What Is It?

Apple Computer, Inc. has issued Apple Security Update 2007-004 to address several security vulnerabilities, the most serious of which could allow a remote user to install and run malicious software on your computer, without your permission.

In addition to fixing problems with Apple's own system software, this update includes critical updates for two third party products that are shipped with the operating system. Both products, MIT Kerberos and GNU Tar, are widely used.

• Kerberos is used to establish secure connections with remote computers for sensitive applications, such as banking.
• GNU Tar is the most commonly used file compression program on Unix based operating systems, including Mac OS X.

Other affected components include AirPort, the Help Viewer, the Installer service, the Login window VidoeConference,  the HID keyboard interface, CarbonCore, fetchmail, and various system software that usually runs only on servers. 

What Should You Do?

You should download and install Apple Security Update 2007-004 at your earliest convenience. There are two ways to obtain it.

1. By far, the easiest way is through Apple Update. Step by step instructions are at http://docs.info.apple.com/article.html?artnum=106704.
2. You can also download the update from the Apple Downloads page, at http://www.apple.com/support/downloads/.

If you use the Apple Downloads page, you must know precisely which operating system is installed on your computer. This page is recommended for advanced users.

References

• http://docs.info.apple.com/article.html?artnum=106704, "Mac OS X: Updating your software," gives step by step instructions for using the Apple Update feature to obtain and install security updates.
• http://www.apple.com/support/downloads/ is the Apple Downloads page, which contains links to critical system software updates and other software that you can download and install onto your Apple Macintosh computer. Most of the items listed on this page are intended for advanced users.
• http://docs.info.apple.com/article.html?artnum=305391, "About Security Update 2007-004," summarizes the updates included in this update package.
• http://www.us-cert.gov/cas/techalerts/TA07-109A.html is US-CERT Technical Cyber Security Alert TA07-109A.
• http://www.us-cert.gov/cas/alerts/SA07-109A.html is US-CERT Cyber Security Alert SA07-109A, which is the end user version of the alert listed above.
• http://web.mit.edu/Kerberos/ is the home page of Kerberos: The Network Authentication Protocol.
• http://www.gnu.org/software/tar/ is the home page of the GNU Tar file compression program.

David Gray, MBA, Chief Wizard WizardWrx, formerly P6 Consulting
	V: +1 (817) 812-3041 TZ: USA Central, GMT -5 E: dagray@wizardwrx.com W: www.wizardwrx.com	5006 Cloyce Court North Richland Hills, TX 76180-6944 USA
Tell me what you need, and I’ll conjure it.