Apple finally fixes its DNS hole

The lat­est patch for Mac OS X finally closes a major hole in the oper­at­ing system’s DNS (domain name sys­tem) soft­ware. Apple’s descrip­tion is in this knowl­edge base arti­cle (About the secu­rity con­tent of Mac OS X v10.5.5 and Secu­rity Update 2008-006 ).

Of course, Apple is late to the party. By early July 2008, Microsoft had a Win­dows patch ready for dis­tri­b­u­tion, and the major *NIX sys­tems had their own patches ready. This Cnet arti­cle called Mas­sive, coor­di­nated DNS patch released has more infor­ma­tion about this project, which pre­ceded the pub­lic announce­ments about the flaw.

It’s sad that Dan Kaminsky’s warn­ings, detailed in a 24 July 2008 Cnet arti­cle called Kamin­sky (finally) pro­vides DNS flaw details, did not inspire an urgent response form Cuper­tino. Apple’s July 2008 patch addressed DNS server issues, but left most Mac users with­out a fix.

There are still other ways to redi­rect a com­puter to a bad domain name, of course. Another piece of pre­ven­tion involves using OpenDNS instead of your ISP’s domain name servers. OpenDNS is free, fast, and pro­vides spellcheck­ing and phish­ing pro­tec­tion that is bet­ter than most PC and Mac secu­rity software.

See these arti­cles from the New York Times (Apple Update Finally Fixes Impor­tant DNS Bug ) and Com­put­er­World (Apple releases Mac OS X 10.5.5, patches nearly 70 bugs) for more details.

Related posts and pages on billso.com

• OpenDNS
• Hawai­ian Telcom
• 7 April 2011: Linux is 20
• 25 July 2008: Fix­ing the DNS secu­rity hole
• 24 Feb­ru­ary 2008: Pak­istan blocks YouTube, breaks trust
• 15 Jan­u­ary 2008: OpenDNS update
• 3 Sep­tem­ber 2007: When users block the ads, should web sites block the users?
• 13 July 2007: Speed up your broad­band con­nec­tion with OpenDNS

Tagged as: Apple, DNS, HPU, Linux, mac, malware, Microsoft, network, opendns, security, university, unix, WiFi, Windows