Security experts knock Apple for not patching DNS bug
Apple Inc. has not yet patched a critical Domain Name System (DNS) bug in its Mac OS X operating system, analysts and security researchers noted today as some criticized the company for dragging its feet.
"It's not sending a real good message," said Rich Mogull, an independent security consultant and former Gartner Inc. analyst. "If they don't patch this in a reasonable time, they're putting their customers at risk."
Apple, which integrates considerable open-source code into its operating systems, relies on BIND (Berkeley Internet Name Domain), created by the Internet Systems Consortium (ISC), for its DNS components. ISC patched BIND July 8, but as of today, Apple had not released an update for Mac OS X.
According to Dan Kaminsky, the researcher who uncovered the DNS flaw in February and helped coordinate a multivendor patch effort, Apple was told of the vulnerability before patches went public. "They were notified at some point," said Kaminsky, who did not name a date. "They were given a heads-up."
Approximately a month after Kaminsky discovered the vulnerability, representatives from several major developers, including Cisco Systems Inc., Internet Systems Consortium (ISC) and Microsoft Corp., met at the latter's Redmond, Wash., headquarters to discuss how to handle the bug. "In the Spring it was all about [vendors] who write DNS code, at its core it was about people who write name servers," said Kaminsky. Companies he called "second tier," those that "ship name server code that others write," were not part of that March meeting at Microsoft. Apple, he added, was one of those second tier vendors.
Calls to patch grew louder last week, however, after other researchers guessed some of the bug's technical details. Two days later, attack code went public.
Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world
On Twitter now
DNS flaw
Powered by Twitter
Esther Schindler
If the comments are ugly, the code is ugly
claird
SVG a graphics format for 21st century
pasmith
Take Chrome OS for a test spin
Sandra Henry-Stocker
Solaris Tip: Have Your Files Changed Since Installation?
jfruh
Android fragments vs. the iPhone monolith
mikelgan
What Gizmodo missed about the Pro WX Wireless USB disk drive
Where Google Chrome security fails: the password
I heard mention that the Chrome OS will have some sort of encryption available a la bitlocker. If it's possible to encrypt personal data using another password or key, then it may have potential for very secure data.... And Ubuntu has an 'encrypt home directory' option, perhaps google should follow suit.
- Dann
Join the conversation here
Quick, practical advice for IT pros. Made fresh daily.
Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.














> Storms saw the bright side
> Storms saw the bright side of Apple not patching the DSN bug,DNS, not DSN.
Proof-read, people.
Thanks for the head's up.
Thanks for the head's up.