WZZZ

Q: Snow Leopard users: Turn off automatic date and time in System Preferences immediately

http://arstechnica.com/apple/2014/12/apple-automatically-patches-macs-to-fix-sev ere-ntp-security-flaw/

 

When exploited, the NTP flaw can cause buffer overflows that allow remote attackers to execute code on your system.

What this means is that, if you allow date and time to be set automatically by outside servers, you risk having your computer taken over.

 

This is a critical issue, it's being exploited as we speak, and Apple has not provided the update to Snow Leopard users, only to 10.8/Mountain Lion and above. I strongly doubt Apple will ever get around to issuing an update for Snow Leopard, or they would have already. Chances of that happening are close to zero

Posted on Dec 23, 2014 4:37 PM

Close

Q: Snow Leopard users: Turn off automatic date and time in System Preferences immediately

  • All replies
  • Helpful answers

first Previous Page 7 of 12 last Next
  • by xyzzy-xyzzy,

    xyzzy-xyzzy xyzzy-xyzzy Dec 31, 2014 3:39 PM in response to WZZZ
    Level 1 (10 points)
    Dec 31, 2014 3:39 PM in response to WZZZ

    WZZZ wrote:

     

    So, if your primary working system is 10.6, what are you doing there? You think the 4.2.8, as is, has some intrinsic incompatibility with OSX? I'm at a loss now what to do.

     

    10.6.7 actually.  I just need to do some more testing on my test copy of my boot.  Since I keep the boot drive separate from my home dir drive it's easy to switch and test.  I just need to use the stuff for some time before I commit to it.  If you (we) see an occasional crash that probably can be lived with.  If I see another panic crash (like I said I saw that only once and early on in the testing -- for example, still didn't have the updated ntpd-wrapper at that time) well then I probably won't use the new stuff.

     

    As for an "intrinsic incompatibility with OSX" I doubt it.  As I said it may be some rare edge condition due to whatever changes were made to the 4.2.8 release.  If so I would expect others on other OS's to start reporting the issue.  I don't monitor Bugzilla so I not sure when or if that will happen.  If it is Mac specific they I'm guessing it's not specific to Snow Leopard.  But I guess we'll never know about that since all OSX's beyond Snow Leopard have their own Apple updaters.

     

    Could try the one from MacIssues, Topher Kessler's site, or the GitHub one, but if it's intrinsic to the 4.2.8, then none of those is going to be the solution. And wouldn't want to try out the beta and find myself back at square one.

     

    Don't get me started with MacIssues.   They apparently want to keep their head in the sand and ignore anything that detracts from their build instructions, which by the way are the conventional configure/make/make install on almost all FSF/gnu-like builds.  No magic there.   I tried to post over there my findings.  The moderator refused the post (never answered my mail way either) so that's when I posted here when I found this thread.  I even posted a reference on MacIssues to the thread here.  Now it and the majority of posts appear deleted as well.

     

    It's probably too late for this now, since a lot of people have lost the original 4.2.4 after trying out the 4.2.8, in one flavor or another, and way, way above my pay grade, but wondering if someone with the skills could port Apple's patch to the original 10.6  4.2.4, with the necessary modifications, whatever they might be.

     

    Yeah, and that's the problem.  If Apple did their own specific patches we would need to find the Apple tarball for 4.2.6 and their patches to whatever source files they patched.  That or a tarball of the patched sources if Apple posted them some where.

     

    As for being able to revert, never update the OS without a backup to fall back on.  In addition I have already copied the original sources involved with the ntp installation so I could always revert that way.

     

    This was a mild crash/abort. But a KP is far more serious and, if the 4.2.8 was clearly responsible, that points to system instability. Then again, some KPs can happen just once and never again.

     

    Never saw any of these kind of system crashes in all the time using 10.6.7 (previously 10.6.5).  And, yes, as I implied above, this is a "mild" crash :-)

     

    ############# HAPPY NEW YEAR TO EVERYONE #############

  • by WZZZ,

    WZZZ WZZZ Dec 31, 2014 4:55 PM in response to xyzzy-xyzzy
    Level 6 (13,112 points)
    Mac OS X
    Dec 31, 2014 4:55 PM in response to xyzzy-xyzzy

    I think I have one "virgin" 10.6.8 clone left (out of 4). After all this, I think I'll wait a bit before I decide to do anything with that one. Nsnail.gif

  • by pcbjr,

    pcbjr pcbjr Dec 31, 2014 6:54 PM in response to WZZZ
    Level 2 (282 points)
    Mac OS X
    Dec 31, 2014 6:54 PM in response to WZZZ

    Over a couple days ago I installed https://drive.google.com/folderview?id=0BxQCbeIgpA2uVjFiN1h4bGZNQ2c&usp=sharing on three 10.6.8 Macs (2 iMacs and a MBP). Now I read the latest posts. Do I have something to worry about? Do I need to clone back and just turn off date/time and live with it? Or are we safe with the installer?

  • by Rachel Reiss,

    Rachel Reiss Rachel Reiss Dec 31, 2014 6:56 PM in response to pcbjr
    Level 1 (5 points)
    Dec 31, 2014 6:56 PM in response to pcbjr

    I installed flatsixracer's last two packages and two days ago and yesterday and my machine is working fine.

  • by shiekh,

    shiekh shiekh Jan 1, 2015 2:56 AM in response to flatsixracer
    Level 1 (0 points)
    Jan 1, 2015 2:56 AM in response to flatsixracer

    Could you limit this installer so it won't install on a PPC Mac?

     

    I built an installer for 10.5 PPC

     

    http://www.cubeowner.com/forums/index.php?s=&showtopic=14866&view=findpost&p=104 496

  • by WZZZ,

    WZZZ WZZZ Jan 1, 2015 10:23 AM in response to shiekh
    Level 6 (13,112 points)
    Mac OS X
    Jan 1, 2015 10:23 AM in response to shiekh

    shiekh wrote:

     

    Could you limit this installer so it won't install on a PPC Mac?

     

    I built an installer for 10.5 PPC

     

    http://www.cubeowner.com/forums/index.php?s=&showtopic=14866&view=findpost&p=104 496

    Why should flatsixracer do that? Don't know if his is suitable for 10.5/PPC or not, but if it is, why should he arbitrarily limit the way it can be used. Just because you built one? Doesn't make any sense. Have I misunderstood what you meant to say?

  • by shiekh,

    shiekh shiekh Jan 1, 2015 10:59 AM in response to WZZZ
    Level 1 (0 points)
    Jan 1, 2015 10:59 AM in response to WZZZ

    My bad, I did not explain myself well.

     

    His are Intel binaries and should not be installed on a PPC;

    that is the reason I went ahead and did the same for the PPC,

    or I would have just used his installer. Actually I tried, and

    that is how I found out they were not universal binaries.

     

    I realize now how my wording could cause confusion; my

    apologies.

  • by shiekh,

    shiekh shiekh Jan 1, 2015 11:57 AM in response to shiekh
    Level 1 (0 points)
    Jan 1, 2015 11:57 AM in response to shiekh

    One problem with my installer is that it installs PPC binaries and not universal binaries, so there would be a problem if one booted an Intel Mac from the PPC patched OS 10.5


    The ideal installer would carry universal binaries

  • by ApMaX,

    ApMaX ApMaX Jan 2, 2015 9:02 AM in response to WZZZ
    Level 1 (17 points)
    Mac OS X
    Jan 2, 2015 9:02 AM in response to WZZZ

    Here is a different patch application:

     

    NTPUpdateSnowLeopard

    https://github.com/MacMiniVault/NTPUpdateSnowLeopard/releases

  • by WZZZ,

    WZZZ WZZZ Jan 2, 2015 9:05 AM in response to ApMaX
    Level 6 (13,112 points)
    Mac OS X
    Jan 2, 2015 9:05 AM in response to ApMaX

    Someone else mentioned this earlier. I have been searching, in vain, for any feedback or reviews. Have you used it?

  • by xyzzy-xyzzy,

    xyzzy-xyzzy xyzzy-xyzzy Jan 2, 2015 12:26 PM in response to WZZZ
    Level 1 (10 points)
    Jan 2, 2015 12:26 PM in response to WZZZ

    WZZZ wrote:

     

    Someone else mentioned this earlier. I have been searching, in vain, for any feedback or reviews. Have you used it?

     

    I woulld stay away from them.  Go with what you know works here.  Like flatsixracer's installer it does install 4.2.8 (presumably with its requisite patch file for ntp_io.c) but it doesn't install ntpd-wrapper to correct the bad sntp -v call nor does it install the ntp-restrict.conf (which I suppose you could view as "optional" since that only addresses some pesky system.log messages). 

     

    As best as I can tell this thread is the only place that took the sntp error seriously.  I don't see it discussed anywhere else.

     

    By the way, not sure how important it is since I don't know if anyone would care, but that installer and flatsixracer's installer do not install the (updated?) man pages and doc's that would normally be installed with a 4.2.8 build.  In my own builds I do let them them get installed.

  • by ApMaX,

    ApMaX ApMaX Jan 2, 2015 2:32 PM in response to WZZZ
    Level 1 (17 points)
    Mac OS X
    Jan 2, 2015 2:32 PM in response to WZZZ

    I have not tested any method yet, but here is an interesting article:

     

    How to manually patch NTP for OS X 10.6 and 10.7

    http://www.macissues.com/2014/12/24/how-to-manually-patch-ntp-for-os-x-10-6-and- 10-7

  • by WZZZ,

    WZZZ WZZZ Jan 2, 2015 4:10 PM in response to xyzzy-xyzzy
    Level 6 (13,112 points)
    Mac OS X
    Jan 2, 2015 4:10 PM in response to xyzzy-xyzzy

    Re. the "edge case" crash scenario we have been discussing, someone elsewhere wrote :

     

    Keep in mind that gcc normally produces executables that are optimized for the system it's being compiled on. As a result the edge cases could be a particular CPU that doesn't implement a particular instruction that flatsixracer's CPU does implement.

    Wonder what you think of that? And by the way, I used the instructions at MI to do the 4.2.8 update (compiling from Xcode 3.2) on one of my clones. Don't see the sntp -v error and I am seeing there what appears to be the ntp-restrict.conf as well. The explanation might be that, perhaps, it didn't fully overwrite flatsixracers' rev 4, which I had first installed, but no idea why that would have happened, nor does it seem likely, since I took it all the way.

     

    Jan  1 10:49:09 **** ntpd[240]: ntpd 4.2.8@1.3265-o Thu Jan  1 15:43:00 UTC 2015 (2): Starting
    Jan  1 10:49:09 **** org.ntp.ntpd[240]:  1 Jan 10:49:09 ntpd[240]: ntpd 4.2.8@1.3265-o Thu Jan  1 15:43:00 UTC 2015 (2): Starting
    Jan  1 10:49:09 **** org.ntp.ntpd[240]:  1 Jan 10:49:09 ntpd[240]: Command line: /usr/sbin/ntpd -c /private/etc/ntp-restrict.conf -n -g -p /var/run/ntpd.pid -f /var/db/ntp.drift
    Jan  1 10:49:09 **** org.ntp.ntpd[240]:  1 Jan 10:49:09 ntpd[240]: proto: precision = 1.000 usec (-20)
    Jan  1 10:49:09 **** org.ntp.ntpd[240]:  1 Jan 10:49:09 ntpd[240]: Listen and drop on 0 v6wildcard [::]:123
    Jan  1 10:49:09 **** org.ntp.ntpd[240]:  1 Jan 10:49:09 ntpd[240]: Listen and drop on 1 v4wildcard 0.0.0.0:123
    Jan  1 10:49:09 **** org.ntp.ntpd[240]:  1 Jan 10:49:09 ntpd[240]: Listen normally on 2 lo0 [::1]:123
    Jan  1 10:49:09 **** org.ntp.ntpd[240]:  1 Jan 10:49:09 ntpd[240]: Listen normally on 3 lo0 [fe80::1%1]:123
    Jan  1 10:49:09 **** org.ntp.ntpd[240]:  1 Jan 10:49:09 ntpd[240]: setsockopt IPV6_MULTICAST_IF 0 for fe80::1%1 fails: Can't assign requested address
    Jan  1 10:49:09 **** org.ntp.ntpd[240]:  1 Jan 10:49:09 ntpd[240]: Listen normally on 4 lo0 127.0.0.1:123
    Jan  1 10:49:09 **** ntpd[240]: setsockopt IPV6_MULTICAST_IF 0 for fe80::1%1 fails: Can't assign requested address
    Jan  1 10:49:09 **** org.ntp.ntpd[240]:  1 Jan 10:49:09 ntpd[240]: Listen normally on 5 en1 192.168.1.47:123
    Jan  1 10:49:09 **** org.ntp.ntpd[240]:  1 Jan 10:49:09 ntpd[240]: Listening on routing socket on fd #26 for interface updates

  • by WZZZ,

    WZZZ WZZZ Jan 2, 2015 4:37 PM in response to xyzzy-xyzzy
    Level 6 (13,112 points)
    Mac OS X
    Jan 2, 2015 4:37 PM in response to xyzzy-xyzzy

    No more time to edit: In case you are curious about the (2) in ntpd 4.2.8@1.3265-o Thu Jan  1 15:43:00 UTC 2015 (2), thinking that it might not have overwritten the rev4 installer from flatsix on the first run through, I reran the entire procedure a second time.


    Is it possible that it left might have remnants from flatsixracer's installer?

  • by xyzzy-xyzzy,

    xyzzy-xyzzy xyzzy-xyzzy Jan 2, 2015 4:49 PM in response to WZZZ
    Level 1 (10 points)
    Jan 2, 2015 4:49 PM in response to WZZZ

    WZZZ wrote:

     

    Re. the "edge case" crash scenario we have been discussing, someone elsewhere wrote :

     

    Keep in mind that gcc normally produces executables that are optimized for the system it's being compiled on. As a result the edge cases could be a particular CPU that doesn't implement a particular instruction that flatsixracer's CPU does implement.

    Wonder what you think of that?

     

    Except that like you, I build my own ntp files on my own system (I have Xcode 3.2.6) so that argument doesn't apply for me either.  Of course that doesn't mean that the gcc compiler itself doesn't have a code generation bug (it does compile the code with -O2 optimization level enabled) but I really really don't believe that :-)

     

    Also, by the way, the crash report you showed earlier, which I said was the same as mine, was not an ILLEGAL INSTRUCTION report.  It appears to be for a pointer attempting to use a chunk of freed memory.  That's what lead me to believe it was a rare edge condition.  Some condition drove it down a path where it freed a pointer but some other place thought the pointer was still valid, or maybe it attempted to free the same pointer twice.  That makes it a coding bug in my book!  And unless the code authors know their code really well (you would hope), and/or this happens more often to others, and the edge condition can be fully understood, errors of this kind can be a b*tch for fix.

     

    And by the way, I used the instructions at MI to do the 4.2.8 update (compiling from Xcode 3.2) on one of my clones. Don't see the sntp -v error and I am seeing there what appears to be the ntp-restrict.conf as well. The explanation might be that, perhaps, it didn't fully overwrite flatsixracers' rev 4, which I had first installed, but no idea why that would have happened, nor does it seem likely, since I took it all the way.

     

    I believe I asked you about that earlier in this thread (i.e., where was the -v error report in your system.log?).  It would be (have been) easy to check, i.e., just look at the sntp command line in the /usr/libexit/ntpd-wrapper file.  You must have the updated one with the sntp -K ... fix.

first Previous Page 7 of 12 last Next