“Symantec Corp. this week warned Mac OS X users that the addition of an exploit to the Metasploit hacking framework had boosted the threat posed by an unpatched bug in Samba, the open-source file- and print-sharing software included with the Apple operating system,” Gregg Keizer reports for Computerworld.
“Although the vulnerability was disclosed May 14 and patched that same day by the Samba community, Apple has not updated Mac OS X with a fix, said Symantec’s Alfred Huger, vice president of engineering with the security company’s response group,” Keizer reports.
“Samba, which is also used by most Linux distributions to file- and print-sharing with Windows systems, is turned on in Mac OS X when users activate the Windows Sharing feature,” Keizer reports.
“Symantec recommended that users disable the Windows Sharing service until Apple produces a patch. Technically astute users, however, may be able to handle the more rigorous chore of compiling the latest version of Samba manually in lieu of waiting for Apple,” Keizer reports.
Full article here.
MacDailyNews Note: By default, every service listed in Mac OS X Tiger’s Sharing preferences is disabled. Apple’s recommendation as explained in “Mac OS X Security Configuration For Version 10.4 or Later, Second Edition, February 15, 2007: You should not enable any of these services unless you are required to use them. “Windows Sharing” allows users to access shared files and printers using the SMB/CIFS protocol. You should disable this service. There are several well- known risks associated with SMB/CIFS.