Developer Release of Lion

Apple has released the developer release of Lion. Apple has also reached out to the security community allowing researchers access to this release as well. The big question is how will Apple handle open debate related to the security of their products. It is a good first step and may be the first real indication that Apple is going to get serious about security after taking on board Alex Jones. This is very important if they plan to sell to the biggest buyer of computers, the government.

One other noticeable difference with Lion is services usually installed on server are included in Lion, the question is what will the pricing look like. Not to mention the upgrade path but this is really how Unix should be. We are really excited about full disk encryption XTS AES-128 which is a welcome change to FileVault. Various PGP mis-steps on the Mac platform has been well document when it comes to WDE. For most users an encrypted virtual disk is a viable option for critical files. 

Researchers ByPass Keychain on iOS device

Researchers from Fraunhofer SIT have demonstrated how to bypass the KeyChain on an iOS device. This is a local attack, not remote, but has implications for users who's devices are lost or stolen.

• They Jailbreak the phone with tools already available to gain access to the system.
• Copy the KeyChain access script to the file system.
• Execute the Script which returns the passwords it has been able to find.

Not all passwords are broken but key ones for online account and corporate network access information can be broken in under six minutes.

For a video on how they did it click here.

If you lose your iPhone or plan to retire it keep this in mind.

1. Do a Hard Factory Reset.
2. Clear out all data.
3. Use Mobile Me Find My iPhone in the event that it is lost and erase it fist. (iTunes should have a backup.)

If you are an organization you should have a phone/PDA retirement policy.

Google Chrome Update 9.0.597.94

Google has released an update to Chrome which includes the new version of Flash (10.2)

• [67234] High Stale pointer in animation event handling. Credit to Rik Cabanier.
• [$1000] [68120] High Use-after-free in SVG font faces. Credit to miaubiz.
• [$1000] [69556] High Stale pointer with anonymous block handling. Credit to Martin Barbella.
• [69970] Medium Out-of-bounds read in plug-in handling. Credit to Bill Budge of Google.
• [$1000] [70456] Medium Possible failure to terminate process on out-of-memory condition. Credit to David Warren of CERT/CC.

Make sure to confirm your Flash control panel setting after update. 

Flash Update 10.2.152.26 Released->Installed with Acrobat Update

Adobe has released an update of Flash to address the following vulnerabilities. Adobe Reader and Acrobat users who installed the update and read the Acrobat Reader Release Notes may have noticed that the update installed this updated version of Flash. Make sure to confirm you Flash privacy settings once you install the latest version, disable P2P uplink or always ask.

• This update resolves an integer overflow vulnerability that could lead to code execution (CVE-2011-0558).
• This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-0559).
• This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-0560, CVE-2011-0561).
• This update resolves multiple memory corruption vulnerabilities that could lead to code execution (CVE-2011-0571, CVE-2011-0572, CVE-2011-0573, CVE-2011-0574).
• This update resolves a library-loading vulnerability that could lead to code execution (CVE-2011-0575).
• This update resolves a font-parsing vulnerability that could lead to code execution (CVE-2011-0577).
• This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-0578).
• This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-0607).
• This update resolves a memory corruption vulnerability that could lead to code execution (CVE-2011-0608).
• Adobe recommends users of Adobe Flash Player 10.1.102.64 and earlier versions for Windows, Macintosh, Linux, and Solaris update to Adobe Flash Player 10.2.152.26.

Adobe Updates Acrobat, Reader and Cold Fusion

Adobe has released an update of Acrobat and Acrobat Reader to address critical vulnerabilities and fix various bugs. 

• These updates resolve an input validation vulnerability that could lead to code execution (CVE-2010-4091).
• These updates resolve a library-loading vulnerability that could lead to code execution (CVE-2011-0562).
• These updates resolve a memory corruption vulnerability that could lead to code execution (CVE-2011-0563).
• These updates resolve a Windows-only file permissions issue that could lead to privilege escalation (CVE-2011-0564).
• These updates resolve a denial of service vulnerability; arbitrary code execution has not been demonstrated, but may be possible (CVE-2011-0565).
• These updates resolve an image-parsing memory corruption vulnerability that could lead to code execution (CVE-2011-0566).
• These updates resolve an image-parsing memory corruption vulnerability that could lead to code execution (CVE-2011-0567).
• These updates resolve a denial of service vulnerability; arbitrary code execution has not been demonstrated, but may be possible (Macintosh only) (CVE-2011-0568).
• These updates resolve a library-loading vulnerability that could lead to code execution (CVE-2011-0570).
• These updates resolve a denial of service vulnerability; arbitrary code execution has not been demonstrated, but may be possible (CVE-2011-0585).
• These updates resolve an input validation vulnerability that could lead to code execution (CVE-2011-0586).
• These updates resolve an input validation vulnerability that could lead to a cross-site scripting vulnerability (CVE-2011-0587).
• These updates resolve a library-loading vulnerability that could lead to code execution (CVE-2011-0588).
• These updates resolve a memory corruption vulnerability that could lead to code execution (CVE-2011-0589).
• These updates resolve a 3D file parsing input validation vulnerability that could lead to code execution (CVE-2011-0590).
• These updates resolve a 3D file parsing input validation vulnerability that could lead to code execution (CVE-2011-0591).
• These updates resolve a 3D file parsing input validation vulnerability that could lead to code execution (CVE-2011-0592).
• These updates resolve a 3D file parsing input validation vulnerability that could lead to code execution (CVE-2011-0593).
• These updates resolve a font parsing input validation vulnerability that could lead to code execution (CVE-2011-0594).
• These updates resolve a 3D file parsing input validation vulnerability that could lead to code execution (CVE-2011-0595).
• These updates resolve a image parsing input validation vulnerability that could lead to code execution (CVE-2011-0596).
• These updates resolve an image parsing input validation vulnerability that could lead to code execution (CVE-2011-0598).
• These updates resolve an image parsing input validation vulnerability that could lead to code execution (CVE-2011-0599).
• These updates resolve a 3D file parsing input validation vulnerability that could lead to code execution (CVE-2011-0600).
• These updates resolve an image parsing input validation vulnerability that could lead to code execution (CVE-2011-0602).
• These updates resolve an image-parsing memory corruption vulnerability that could lead to code execution (CVE-2011-0603).
• These updates resolve an input validation vulnerability that could lead to cross-site scripting (CVE-2011-0604).
• These updates resolve a memory corruption vulnerability that could lead to code execution (Macintosh only) (CVE-2011-0605).
• These updates resolve a memory corruption vulnerability that could lead to code execution (CVE-2011-0606).
• 2742895 Crash after copying text from a comment and scrolling to the next page when data already exists on the clipboard.

ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 for Windows, Macintosh and UNIX has also been released. This is a Hot Fix, users should read the tech note in references for more information.