APPLE-SA-2010-10-20-2 Java for Mac OS X 10.5 Update 8

Apple has released an updates to Java for Mac OSX Server and Client to address server vulnerabilities which are dated. This includes a fix to prevent an unsigned applet from execution outside the sand-box, proper handling of MACH RPC messaging and improvement to handling window bonds. Users should apply this update via Software Update. For More information please see reference link.

Google Updates Chrome to 7.0.517.41

Google has released an update of Chrome to the stable channel to address various stability and security issues. This includes fixes to crashes with forms, crash using auto fill, URL spoofing on page unload, element persistence in the element map and sandbox process failures (Not Confirmed on Mac OSX but affect Linux distributions). 

Users should apply the update by opening about Chrome and clicking on the check for updates link. For more information about improvements visit the reference links below. 

Adobe Reader and Acrobat

Adobe has released a security update for Acrobat and Acrobat Reader to address CVE-2010-2883 and CVE-2010-2884. This update was released ahead of schedule, users should apply this update promptly, it is marked as critical.

As a note we recommend using Preview.app for PDF files, within seatbelt for hard core users. 

Safari Auto Fill Flaw Can Still be Conducted Using Two Phase Process

Jeremiah Grossman's Auto Fill Flaw can still be exploited by socially engineering a user to perform staged clicks on a form or page. In his online example the users location is used to provoke the first key. Other examples can be simple trickery such as type "DuD" to prove your a human. He has posted the technical details on his blog, the result is that the users Auto Fill information is passed without the knowledge of the user.

Auto fill altthough viewed as a convenicnce to users can result in sharing information the user did not plan to disclose. In Safari you should make sure to turn these settings off including on iOS devices. 

Recommended Settings

When thinking about privacy and the sharing of any personal information educate users in the concepts of trust and verification. If the form is completed automatically the user skips triggering mechanisms that can prevent these kinds of information gathering attacks. 

APPLE-SA-2010-09-20-1 Security Update 2010-006

Apple has released an update for OSX Server 10.6.4 to address an password bypass vulnerability in AFP Server. A malicious users may be able to bypass authentication if they are aware of a users of the system. Administrators should apply this software update to OSX Server,  a restart is required.