y ago
Heads-up that this update, along with recent security updates for High Sierra and Mojave, disable the ability to hide major macOS updates: https://www.macrumors.com/2020/05/28/macos-ignore-software-updates/ https://www.macrumors.com/2020/05/28/macos-ignore-software-u...

82 points by vngzs 6y ago

The Apple product security team just submitted this to the Full Disclosure mailing list[0]. There's a Python arbitrary remote code execution flaw addressed in this update (CVE-2020-9793). The same flaw is present in iOS as well[1][2]. [0]: http://seclists.org/fulldisclosure/2020/May/53 http://seclists.org/fulldisclosure/2020/May/53 [1]: http://seclists.org/fulldisclosure/2020/May/49 http://seclists.org/fulldisclosure/2020/May/49 [2]: https://support.apple.com/en-us/HT211168 https://support.apple.com/en-us/HT211168

JonathonW 6y ago
The Python vulnerability has been removed from the iOS vulnerability list on Apple Support... iOS does not ship Python, so it was likely included by mistake.
- vngzs 6y ago
  Ah, it has! That explains my confusion about why Python is even present on iOS. There's still a good meat of interesting vulnerabilities here, but many of the interesting ones have hidden details for now. I'm looking forward to when the full CVEs come out.
- snazz 6y ago
  Yes. There was also a Zsh vulnerability mistakenly included in the iOS list.
mistrial9 6y ago
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8492 .. leads to https://bugs.python.org/issue39503 https://bugs.python.org/issue39503 which is no-big-deal https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9793 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9793 .. is cloaked.. but personally I am sceptical of "giant ball of fixes" with "urgent/required priority" that actually "do other things the vendor wants besides the advertised fix" and "aggrandizes obscure vulnerabilities as a security treadmill"
saagarjha 6y ago
This is also available through https://lists.apple.com/mailman/listinfo/security-announce https://lists.apple.com/mailman/listinfo/security-announce.

bgorman 6y ago

Is this a normal disclosure? I just purchased a Mac but the list of potential kernel exploits seems much higher than I would expect in a point release.

iphone_elegance 6y ago
yeah, apples software has the same flaws as everybody elses ( especially safari )
barkingcat 6y ago
Apple has as many kernel exploits as any other, software is not perfect. macOS has a long history of many many security patches in point releases, sometimes the release notes run into the tens of pages. The point of view you should take is that the company that doesn't issue security fixes (or issues very few comparatively) is the one you should be worried about: They are not better, they just don't fix anything and leave you vulnerable instead.
- skrtskrt 6y ago
  I haven't used Windows since I needed it for obscure engineering software in college, but I did find that the frequency of security updates combined with Windows reputation made me feel more uneasy rather than positive. I felt less like "Oh good they're being proactive" and more like "Do they introduce 3 vulnerabilities for every one they fix?"
  - tpetry 6y ago
    Bit the bonus is microsoft is patching these vulnerabilites at best every two weeks. For macos you have to wait for the next minor release which may take a lot longer.
    - acdha 6y ago
      Apple has shipped out-of-band security updates quickly — they must have an internal process for weighing severity versus the user fatigue from shipping frequent updates.

snazz 6y ago

I've noticed that Apple has started releasing Darwin sources more often. This is a really huge improvement for security research, since it lets outside researchers see the mitigations and fixes that Apple made to kernel security vulnerabilities quicker. This way, incomplete or otherwise incorrect fixes can be reported to Apple before that kernel version has been in the wild for a long time.

saagarjha 6y ago
As someone who maintains mirrors of Apple's open source releases: eh. They had a week a couple months back where they deleted the download links for every old version of XNU; they've been OK for the last few weeks on opensource.apple.com itself but opensource.apple.com/tarballs has been slow to update for all projects (I even sent them an email about it!) And it's important to note that a lot of the actual security features that the system relies on (such as much of the sandboxing code) is not included in the open source release at all.
- snazz 6y ago
  I've been using https://github.com/clemensg/xnu https://github.com/clemensg/xnu to look through the releases and there's definitely been an uptick recently (although that particular repo was suddenly updated after I made an issue).
  - saagarjha 6y ago
    I keep mine at https://github.com/apple-open-source-mirror https://github.com/apple-open-source-mirror, but I have not updated it as the new dyld-733.8 tarballs aren't linked yet and I like to keep them all in sync :(
- tannhaeuser 6y ago
  Sorry to hijack but would you know a way to run Darwin from sources as an OS for testing Mac builds (backend and command-line apps without GUI)? Clang and/or gcc would be a plus to have. I've looked at the PureDarwin project but that doesn't seem to provide anything I could use. Apple's update treadmill, notarization, SIP, and other tightening makes Mac OS an increasingly annoying and expensive/time-consuming platform to port software to.

rcarmo 6y ago

Still no news about the mail data losses since 10.15.0... Ah well.

allenbrunson 6y ago
i held off upgrading to catalina for as long as possible, due to the mail bug and other issues, like the removal of itunes, which broke all my applescripts. alas, xcode is one of my bread-and-butter apps. recent versions require catalina, so i had to switch. due to the mail data loss bug, i bought a third-party mail client. it's good to support small developers, i guess?
yborg 6y ago
What is this bug? I've been using Mail on Catalina for the last 6 months and haven't noticed any problems.
- rcarmo 6y ago
  I assume I was downvoted out of spite or by someone who's not aware of this: https://mjtsai.com/blog/2019/10/11/mail-data-loss-in-macos-10-15/ https://mjtsai.com/blog/2019/10/11/mail-data-loss-in-macos-1... Michael Tsai has been keeping track of this since October, and regularly comments on this with every Catalina update, like the last one: https://mjtsai.com/blog/2020/05/27/macos-10-15-5/ https://mjtsai.com/blog/2020/05/27/macos-10-15-5/
mmariani 6y ago
Run fsck on your disk. I had the same problem, digging into it I found APFS had hopelessly corrupted my disk, its snapshots, and the time machine backups. In the process I not only lost mail and other files, but I had unexpected app crashes and casual kernel panics. Once I found the corrupted files I had to log in into single user mode to remove them as I couldn’t even as root when logged as usual. Don’t forget to delete your APFS snapshots, if you don’t the problem will quietly sneak in again. After that you’re safe to make a new snapshot and a new backup. Why didn’t Apple just give us ZFS instead of the shitshow APFS is?
apple4ever 6y ago

vinay_ys 6y ago

This seems like a very large release with lots of security fixes. Wonder if Apple is releasing the security fixes quickly enough after it is found and reported or are they batching these fixes into a larger and fewer release and in doing so are they putting users at risk unnecessarily for longer duration.

saagarjha 6y ago
Here's the list for 10.15.4: https://support.apple.com/en-us/HT211100 https://support.apple.com/en-us/HT211100. This one does not seem unusually large.

LordFast 6y ago

Does Catalina have more security issues? Or are we just talking about them more than before?

quantummkv 6y ago
Just more talking. The kind of bugs and their number are not that far off from windows or linux systems.
saagarjha 6y ago
Looks about the same as usual.

daneel_w 6y ago

If you are a Mojave user please exercise caution when installing Security Update 2020-003 for Mojave, which was released together with Catalina 10.15.5. This update annulled my user's password. I couldn't log back in again once the update was installed. I had to use the original administrator account of my macOS setup in order to reset the password. While searching for information on the problem I came upon another Mojave user who experienced the same problem. Twice... https://forums.macrumors.com/threads/login-password-screws-up-after-security-update-2020-002-and-2020-003.2227824/ https://forums.macrumors.com/threads/login-password-screws-u...

jwiley 6y ago

I wonder why patches for individual security updates are pushed out individually instead of following the hard release process? We moved away from that in the web / app space decades ago, it's hard to imagine saying "guys, we need to wait 3 months to fix an SQL injection vulnerability to avoid churn." Also...Mac updates are theoretically 'automatically installed', but somehow I have to notice and update, enter my password, and agree to restart and occasionally terms of service for every update which feels clunky.

cglong 6y ago

Heads-up that this update, along with recent security updates for High Sierra and Mojave, disable the ability to hide major macOS updates: https://www.macrumors.com/2020/05/28/macos-ignore-software-updates/ https://www.macrumors.com/2020/05/28/macos-ignore-software-u...