System Administration
Tools for the toolbox
Tuesday, July 09, 2002Ask and Ye Shall Receive
An interesting little tidbit came across the transom, courtesy of BUGTRAQ. What's interesting is the description of how Apple's Software Update works.Software Update is a simple HTTP application, with a few flaws. A client requests a list of software from Apple. After receiving the list, the client sends a list of its installed software. The server sends a list of available files and their locations. The client requests those files.
Aside for the extraneous network activity in the second request from the client, the problem is that there is no means for verifying that the files are indeed from Apple. This leaves you open to a classic man-in-the-middle attack.
11:47:58 AM # Google It!
categories: Security, System Administration
