Apple TV 2.3.1 Update Released, Apparently Disables Boxee Installations

Posted by:
Date: Wednesday, February 25th, 2009, 09:28
Category: Apple TV

appletvlogo.jpg
Overnight, Apple released a minor software update for owners of its set-top media box, though it’s currently unknown whether the patch offers any new features. According to AppleInsider, Apple has yet to update its Apple TV software updates page, which documents revision changes as they come about.
Per reports that have come in, the 2.3.1 update appears to wreak havoc on installations of the Boxee cross-platform media center software, which adds unauthorized support for a wide range of multimedia formats, online video channels, and social networking features.
An update to Apple TV that arrived this past November also disabled Boxee installations but did so while delivering a number of widely received features at the same time, such as AirTunes streaming from Apple TV, third-party remote control compatibility, playlists, and music volume control.
Stay tuned for additional details as they become available and if you’ve downloaded the update and noticed any major changes, let us know in the comments or forums.

(more…)

Review: Roxio Toast 10 Titanium and Toast 10 Titanium Pro

Posted by:
Date: Tuesday, February 24th, 2009, 15:59
Category: Review

By Robert Kaneko
Roxio has once again updated their flagship authoring software package. The latest update, Toast 10 Titanium, continues the natural evolution of a mature product. It gives the user some hints about where Roxio might go with the product as we begin to approach the end of the general use optical storage era. It also presents users with a choice. Roxio has, for the first time, split the product into two versions. There is Toast 10 Titanium, which is the standard version of Toast that users have come to know and love. There is also Toast 10 Titanium Pro, a new variant that basically includes four extra third party authoring solutions in with the basic Toast package.
toastx1.jpg
Let me admit up front that I am a long time fan of Toast. It sits on my short list of “must have” applications. As I noted in my Toast 9 Titanium review last year, I find it an invaluable resource for authoring and archiving beyond the basics provided by Apple’s iDVD, iTunes and Finder disc burning features. In addition, Roxio seems to anticipate that one new feature that I didn’t even know I needed that makes me want to open my wallet one more time.
Toast 10 Titanium has joined the growing list of applications that now requires Mac OS X 10.5 or later. The funny thing is, I didn’t know that when I started this review. Sitting comfortably in my world of ignorance, I installed Toast on my trusty PowerBook G4 running OS X 10.4.11. It worked beautifully! I used most of the new features, including the ability to download and convert flash video from sites like YouTube, and they worked perfectly. I might have run into problems with AVCHD support or Blu-ray, but since I don’t have hardware that supports those features I remained blissfully unaware. Toast and SonicFire Pro 5 (part of the Toast 10 Titanium Pro package) both worked flawlessly. It wasn’t until I tried using the new Mac2TiVo feature that I realized there was a problem. That’s when I actually read the system requirements and moved the installation to a Leopard machine.
If you are familiar with any of the recent versions of Toast, especially Toast 9, Toast 10 is nearly identical. Roxio has once again polished the interface, dropping the styling of Toast 9 in favor of a more Leopard-friendly look, but the general structure of the program remains largely unchanged.
toastx2.jpg
toastx3.jpg
Click the jump for the full review…

(more…)

EMC Releases Retrospect 8 Beta 4

Posted by:
Date: Friday, February 20th, 2009, 07:47
Category: Software

retrospect8box.jpg
EMC Corporation on Friday released the fourth public beta of Restrospect 8.0 its long-standing backup and recovery software for the Mac. The new beta consists of the following new features and changes:

  • Stability has been greatly improved, and this build should feel much better.
  • Proactive Backup (old Backup Server) monitoring is now functional, and the Pause/Run/Resume buttons now work as expected.
  • Email notification is working as designed now.
  • Repair and Rebuild Catalog functionality has been added.
  • It is now possible to set a password for the Retrospect engine by going to Preferences>General and clicking the Change Server Password button. Once you set/change the password, you will need to remove the Retrospect engine from the sidebar and re-add it using the new password.
  • Partial archiving of Time Machine data has been added. Retrospect 8.0 cannot restore a functioning Time Machine volume, but it can restore files backed up from a Time Machine volume to any non-Time Machine volume.
  • Backup and restore activities can now be previewed when using the Backup and Restore Assistants.
  • The restore files and folders workflow now has an option to restore to a new folder. When choosing this option, Retrospect may incorrectly warn you on the summary page that all other files will be deleted from the destination. This is not the case.
  • Media request notifications have been improved.
  • Several bugs related to rules (selectors) have been fixed; a handful may still remain.
  • The Retrospect 8.0 beta is currently available as a 29.7 megabyte download and requires Mac OS X 10.4 or later to install and run.
    Retrospect 8.0 is expected to ship in the first quarter in three versions: Desktop 3-User (US$129 new or US$59 as an upgrade), Single Server (US$809 or US$539), and Multi Server (US$1,669 or US$939). Users who purchased a new Retrospect 6.1 license on or after January 14, 2008 will receive a free upgrade.
    Let us know what you think in the comments or forums.

    (more…)

    Adium X Updated to 1.3.3

    Posted by:
    Date: Friday, February 20th, 2009, 07:07
    Category: Software

    adiumducky.gif
    Adium, the open source instant message chat client with support for multiple programs (including AOL Instant Messenger, ICQ, Jabber, MSN, Yahoo! Google Talk, Bonjour, etc.) has been updated to version 1.3.3.
    The new version, a 23.4 megabyte download, sports the following major fixes and changes listed here.
    Adium X is available for free and requires Mac OS X 10.4 or later to run. The program functions as a Universal Binary and runs at native speeds on both PowerPC and Intel-based hardware.
    If you’ve tried the new build and have any feedback, positive or negative, let us know in the comments or forums.

    (more…)

    Cocktail 4.3.1 Leopard Edition Released

    Posted by:
    Date: Friday, February 20th, 2009, 07:43
    Category: Software

    cocktaillogo.jpg
    On Friday, shareware developer Maintain released version 4.3.1 of Cocktail (Leopard Edition), Cocktail, the popular shareware utility program that allows for additional Mac OS X system tests.
    The new version, a 1.8 megabyte download, adds the following fixes and changes:

  • Addresses an issue in which Cocktail may stop responding during a scheduled clearing of system caches.
  • Added clearing of the trojan Lamzev.A and the worm Inqtana.A.
  • Minor improvements on the clear potentially harmful files procedure.
  • Cocktail 4.3 retails for a US$14.95 shareware registration fee and requires Mac OS X 10.5 or later to run.
    If you’ve tried the new version and have any kind of feedback about it, let us know in the comments or forums.

    (more…)

    Apple Releases SMC Firmware Update 1.3 for 13″ MacBook

    Posted by:
    Date: Wednesday, February 18th, 2009, 08:29
    Category: MacBook

    macbooks.jpg
    Late Tuesday, Apple released its SMC Firmware Update 1.3 for the company’s 13″ polycarbonate (black and white non-unibody) MacBook notebooks released in early 2009. The update, a 557 kilobyte download, works to clear a performance issue wherein the notebook may slow down when booted while using battery power only. This SMC Update improves startup time when starting up from the battery.
    The update requires Mac OS X 10.5 or later to install and run.
    If you’ve tried the update and noticed any changes, please let us know in the comments or forums.

    (more…)

    Unibody 17″ MacBook Pro Notebooks Now Shipping

    Posted by:
    Date: Monday, February 16th, 2009, 09:01
    Category: News

    el17.jpg
    A slew of readers have informed AppleInsider that their order updates for Apple’s unibody 17″ MacBook Pro notebook have been updated to “shipping” as of Friday.
    The notebook, which was launched in January at Macworld, showed signs of delay when some customers were told their orders would likely slip into March despite promises it would ship in late January. Early this month, the company let many of these buyers know that their orders wouldn’t ship for about two weeks due to problems “wrapping up” production.
    The reason for the delay is currently unknown.
    If you’ve heard naything from your end or received an order update, let us know in the comments or forums.

    (more…)

    Customizable Four-Finger Gestures May be En Route for Apple Notebooks in Mac OS X

    Posted by:
    Date: Monday, February 16th, 2009, 08:12
    Category: News

    el17.jpg
    There’s some interesting stuff buried within the depths of the Mac OS X file structure. Among these, according to MyAppleGuide, is a bit of code in Mac OS X’s Trackpad preference panethat would allow users of multitouch-capable trackpads such as those on the new MacBooks and MacBook Pros to define their own four-finger gestures.
    The file is currently a .nib, meaning it’s currently just installed as part of the interface and no actual code is hooked up to it, but if you have a multitouch-capable Mac (such as a unibody MacBook, MacBook Pro or MacBook Air), you can find the same file at /System/Library/PreferencePanes/Trackpad.prefPane/Contents/Resources/ English.lproj/FourFingerSwipeGesture.nib.
    Currently, the multitouch trackpad’s four-finger gestures are hard-coded and perform a given set of functions such as activating the desktop, triggering Expose, and bringing up the Application Switcher.
    Customization of gestures could be en route in a future Mac OS X update, a feature many users might appreciate.
    Stay tuned for additional details as they become available and let us know what you think in the comments or forums.

    (more…)

    CoolBook Updated to 2.13, Receives Unibody MacBook Support

    Posted by:
    Date: Monday, February 16th, 2009, 08:30
    Category: Software

    coolbook.jpg
    Over the weekend, developer Magnus Lundholm released CoolBook 2.13, the latest version of his shareware CPU frequency, voltage and temperature monitoring program.
    The new version, a 600 kilobyte download, adds support for Apple’s new unibody MacBooks as well as repairs the following bugs and features:

  • Fixed a bug adding invalid values to the frequency selector.
  • Fixed an issue with the throttling level selector.
  • Additional fixes to support the new unibody models.
  • CoolBook 2.13 retails for a US$10 shareware registration fee and requires Mac OS X 10.4 or later and an Intel-based Mac to run.
    If you’ve tried the program and have either positive or negative feedback about it, let us know over in the forums.

    (more…)

    Apple Releases Security Update 2009-001

    Posted by:
    Date: Friday, February 13th, 2009, 09:56
    Category: Software

    applesecurity.jpg
    Making Friday a somewhat official update-o-rama, Apple released Security Update 2009-001, its first collection of security fixes for the new year.
    The 43.4 megabyte download contains the following fixes and features:

  • AFP Server:
    Impact: A user with the ability to connect to AFP Server may be a able to trigger a denial of service
    Description: A race condition in AFP Server may lead to an infinite loop. Enumerating files on an AFP server may lead to a denial of service. This update addresses the issue through improved file enumeration logic. This issue only affects systems running Mac OS X v10.5.6.
  • Apple Pixlet Video:
    Impact: Opening a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution
    Description: A memory corruption issue exist in the handling of movie files using the Pixlet codec. Opening a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit: Apple.
  • CarbonCore:
    Impact: Opening a file with a maliciously crafted resource fork may lead to an unexpected application termination or arbitrary code execution
    Description: A memory corruption issue exists in Resource Manager’s handling of resource forks. Opening a file with a maliciously crafted resource fork may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved validation of resource forks. Credit: Apple.
  • CFNetwork:
    Impact: Restores proper operation of cookies with null expiration times
    Description: This update addresses a non-security regression introduced in Mac OS X 10.5.6. Cookies may not be properly set if a web site attempts to set a session cookie by supplying a null value in the “expires” field, rather than omitting the field. This update addresses the issue by ignoring the “expires” field if it has a null value.
  • CFNetwork:
    Impact: Restores proper operation of session cookies across applications
    Description: This update addresses a non-security regression introduced in Mac OS X 10.5.6. CFNetwork may not save cookies to disk if multiple open applications attempt to set session cookies. This update addresses the issue by ensuring that each application stores its session cookies separately.
  • Certificate Assistant:
    Impact: A local user may manipulate files with the privileges of another user running Certificate Assistant
    Description: An insecure file operation exists in Certificate Assistant’s handling of temporary files. This could allow a local user to overwrite files with the privileges of another user who is running Certificate Assistant. This update addresses the issue through improved handling of temporary files. This issue does not affect systems prior to Mac OS X v10.5. Credit: Apple.
  • ClamAV:
    Impact: Multiple vulnerabilities in ClamAV 0.94
    Description: Multiple vulnerabilities exist in ClamAV 0.94, the most serious of which may lead to arbitrary code execution. This update addresses the issues by updating ClamAV to version 0.94.2. ClamAV is distributed only with Mac OS X Server systems. Further information is available via the ClamAV website at http://www.clamav.net/.
  • CoreText:
    Impact: Viewing maliciously crafted Unicode content may lead to an unexpected application termination or arbitrary code execution
    Description: A heap buffer overflow may occur when processing Unicode strings in CoreText. Using CoreText to handle maliciously crafted Unicode strings, such as when viewing a maliciously crafted web page, may result in an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. This issue does not affect systems prior to Mac OS X v10.5. Credit to Rosyna of Unsanity for reporting this issue.
  • CUPS:
    Impact: Visiting a maliciously crafted website may lead to an unexpected application termination
    Description: Exceeding the maximum number of RSS subscriptions results in a null pointer dereference in the CUPS web interface. This may lead to an unexpected application termination when visiting a maliciously crafted website. In order to trigger this issue, valid user credentials must either be known by the attacker or cached in the user’s web browser. CUPS will be automatically restarted after this issue is triggered. This update addresses the issue by properly handling the number of RSS subscriptions. This issue does not affect systems prior to Mac OS X v10.5.
  • DS Tools:
    Impact: Passwords supplied to dscl are exposed to other local users
    Description: The dscl command-line tool required that passwords be passed to it in its arguments, potentially exposing the passwords to other local users. Passwords exposed include those for users and administrators. This update makes the password parameter optional, and dscl will prompt for the password if needed. Credit: Apple.
  • fetchmail:
    Impact: Multiple vulnerabilities in fetchmail 6.3.8
    Description: Multiple vulnerabilities exist in fetchmail 6.3.8, the most serious of which may lead to a denial of service. This update addresses the issues by updating to version 6.3.9. Further information is available via the fetchmail web site at http://fetchmail.berlios.de/
  • Folder Manager:
    Impact: Other local users may access the Downloads folder
    Description: A default permissions issue exists in Folder Manager. When a user deletes their Downloads folder and Folder Manager recreates it, the folder is created with read permissions for everyone. This update addresses the issue by having Folder Manager limit permissions so that the folder is accessible only to the user. This issue only affects applications using Folder Manager. This issue does not affect systems prior to Mac OS X v10.5. Credit to Graham Perrin of CENTRIM, University of Brighton for reporting this issue.
  • FSEvents:
    Impact: Using the FSEvents framework, a local user may be able to see filesystem activity that would otherwise not be available
    Description: A credential management issue exists in fseventsd. By using the FSEvents framework, a local user may be able to see filesystem activity that would otherwise not be available. This includes the name of a directory which the user would not otherwise be able to see, and the detection of activity in the directory at a given time. This update addresses the issue through improved credential validation in fseventsd. This issue does not affect systems prior to Mac OS X v10.5. Credit to Mark Dalrymple for reporting this issue.
  • Network Time:
    Impact: The Network Time service configuration has been updated
    Description: As a proactive security measure, this update changes the default configuration for the Network Time service. System time and version information will no longer be available in the default ntpd configuration. On Mac OS X v10.4.11 systems, the new configuration takes effect after a system restart when Network Time service is enabled.
  • perl:
    Impact: Using regular expressions containing UTF-8 characters may lead to an unexpected application termination or arbitrary code execution
    Description: A memory corruption issue exists in the handling of certain UTF-8 characters in regular expressions. Parsing maliciously crafted regular expressions may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of regular expressions.
  • Printing:
    Impact: A local user may obtain system privileges
    Description: An error handling issue exists in csregprinter, which may result in a heap buffer overflow. This may allow a local user to obtain system privileges. This update addresses the issue through improved error handling. Credit to Lars Haulin for reporting this issue.
  • python:
    Impact: Multiple vulnerabilities in python
    Description: Multiple vulnerabilities exist in python, the most serious of which may lead to arbitrary code execution. This update addresses the issues by applying patches from the python project.
  • Remote Apple Events:
    Impact: Sending Remote Apple events may lead to the disclosure of sensitive information
    Description: An uninitialized buffer issue exists in the Remote Apple Events server, which may lead to disclosure of memory contents to network clients. This update addresses the issue through proper memory initialization. Credit: Apple.
  • Remote Apple Events:
    Impact: Enabling Remote Apple Events may lead to an unexpected application termination or the disclosure of sensitive information
    Description: An out-of-bounds memory access exits in Remote Apple Events. Enabling Remote Apple Events may lead to an unexpected application termination or the disclosure of sensitive information to network clients. This update addresses the issue through improved bounds checking. Credit: Apple.
  • Safari RSS:
    Impact: Accessing a maliciously crafted feed: URL may lead to arbitrary code execution
    Description: Multiple input validation issues exist in Safari’s handling of feed: URLs. esp issues allow execution of arbitrary JavaScript in the local security zone. This update addresses the issues through improved handling of embedded JavaScript within feed: URLs. Credit to Clint Ruoho of Laconic Security, Billy Rios of Microsoft, and Brian Mastenbrook for reporting these issues.
  • servermgrd:
    Impact: Remote attackers may be able to access Server Manager without valid credentials
    Description: An issue in Server Manager’s validation of authentication credentials could allow a remote attacker to alter the system configuration. This update addresses the issue through additional validation of authentication credentials. This issue does not affect systems prior to Mac OS X v10.5. Credit: Apple.
  • SMB:
    Impact: Connecting to a maliciously crafted SMB file system may lead to an unexpected system shutdown or arbitrary code execution with system privileges
    Description: An integer overflow in SMB File System may result in a heap buffer overflow. Connecting to a maliciously crafted SMB file system may lead to an unexpected system shutdown or arbitrary code execution with system privileges. This update addresses the issue through improved bounds checking. This issue does not affect systems prior to Mac OS X v10.5. Credit: Apple.
  • SMB:
    Impact: Connecting to a maliciously crafted SMB file server may lead to an unexpected system shutdown
    Description: A memory exhaustion issue exists in the SMB File System’s handling of file system names. Connecting to a maliciously crafted SMB file server may lead to an unexpected system shutdown. This update addresses the issue by limiting the amount of memory allocated by the client for file system names. Credit: Apple.
  • SquirrelMail:
    Impact: Multiple vulnerabilities in SquirrelMail
    Description: SquirrelMail is updated to version 1.4.17 to address several vulnerabilities, the most serious of which is a cross-site scripting issue. Further information is available via the SquirrelMail web site at http://www.SquirrelMail.org/
  • X11:
    Impact: Multiple vulnerabilities in X11 server
    Description: Multiple vulnerabilities exist in X11 server. The most serious of these may lead to arbitrary code execution with the privileges of the user running the X11 server, if the attacker can authenticate to the X11 server. This update addresses the issues by applying the updated X.Org patches. Further information is available via the X.Org website at http://www.x.org/wiki/Development/Security
  • X11:
    Impact: Multiple vulnerabilities in FreeType v2.1.4
    Description: Multiple vulnerabilities exist in FreeType v2.1.4, the most serious of which may lead to arbitrary code execution when processing a maliciously crafted font. This update addresses the issues by incorporating the security fixes from version 2.3.6 of FreeType. Further information is available via the FreeType site at http://www.freetype.org/ The issues are already addressed in systems running Mac OS X v10.5.6.
  • X11:
    Impact: Multiple vulnerabilities in LibX11
    Description: Multiple vulnerabilities exist in LibX11, the most serious of which may lead to arbitrary code execution when processing a maliciously crafted font. This update addresses the issues by applying the updated X.Org patches. Further information is available via the X.Org website at http://www.x.org/wiki/Development/Security These issues do not affect systems running Mac OS X v10.5 or later.
  • XTerm:
    Impact: A local user may send information directly to another user’s Xterm
    Description: A permissions issue exists in Xterm. When used with luit, Xterm creates tty devices accessible by everyone. This update addresses the issue by having Xterm limit the permissions so tty devices are accessible only by the user.
  • Security Update 2009-001 requires Mac OS X 10.5 or later to install and run.
    If you’ve tried the update and noticed any changes, please let us know in the comments or forums.

    (more…)