Can't remember hearing about MAC needing "security updates", but it appears as they are becoming more popular they are starting to enjoy some of the attention of hackers previously reserved for Microsoft Operating Systems.

Original release date: May 29, 2008

Source: US-CERT

Systems Affected

* Mac OS X prior to v10.5.3

* Mac OS X Server prior to v10.4.11

Overview

Apple has released Security Update 2008-003 and OS X version 10.5.3 to correct multiple vulnerabilities affecting Apple Mac OS X and Mac OS X Server. Attackers could exploit these vulnerabilities to execute arbitrary code, gain access to sensitive information, or cause a denial of service.

I. Description

Apple Security Update 2008-003 and Apple Mac OS X version 10.5.3 address a number of vulnerabilities affecting Apple Mac OS X and OS X Server versions prior to and including 10.4.11 and 10.5.2. Further details are available in the US-CERT Vulnerability Notes Database. The update also addresses vulnerabilities in other vendors' products that ship with Apple OS X or OS X Server.

II. Impact

A remote, unauthenticated attacker may be able to execute arbitrary code.

III. Solution

Upgrade

Install Apple Security Update 2008-003 or Apple Mac OS X version 10.5.3. These and other updates are available via Software Update or via Apple Downloads.

Well not really, but I did have an interesting experience at Ralph's the other day. With the cost of gas raising almost daily, and me anticipating my new car, we decided to logon to Ralph's web site to check out their 'specials'. I never was one to clip coupons or look through the papers, but somehow finding that Ralph's post this on-line with an easy interface to click to add the sale items to a printable shopping list, it was now not only convenient, but a time saver. Menus could then be easily planned around the sale items--another time saver.

So off to the store we went, list in-hand. We loaded an entire cart with all of the items we needed--everything from apples to steaks and everything in between. When we got to the check-out counter I watch the total climb as the clerk passed each item through the scanner--$100--$200--$230--the total finally topping out at $247.92. Then I handed the clerk my Ralph's Club Card (senior edition). She scanned the card and I gleefully watched the total on the register start rolling backwards--dollar by dollar--until the final total was $147.62! To quote from the bottom of my register receipt a "verified total savings of $100.30". I've used the card for years, and it has always saved $10.00 here $30.00 there and one time I think I saved about $40.00, but never a savings that really seemed to matter. But saving over $100.00 was an eye-opener.

I found a method of checking the sale items that was both convenient and time-saving and could save us over $100.00 per week at the supermarket!

Check it out, I think you'll like it: http://www.ralphs.com

(I'm sure that other markets have the same features on their web sites, Ralph's has just been convenient to my location and I've gotten into the habit of using them out of convenience.)

WHO IS IMPACTED AND WHY?

For customers who host their sites on a Debian OS (or its derivatives) to generate a key pair used to request a certificate, that key pair (and the corresponding certificate) is vulnerable.

This is due to a flaw in the Debian-specific random number generation that results in relatively predictable key pair values, making them highly exploitable.

WHAT CAN YOU DO?

If you or your customers are running Debian operating systems and derivatives (such as Ubuntu) released between September 17, 2006 and May 12, 2008 you should deploy a recently released Debian patch and revoke and replace all SSL and Code Signing certificates for which keys were created on these operating systems. Debian has released a testing tool to confirm whether your certificates are affected. This tool and other useful information can be found here:

http://lists.debian.org/debian-security-announce/2008/msg00152.html

NOTE: Inland Pacific Consulting does not host any accounts on Debian Operating Systems. We host strictly on the new Microsoft Windows 2008 64 bit operating system. Consequently none of our clients are effected by the above security flaw.

I stumbled on this article "30 Free Ways to Market Your Site" by Carrie Hill from her column "Little Biz" on Search Engine Watch that had some excellent ideas for marketing a small business web-site that I thought were especially relevant with the economy slowing and budgets tightening and wanted to share some of them with you.

Not only are her suggestions relevant to building the link popularity of your site, but they help in getting you familiar with, and involved in, the on-line community. Most small businesses are members of their local Chamber of Commerce or other networking groups, but many small business owners are not familiar with the same networking communities and opportunities that exist on-line. Following these tips is a perfect introduction to the on-line community and a good guide to how to become involved.

You will find that the knowledge gained while investigating and following many of these steps will be as big an asset to your company growth as the potential business you may generate.

Here are some of my favorites (some new, others nice reminders of things forgotten):

1. Write a press release on a new product or offering and send it to some free press release distribution sites. [ed. on-line]

2. Send the press release to your local media outlets, or any niche media outlets that may be interested in what you do. [ed. print]

13. Start a blog.

17. Submit a product (or 20) to GoogleBase. [ed. This is a new beta service of Google http://base.google.com/support/bin/answer.py?hl=en&answer=59260]

22. Install Web analytics on your site, if you don't already have them. [ed. If you don't use these on a site we host--ask us to install them for you.]

You can view her entire article here (http://searchenginewatch.com/showPage.html?page=3628785)

For those of you thinking of starting a blog, just setting up could seem a bit daunting. New terminology--ping-backs, track-backs, technorati, digg-it, etc. can seem overwhelming too. And then there's writing your articles, posting your articles and managing articles in-progress.

I've found there is nothing really easy about researching the technology, but there are a ton of web-sites and blogs dedicated to understanding these things and the understanding comes with time. At first, I just started posting directly on my blog, which worked and meant I didn't have to learn much new. But as I started writing more articles this didn't prove to be the easiest way of doing things.

Then I discovered that there are tools for writing blog articles off-line on your computer and then publishes them automatically when they have been completed. There are many of these tools, but the one I found that I like the best is Windows Live Writer and can be found here: http://windowslivewriter.spaces.live.com/. It does everything that you will need to do when writing and publishing articles--add categories, keywords, control comments, add you slug (oops, there's another one of those terms again), add your article excerpt or summary, set publishing dates in advance, manage tags, etc.  There are even 5 short (3 minutes or so) videos that walk you through everything from getting started to publishing your first post at the above link. Windows Live Writer even has the capability to manage several blogs at the same time, should you really get into it and have more than one! This is actually convenient for me, as I manage the blogs of several of our clients.

Once you make the decision to start a blog, it becomes addictive. The hardest part is just making up your mind to do it and getting started. So don't put it off any longer, start your blog today!

If you need help getting started, don't hesitate to give me a call.