Security Update 2006-005 || sleep issues

after installing Security Update 2006-005, like others i had problems with connecting to my airport express, sluggish behavior, and some hanging apps (unable to kill or forcequit). i deleted various cache files (via macfixit suggestion), zapped pram, repaired disk permissions. things seem to be working fine now, with the exception that my computer will no longer sleep. has anyone experienced this? also of note, when i have tried to get the computer to sleep and ichat is running, it tries to disconnect, then the application hangs, and cannot be quit, force quit or killed.
please help, my mac wishes to sleep again.
e.

what does this do, is it stronger than just a force quit or a kill?
also, my issues resolved. after zapping pram, permissions, cache cleanup, and macjanitor, the last ingredient was to turn the computer off for a while. i have heard unplugging the power supply isn't a bad idea either.
i stepped away, and later when i turned the machine back on, all my maintenance/cleanup work finally took and things were running well again. looks like it just needed some cleanup and a rest.
e.

Similar Messages

Question Regarding Security Updates 2006-005 and 2006-006?

Okay I just noticed Apple Security Update 2006-005 and 2006-006 are available for download. Has anyone had any problems with these updates? I remember the Security Update 2006-001 was a nightmare for me -- Safari was broken after that update I had to do a complete OS reinstall then re-update to Mac OSZ 10.3.9 Panther and I only want to update if the likelihood of any problems occuring is very slim. Anyone running Mac OS X on PowerPC chips (i.e. using a PowerBook, an older iMac, Mac Mini, PowerMac etc) or on Intel chips (i.e. MacBook Pro, the new iMacs, new Mac Mini's etc) with Mac OS X Panther, Mac OS X Tiger etc having any problems with either update?

(10.3.9 Client) seems to have broken my CS2 Version Cue after loading Security Update 2006-006 via Software Update - 27MB or something.
Though afterwards all apps (Illustrator 12.0.1, Acrobat 7.0.8, PS 9.0.1 and InDesign 4.0.4) open and run fine, Version Cue disappeared from the Desktop Menu and System Preferences and says it's no longer installed, all this immediately after loading the Update and restarting.
Two restarts and a Repair Permissions haven't resolved the issue. I've downloaded the stand alone Update and have run that but without any luck. I'd had no history of any trouble with any Security Update prior to this, and have run good maintenance schedules.
I've not seen any other posts or related issues to mine, so maybe it's just my isolated event?

Latest software update - security update 2006-005 and iTunes7.0.1

So I installed this one last night and ran repair permissions, but today iPhoto is crashing every time I try to import a JPG file and Safari also just randomly crashed on me. Have reported the bugs to the gods at Apple so let's see. Anyone else?

I have a different symptom after the latest security update (along with a few other app. updates)
after update, on restart my screen froze with the grey apple shifted off to the right, the fan started going beserk so I switched off.
restarted with no display connected and waited until I thought it had got the the end of the boot cycle and reconnected the display (23" apple cinema dispay) and all (so far) seems fine. A bit weird though. Anyone have any thoughts?
P
PowerBook G4 / G5 quad 23" acd Mac OS X (10.4.7)

Bootcamp issue with Security Update 2014-005.

My MacBook Pro with Bootcamp won't boot in Windows 8.1 mode after the recent Security Update 2014-005. Any suggestions on how to diagnose and repair the startup.
I am using a MacBook Pro (13 inch, Mid 2012) with a 2.5 GHz Intel Core i5, 4 GB 1600 MHz DDR3 with a Macintosh HD.

Keiths-MacBook-Pro:~ $ diskutil list
/dev/disk0
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *500.1 GB   disk0
   1:                        EFI EFI                     209.7 MB   disk0s1
   2:                  Apple_HFS Macintosh HD            249.2 GB   disk0s2
   3:                 Apple_Boot Recovery HD             650.0 MB   disk0s3
   4:       Microsoft Basic Data BOOTCAMP                250.0 GB   disk0s4
Keiths-MacBook-Pro:~ $ diskutil cs list
No CoreStorage logical volume groups found
Keiths-MacBook-Pro:~ $ sudo gpt -vv -r show /dev/disk0
Password:
gpt show: /dev/disk0: mediasize=500107862016; sectorsize=512; blocks=976773168
gpt show: /dev/disk0: Suspicious MBR at sector 0
gpt show: /dev/disk0: Pri GPT at sector 1
gpt show: /dev/disk0: Sec GPT at sector 976773167
      start       size index contents
          0          1         MBR
          1          1         Pri GPT header
          2         32         Pri GPT table
         34          6
         40     409600      1 GPT part - C12A7328-F81F-11D2-BA4B-00A0C93EC93B
     409640 486812704      2 GPT part - 48465300-0000-11AA-AA11-00306543ECAC
487222344    1269536      3 GPT part - 426F6F74-0000-11AA-AA11-00306543ECAC
488491880       1176
488493056 488280064      4 GPT part - EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
976773120         15
976773135         32         Sec GPT table
976773167          1         Sec GPT header

Menu Bar Icons Disappeared and other issues after Security Update 2006-001

Hi,
I was really affraid when i've heard about the Safari vulnerability, so I was really happy to see the Security Update 2006-001.
But after installing it, I'm having regrets:
* mouse speed turned to default settings
* system preferences crashes when i try to access to Mouse & Keyboard
* all the menu bar icons disappeared: Bluetooth, Airport, Time, EVEN Spotlight
* Finder is slower...
I've repaired disk permissions but: nothing happens....
What should I do please?
Should I wait?

How did you fix it? I'm having the same problem
myself.
Mandy,
I'm gonna tell you a secret, just like i said my problem wasn't due to the Security Update but because of Front Row.
How? Because, I've hacked my iMac (without iSight) to install FrontRow (with an update), and i've installed the Security Update at the same time. Restarted my computer, and thought the problem was due to the Security Update.
If you did the same thing, here's the trick to remove Front Row:
Delete Front Row (/System/Library/CoreServices/Front Row.app)
Install/reinstall the the latest Mac OS X Update Combo.
This article assumes you haven’t tried installing Front Row before without the use of Enabler. If you have used one of the very early versions of Front Row (ones installed without Enabler):
Delete Front Row (/System/Library/CoreServices/Front Row.app)
Delete the preference file (/System/Library/LaunchAgents/com.apple.frontrow.plist)
Remove any Login Items that launch Front Row (System Preferences >Accounts >User >Login Items)
Disable any shortcuts managed by third-party applications that launched Front Row.
Reboot and reinstall.

Apple Releases Security Update 2006-004 (PowerPC and Intel)

From Macfixit................
Apple has released Security Update 2006-004 for Mac OS X in both PowerPC and Intel versions. This update requires Mac OS X 10.4.7 for either PowerPC or Intel, Mac OS X 10.3.9 or Mac OS X 10.3.9 Server.
This is the fourth major standalone security update for Mac OS X released this year.
Update procedure recommendation First, avoid performing any other operations (in Mac OS X or third-party applications) while the update process is occurring. In addition, before installing this security update, make sure all Apple-installed applications and utilities are in their original locations. Moving one of these applications to a different location on your hard drive can lead to an incomplete update. Also, disconnect any FireWire/USB devices before applying the update (except for your startup drive, if it is FireWire or USB, and your keyboard/mouse), then re-connect the devices one by one (checking for issues created by any particular device) after the update process is complete and the system has restarted.
Enhancements in this release
Of most interest to general end-users:
a fix that prevents maliciously crafted Zip archives from causing condition where arbitrary code can be execute. In other words, prior to Security Update 2006-004 you could download a specially crafted file ending in .zip from a Web site or other location, and it could trigger the execution of malicious code.
a fix that disallows maliciously crafted Canon RAW images from creating a buffer overflow, potentially leading to arbitrary code execution. Prior to Security Update 2006-004, you could download or otherwise receive a Canon RAW file that could allow execution of malicious code on your system.
similar to the above, a fix that prevents maliciously crafted GIF images from causing an integer overflow, potentially leading to arbitrary code execution.
new download validation that will catch certain HTML files defined by Safari as "safe" that may actually contain malicious JavaScript code. After applying Security Update 2006-004, these files will not be automatically opened.
Protection against maliciously crafted HTML documents that can also open the door for arbitrary code execution by accessing deallocated objects.
A full list of enhancements is as follows:
AFP Server
An issue in the AFP server allows search results to include files and folders for which the user performing the search has no access. This may lead to information disclosure if the names themselves are sensitive information. If the permissions of the items allow it, the contents may also be accessible. This update addresses the issue in Mac OS X v10.3.9 by ensuring that search results only include items for which the user is authorized. For Mac OS X v10.4 systems, the issue was addressed in Mac OS X v10.4.7. Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9:
The AFP server contains an integer overflow that can be triggered by an authenticated user. A malicious user with access to the AFP server may be able to cause a denial of service attack or arbitrary code execution with system privileges. The AFP server is not enabled by default on Mac OS X. This update addresses the issue by performing additional validation. Credit to Dino Dai Zovi of Matasano Security for reporting this issue. Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.7, Mac OS X Server v10.4.7.
On Mac OS X Server, the AFP server supports reconnection of file sharing sessions after a network outage. The storage of reconnect keys is world-readable. It may be possible for an authenticated local user to read the reconnect keys, use them to impersonate another user over AFP, and access files or folders with the privileges of the impersonated user. This update addresses the issue by protecting the reconnect keys with appropriate file system permissions. This issue only affects Mac OS X Server. Available for: Mac OS X Server v10.3.9, Mac OS X Server v10.4.7.
An unchecked error condition exists in the AFP server that may lead to a crash. By carefully crafting an invalid AFP request, an attacker may be able to trigger this condition and cause a denial of service. This update addresses the issue by handling the formerly unchecked error condition. Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.7, Mac OS X Server v10.4.7
Bluetooth
The security of the Bluetooth Setup Assistant has been improved in this update for Mac OS X v10.4.7. The length of the automatically generated passkey used for pairing has been increased from six characters to eight characters. Available for: Mac OS X v10.4.7, Mac OS X Server v10.4.7
Bom
An issue in Bom's compression state handling may cause heap corruption. By carefully crafting a corrupt Zip archive and persuading a victim to open it, an attacker may be able to trigger this condition which could lead to an application crash or arbitrary code execution. Note that Safari will automatically open archives when "Open `safe' files after downloading" is enabled. This update addresses the issue by properly handling such malformed Zip archives. Credit to Tom Ferris of Security-Protocols.com for reporting this issue. Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.7, Mac OS X Server v10.4.7.
DHCP
A stack buffer overflow exists in bootpd's request processing. By carefully crafting a malicious BOOTP request, a remote attacker may be able to trigger the overflow and cause arbitrary code execution with the privileges of the system. Note that bootpd is not enabled by default in Mac OS X, and must be manually configured in order to be enabled. This update addresses the issue by performing additional bounds checking. Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.7, Mac OS X Server v10.4.7.
dyld
Malicious local system users may specify dynamic linker options that cause output to standard error. This output contains informational content and potentially user-specified content. As a result, privileged applications that parse or reuse standard error may be influenced inappropriately. This update addresses the issue by ignoring the problematic dynamic linker options in privileged applications. Credit to Neil Archibald of Suresec LTD for reporting this issue. Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.7, Mac OS X Server v10.4.7.
An improperly handled condition in the dynamic linker may lead to including dangerous paths when searching for libraries to load into privileged applications. As a result, malicious local users may cause the dynamic linker to load and execute arbitrary code with elevated privileges. This update addresses the issue by properly selecting search paths when executing privileged applications. Credit to Neil Archibald of Suresec LTD for reporting this issue. Available for: Mac OS X v10.4.7, Mac OS X Server v10.4.7
fetchmail
Several issues in the fetchmail utility were discovered. The most serious issue could lead to arbitrary code execution when fetching mail from a malicious POP3 mail server. All issues are described at the fetchmail website (fetchmail.berlios.de). This update addresses the issues by updating fetchmail to version 6.3.4. In addition, fetchmail is no longer distributed as a privileged utility. Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.7, Mac OS X Server v10.4.7.
gunzip
A race condition may allow a malicious local user to modify the permissions of files owned by another user executing gunzip. This issue is only exploitable when executing gunzip on files in directories that are modifiable by other users. This update addresses the issue by properly handling files while decompressing. Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.7, Mac OS X Server v10.4.7.
A directory traversal vulnerability is present in the command line utility gunzip when it is used with the non-default "-N" option. By carefully crafting a malicious compressed file and persuading a user to open it with "gunzip -N", an attacker may replace or create arbitrary files with the privileges of the victim. This update addresses the issue by properly stripping paths from files when decompressing. Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.7, Mac OS X Server v10.4.7
Image RAW
By carefully crafting a corrupt Canon RAW image, an attacker can trigger a buffer overflow which may lead to an application crash or arbitrary code execution. This update addresses the issue by performing additional validation of Canon RAW images. This issue does not affect systems prior to Mac OS X v10.4. Available for: Mac OS X v10.4.7, Mac OS X Server v10.4.7.
ImageIO
By carefully crafting a corrupt Radiance image, an attacker can trigger an integer overflow which may lead to an application crash or arbitrary code execution. This update addresses the issue by performing additional validation of Radiance images. This issue does not affect systems prior to Mac OS X v10.4. Available for: Mac OS X v10.4.7, Mac OS X Server v10.4.7
By carefully crafting a corrupt GIF image, an attacker can trigger an undetected memory allocation failure which may lead to an application crash or arbitrary code execution. This update addresses the issue by performing additional validation of GIF images. This issue does not affect systems prior to Mac OS X v10.4. Available for: Mac OS X v10.4.7, Mac OS X Server v10.4.7.
By carefully crafting a corrupt GIF image, an attacker can trigger an integer overflow which may lead to an application crash or arbitrary code execution. This update addresses the issue by performing additional validation of GIF images. This issue does not affect systems prior to Mac OS X v10.4. Credit to Tom Ferris of Security-Protocols.com for reporting this issue. Available for: Mac OS X v10.4.7, Mac OS X Server v10.4.7
LaunchServices
Download Validation may erroneously identify certain files containing HTML as "safe". If such a file is downloaded in Safari and Safari's "Open `safe' files after downloading" option is enabled, the HTML document will automatically be opened from a local URI. This would allow any JavaScript code embedded in the document to bypass access restrictions normally imposed on remote content. This update provides additional checks to identify potentially malicious file types so that they are not automatically opened. This issue does not affect systems prior to Mac OS X v10.4. Available for: Mac OS X v10.4.7, Mac OS X Server v10.4.7
OpenSSH
Attempting to log in to an OpenSSH server ("Remote Login") using a nonexistent account causes the authentication process to hang. An attacker can exploit this behavior to detect the existence of a particular account. A large number of such attempts may lead to a denial of service. This update addresses the issue by properly handling attempted logins by nonexistent users. This issue does not affect systems prior to Mac OS X v10.4. Credit to Rob Middleton of the Centenary Institute (Sydney, Australia) for reporting this issue. Available for: Mac OS X v10.4.7, Mac OS X Server v10.4.7
telnet
When connected to a TELNET server, the client may send the contents of arbitrary environment variables to the server if the server requests them. Some environment variables may contain sensitive information that should not be sent over the network. This update addresses the issue by ensuring that only non-sensitive variables and variables that the user has explicitly requested are are shared with the server. Credit to Gael Delalleau and iDEFENSE for reporting this issue. Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.7, Mac OS X Server v10.4.7.
WebKit
A maliciously-crafted HTML document could cause a previously deallocated object to be accessed. This may lead to an application crash or arbitrary code execution. This update addresses the issue by properly handling such documents. Credit to Jesse Ruderman of Mozilla Corporation for reporting this issue. Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.7, Mac OS X Server v10.4.7
AppKit, ImageIO
Buffer overflows were discovered in TIFF tag handling (CVE-2006-3459, CVE-2006-3465), the TIFF PixarLog decoder (CVE-2006-3461), and the TIFF NeXT RLE decoder (CVE-2006-3462). By carefully crafting a corrupt TIFF image, an attacker can trigger a buffer overflow which may lead to an application crash or arbitrary code execution. This update addresses the issue by performing additional validation of TIFF images. Systems prior to Mac OS X v10.4 are affected only by the TIFF NeXT RLE decoder issue (CVE-2006-3462). Credit to Tavis Ormandy, Google Security Team for reporting this issue. Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.7, Mac OS X Server v10.4.7./

Right after installing Security Update 2006-004 (Intel) on my macbook pro I am having troubles with my wireless connectivity. Here is the dump from the console:
Aug 3 15:49:43 x-ray /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport: Error: WirelessAssociate2() = 88001006 for network RadioActive
Aug 3 15:49:43 x-ray /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport: Error: (had password)
Aug 3 15:49:51 x-ray /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport: Error: WirelessAssociate2() = 88001006 for network RadioActive
Aug 3 15:49:51 x-ray /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport: Error: (had password)
Aug 3 15:49:59 x-ray /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport: Error: WirelessAssociate2() = 88001006 for network RadioActive
Aug 3 15:49:59 x-ray /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport: Error: (had password)
I can reboot and it will work, but if I put my macbook to sleep it, when I wake it, it will do the same thing again.
I am also getting timeouts waiting for results of 1st wireless scan to complete in console.
Anyone else having this issue?
MBP15-2GHZ Mac OS X (10.4.7)

After Security update 2006-002, RAM is halved

Hi,
Right after applying the Security Update 2006-002, I experienced a freeze upon wake-up from sleep. And a general application slowdown.
A fleeting look past the About this Mac window surprisingly revealed that the system now identifies the two additional (trusty for 8 months or so) OWC 1GB RAM modules as 512kb only. Startup memory test is reported as failed - But the modules are still listed as OK.)
I tried putting the modules in another bank. This works, after restart memory is identified correctly and system breezes. Unfortunately, another restart brings things back to the original, 1.5GB state.
Resetting nvram (reset-nvram, set-defaults, reset-all) in OF also mostly has the same effect: First restart restores things back to normal, second restart brings the problem back.
Having read about the recent PB problems where a system update aparently disabled one memory slot, something tells me it's not the RAM modules themselves. (Yes, they check out fine in memory tests.)
Any ideas?
Best,
Ben

Problem disappeared after I caved in and bought new RAM (Kingston Value Ram) as recomended by / from a local dealer. I am inclined to think this in fact was a defect in the RAM modules themselves, OWC has issued a RMA on them and I'm sending them back. Thanks!

Mac shuts down after security update 2007-005

I installed security update 2007-005 and now after going to sleep the mac just shuts down. I have repaired permissions and run DiskWarrior. It just keeps happening.
Karen
iMac G5 Mac OS X (10.3.9)

Since I have installed security update 2007-003 and 4, DVD player was disabled. now that apple released security update 2007-005, I am now facing more serious issues with the entire system halting (the clock is frozen and the mouse turns into a beach ball... every once in a while)! I am beginning to suspect that the last three security updates need to be avoided at any cost since I have had so many problems with them!
So, in answer to your question, I would just run a clean install of OS 10.3, and never install security update 2007-004 and 5 until apple assures us that there are no more flaws in the security updates again!

Unable to see PC's on network after Security Update 2008-005

I just updated our Tiger server with the latest security update 2008-005 and now none of the PC's can see the Workgroup or the server. In addition, the Macs can no longer see the PC's on the network. The PC's can connect to other computers if it was previously mapped. However if we try to connect to the Workgroup, it is denied. Previously one PC's with the Windows Firewall turned on blocked all the PC's from seeing the Workgroup however it did not block Macs. This time viewing PC's is blocked completely and there are no PC's windows firewalls running. The macs can still see other macs and the servers (all Xserve's).

Issue resolved. It had nothing to do with the update. When I restarted the server it chose an NT computer on the network as the Master Browser. The resolution was to turn off the NT computer, restart the computer and let it pick up one of the 2000 or XP computers as the Master Browser. That worked.

System preferences shot after Security Update 2006-008 - no sound any more

All sorts of strange problems after running the 2006-008 security update, yet only affecting one my two MacMini:
System Preferences completely "shot", with the Date&Time item/icon looking very odd.
The little flag for language/keyboard setting and date/time did not show any more in the top menu bar -- basically everything left side of the blue Spotlight magnifying glass icon was gone.
Also Safari much more prone to quit.
Managed to delete some prefs and cached stuff and to replace the System Preferences application with the one from the other (working ok) Mac.
(I wish such components were available on the web!)
However: Currently I get no sound whatsoever. When I check the option to have the little speaker symbol displayed in the menu bar it shows. But as soon as I click it once, it vanishes from the menu bar.
In the Sound window, I have Volume set to full, yet everything is greyed out, "Sound off" is checked without my doing, while "Display sound volume in the menu bar" unchecks itself everytime(!)
And, very odd: While resetting PRAM and the fsck-routine working ok (no problems found) and disk utility claiming to have repaired all permissions, I can not run a reset of Open Firmware/nvram with the O-F-Apple-Alt key combination (I'm using an original Apple USB Keyboard for this, since I'm aware that my 3rd party keyboards from Logitech and Microsoft often refuse to perform such kind of "low level" tasks).
Mac Mini 1.66 GHz 2 GB RAM Mac OS X (10.4.8) German language OS

finally found the solution to my problems at
http://www.macfixit.com/article.php?story=20061229012312895
Late-Breakers
Friday, December 29 2006 @ 01:23 AM PST
Security Update 2006-008 Special Report: General fixes for common issues
"Re-apply the Mac OS X 10.4.8 combo updater Once again, re-application of the current combination updater (Mac OS X 10.4.8 for PowerPC or Intel) has proven useful in the case of Security Update 2006-008. Doing so overwrites potentially problem-causing files".
while it is widely known that the folks from redmond do release software before all the bugs are removed, i was not aware before that apple is following the same approach: using their customers as guinea pigs when it comes to updates. there is plenty of reports on MacFixIt about all sorts of troubles with previous apple os updates.
Mac Mini 1.66 GHz 2 GB RAM Mac OS X (10.4.8) German language OS

Delay when opening Airport menu bar item following Security Update 2007-005

When I first got this computer, there was one annoying quirk: when I clicked on the Airport menu bar item at the top right, there would be a roughly 1 second pause before the menu actually appeared. I recall hearing other people having the same experience at the time. Airport worked fine, but this delay was really annoying: since you're not sure if the system registered your click, so you click again, but then it registers the second click which causes the menu to disappear as soon as it appears, and you click again, and fall into this ridiculous cycle of fighting the sluggish menu item.
Before long, this issue disappeared following some update (I can't remember which).
After installing Security Update 2007-005, this exact same annoyance has reappeared. (I can confirm that the presence of the 802.11n Enabler update has no effect on the problem.)
Is anyone else noticing this? Is there anything I can do to fix it?

Hi
Can you tell people how you cured the problem, so that those who search looking for answers to a similar problem know how to fix it?
Steve
I haven't got a problem myself, BTW)

Outlook from Office 2011 can't start after OS X Security Update 2014-005

I just installed Security Update 2014-005 on OS X v10.9.5 in a MacBook Pro (2012). After the OS restarts, Microsoft Outlook from Office 2011 fails to start. Did anyone else experience this issue and have a solution that can be shared?

Try u-installing Office and re-installing.
Office 2011 Removal
Office 2011 Removal (2)

ClamAV and DNS Failure with Security Update 2010-005

Hey everyone, got a bit of an issue.
I'm running Leopard Server 10.5.8 and I've noticed a very odd issue with the latest security update, (2010-005).
Since the update, whenever ClamAV goes out to check for new definitions and database updates, all of my DNS clients lose connection during the few minutes that it's working. I've verified this by watching the logs as the updates happen. Everything is fine, and the second that ClamAV starts running, DNS fails on all the clients, then starts again after the update process.
Anyone else notice this? And more importantly, how should I go about disabling ClamAV, since I don't run a mail server off this particular server.
Thanks!

The System Info below your post indicates that you are running OS X 10.5.8. The FaceTime Beta requires a minimum of OS X 10.6.4.

VPN broken after 10.6.4 Update / Security Update 2010-005

I have a MacMini Server that was running 10.6.3 in use as a gateway for the last 3 or 4 months and everything has been working just fine. However, after applying 10.6.4 and Security Update 2010-005 the iChat and VPN services broke.
I was able to fix the iChat service by using serveradmin in Terminal - Server Admin was showing the correct name of the iChat server, but serveradmin reported a different (incorrect) name. My only guess is that one of the updates somehow changed that setting behind the scenes.
I have yet to be able to fix the VPN (L2TP) issue, though. I can connect internally (to 10.0.1.1) with no problem. I can connect with via iPhone over 3G no problem. I cannot connect externally from a 10.5.8 or a 10.6.4 client - any attempt always fails with a timeout. The VPN log shows nothing, but the system log shows:
Sep 24 14:18:33 gateway racoon[90950]: Connecting.
Sep 24 14:18:33 gateway racoon[90950]: IKE Packet: receive success. (Responder, Main-Mode message 1).
Sep 24 14:18:33 gateway racoon[90950]: IKE Packet: transmit success. (Responder, Main-Mode message 2).
Sep 24 14:18:36 gateway racoon[90950]: IKE Packet: transmit success. (Phase1 Retransmit).
Sep 24 14:19:03: --- last message repeated 8 times ---
Sep 24 14:19:03 gateway racoon[90950]: IKEv1 Phase1: maximum retransmits. (Phase1 Maximum Retransmits).
Sep 24 14:19:03 gateway racoon[90950]: Disconnecting. (Connection tried to negotiate for, 29.171451 seconds).
Sep 24 14:19:03 gateway racoon[90950]: IKE Phase1 Failure-Rate Statistic. (Failure-Rate = 100.000).
It would seem that the response to the initial handshake is being blocked. However, serveradmin has this to say about ipfilter:
gateway:/ *******$ sudo serveradmin settings ipfilter|grep VPN
ipfilter:ipAddressGroupsWithRules:array_id:any:rules:_arrayid:VPN ISAKMP/IKE:action = "allow"
ipfilter:ipAddressGroupsWithRules:array_id:any:rules:_arrayid:VPN L2TP - Layer-Two Tunneling Protocol:action = "allow"
ipfilter:ipAddressGroupsWithRules:array_id:any:rules:_arrayid:VPN L2TP\: IKE NAT Traversal:action = "allow"
ipfilter:ipAddressGroupsWithRules:array_id:any:rules:_arrayid:VPN L2TP\: ISAKMP/IKE:action = "allow"
ipfilter:ipAddressGroupsWithRules:array_id:any:rules:_arrayid:VPN L2TP\: ESP - Encapsulating Security Payload protocol:action = "allow"
ipfilter:standardServices:arrayid:VPN PPTP\: GRE - Generic Routing Encapsulation protocol:readOnly = yes
ipfilter:standardServices:arrayid:VPN PPTP\: GRE - Generic Routing Encapsulation protocol:protocol = "gre"
ipfilter:standardServices:arrayid:VPN PPTP\: GRE - Generic Routing Encapsulation protocol:name = ""
ipfilter:standardServices:arrayid:VPN PPTP\: GRE - Generic Routing Encapsulation protocol:dest-port = ""
ipfilter:standardServices:arrayid:VPN L2TP\: ESP - Encapsulating Security Payload protocol:readOnly = yes
ipfilter:standardServices:arrayid:VPN L2TP\: ESP - Encapsulating Security Payload protocol:protocol = "esp"
ipfilter:standardServices:arrayid:VPN L2TP\: ESP - Encapsulating Security Payload protocol:name = ""
ipfilter:standardServices:arrayid:VPN L2TP\: ESP - Encapsulating Security Payload protocol:dest-port = ""
ipfilter:standardServices:arrayid:VPN L2TP - Layer-Two Tunneling Protocol:oldDescription = "Layer-Two Tunneling Protocol (L2TP)"
ipfilter:standardServices:arrayid:VPN L2TP - Layer-Two Tunneling Protocol:protocol = "udp"
ipfilter:standardServices:arrayid:VPN L2TP - Layer-Two Tunneling Protocol:readOnly = no
ipfilter:standardServices:arrayid:VPN L2TP - Layer-Two Tunneling Protocol:name = ""
ipfilter:standardServices:arrayid:VPN L2TP - Layer-Two Tunneling Protocol:dest-port = "1701"
ipfilter:standardServices:arrayid:VPN PPTP - Point-to-Point Tunneling Protocol:oldDescription = "PPTP VPN"
ipfilter:standardServices:arrayid:VPN PPTP - Point-to-Point Tunneling Protocol:protocol = "tcp"
ipfilter:standardServices:arrayid:VPN PPTP - Point-to-Point Tunneling Protocol:readOnly = no
ipfilter:standardServices:arrayid:VPN PPTP - Point-to-Point Tunneling Protocol:name = ""
ipfilter:standardServices:arrayid:VPN PPTP - Point-to-Point Tunneling Protocol:dest-port = "1723"
ipfilter:standardServices:arrayid:VPN L2TP\: ISAKMP/IKE:readOnly = no
ipfilter:standardServices:arrayid:VPN L2TP\: ISAKMP/IKE:protocol = "udp"
ipfilter:standardServices:arrayid:VPN L2TP\: ISAKMP/IKE:name = ""
ipfilter:standardServices:arrayid:VPN L2TP\: ISAKMP/IKE:dest-port = "500"
ipfilter:standardServices:arrayid:VPN L2TP\: IKE NAT Traversal:readOnly = no
ipfilter:standardServices:arrayid:VPN L2TP\: IKE NAT Traversal:protocol = "udp"
ipfilter:standardServices:arrayid:VPN L2TP\: IKE NAT Traversal:name = ""
ipfilter:standardServices:arrayid:VPN L2TP\: IKE NAT Traversal:dest-port = "4500"
Which seems to be correct to me.
As with the iChat problem, everything seems to be correct as reported by Server Admin. I have been hunting for the incorrect setting using serveradmin, but so far everything there seems to be correct as well.
One last item that I just discovered today, and which is probably a huge hint (and I just don't know how to connect the dots), is that when I stop the VPN service (it's running on the gateway server), the entire office loses it's connection to the internet. Turn VPN back on, and the internet is back.
I think my server is deeply, deeply disturbed, but I am not ready to wipe it clean and start over again. I sure would appreciate any insights on this one....

I have a MacMini Server that was running 10.6.3 in use as a gateway for the last 3 or 4 months and everything has been working just fine. However, after applying 10.6.4 and Security Update 2010-005 the iChat and VPN services broke.
I was able to fix the iChat service by using serveradmin in Terminal - Server Admin was showing the correct name of the iChat server, but serveradmin reported a different (incorrect) name. My only guess is that one of the updates somehow changed that setting behind the scenes.
I have yet to be able to fix the VPN (L2TP) issue, though. I can connect internally (to 10.0.1.1) with no problem. I can connect with via iPhone over 3G no problem. I cannot connect externally from a 10.5.8 or a 10.6.4 client - any attempt always fails with a timeout. The VPN log shows nothing, but the system log shows:
Sep 24 14:18:33 gateway racoon[90950]: Connecting.
Sep 24 14:18:33 gateway racoon[90950]: IKE Packet: receive success. (Responder, Main-Mode message 1).
Sep 24 14:18:33 gateway racoon[90950]: IKE Packet: transmit success. (Responder, Main-Mode message 2).
Sep 24 14:18:36 gateway racoon[90950]: IKE Packet: transmit success. (Phase1 Retransmit).
Sep 24 14:19:03: --- last message repeated 8 times ---
Sep 24 14:19:03 gateway racoon[90950]: IKEv1 Phase1: maximum retransmits. (Phase1 Maximum Retransmits).
Sep 24 14:19:03 gateway racoon[90950]: Disconnecting. (Connection tried to negotiate for, 29.171451 seconds).
Sep 24 14:19:03 gateway racoon[90950]: IKE Phase1 Failure-Rate Statistic. (Failure-Rate = 100.000).
It would seem that the response to the initial handshake is being blocked. However, serveradmin has this to say about ipfilter:
gateway:/ *******$ sudo serveradmin settings ipfilter|grep VPN
ipfilter:ipAddressGroupsWithRules:array_id:any:rules:_arrayid:VPN ISAKMP/IKE:action = "allow"
ipfilter:ipAddressGroupsWithRules:array_id:any:rules:_arrayid:VPN L2TP - Layer-Two Tunneling Protocol:action = "allow"
ipfilter:ipAddressGroupsWithRules:array_id:any:rules:_arrayid:VPN L2TP\: IKE NAT Traversal:action = "allow"
ipfilter:ipAddressGroupsWithRules:array_id:any:rules:_arrayid:VPN L2TP\: ISAKMP/IKE:action = "allow"
ipfilter:ipAddressGroupsWithRules:array_id:any:rules:_arrayid:VPN L2TP\: ESP - Encapsulating Security Payload protocol:action = "allow"
ipfilter:standardServices:arrayid:VPN PPTP\: GRE - Generic Routing Encapsulation protocol:readOnly = yes
ipfilter:standardServices:arrayid:VPN PPTP\: GRE - Generic Routing Encapsulation protocol:protocol = "gre"
ipfilter:standardServices:arrayid:VPN PPTP\: GRE - Generic Routing Encapsulation protocol:name = ""
ipfilter:standardServices:arrayid:VPN PPTP\: GRE - Generic Routing Encapsulation protocol:dest-port = ""
ipfilter:standardServices:arrayid:VPN L2TP\: ESP - Encapsulating Security Payload protocol:readOnly = yes
ipfilter:standardServices:arrayid:VPN L2TP\: ESP - Encapsulating Security Payload protocol:protocol = "esp"
ipfilter:standardServices:arrayid:VPN L2TP\: ESP - Encapsulating Security Payload protocol:name = ""
ipfilter:standardServices:arrayid:VPN L2TP\: ESP - Encapsulating Security Payload protocol:dest-port = ""
ipfilter:standardServices:arrayid:VPN L2TP - Layer-Two Tunneling Protocol:oldDescription = "Layer-Two Tunneling Protocol (L2TP)"
ipfilter:standardServices:arrayid:VPN L2TP - Layer-Two Tunneling Protocol:protocol = "udp"
ipfilter:standardServices:arrayid:VPN L2TP - Layer-Two Tunneling Protocol:readOnly = no
ipfilter:standardServices:arrayid:VPN L2TP - Layer-Two Tunneling Protocol:name = ""
ipfilter:standardServices:arrayid:VPN L2TP - Layer-Two Tunneling Protocol:dest-port = "1701"
ipfilter:standardServices:arrayid:VPN PPTP - Point-to-Point Tunneling Protocol:oldDescription = "PPTP VPN"
ipfilter:standardServices:arrayid:VPN PPTP - Point-to-Point Tunneling Protocol:protocol = "tcp"
ipfilter:standardServices:arrayid:VPN PPTP - Point-to-Point Tunneling Protocol:readOnly = no
ipfilter:standardServices:arrayid:VPN PPTP - Point-to-Point Tunneling Protocol:name = ""
ipfilter:standardServices:arrayid:VPN PPTP - Point-to-Point Tunneling Protocol:dest-port = "1723"
ipfilter:standardServices:arrayid:VPN L2TP\: ISAKMP/IKE:readOnly = no
ipfilter:standardServices:arrayid:VPN L2TP\: ISAKMP/IKE:protocol = "udp"
ipfilter:standardServices:arrayid:VPN L2TP\: ISAKMP/IKE:name = ""
ipfilter:standardServices:arrayid:VPN L2TP\: ISAKMP/IKE:dest-port = "500"
ipfilter:standardServices:arrayid:VPN L2TP\: IKE NAT Traversal:readOnly = no
ipfilter:standardServices:arrayid:VPN L2TP\: IKE NAT Traversal:protocol = "udp"
ipfilter:standardServices:arrayid:VPN L2TP\: IKE NAT Traversal:name = ""
ipfilter:standardServices:arrayid:VPN L2TP\: IKE NAT Traversal:dest-port = "4500"
Which seems to be correct to me.
As with the iChat problem, everything seems to be correct as reported by Server Admin. I have been hunting for the incorrect setting using serveradmin, but so far everything there seems to be correct as well.
One last item that I just discovered today, and which is probably a huge hint (and I just don't know how to connect the dots), is that when I stop the VPN service (it's running on the gateway server), the entire office loses it's connection to the internet. Turn VPN back on, and the internet is back.
I think my server is deeply, deeply disturbed, but I am not ready to wipe it clean and start over again. I sure would appreciate any insights on this one....

Apache denying http requests- could it be Security update 2006-007PPC?

I've been webhosting off an iMac G4 for two years and yesterday no one could access any of the pages, coming from multiple DNSs. I opened up sharing and turned on the log, saw some denials. Some improvement by toggling Personal Web Sharing, but goes back to not letting requests go through. Just so happens, I upgraded the hard drive the day before using carbon copy cloner and also converted the main page to a CSS, although can't imagine that would do it since I used the template from a working page. Could it be one of these changed some Apache settings or Security Upgrade is responsible? I'm on the phone right now, telling someone I'm working on it....

12190 deny tcp from any to any
65535 allow ip from any to any</pre>Usually, though,
if you turn on a service, the corresponding port
should open in the firewall. If the firewall is off,
I just get the last line starting with
65535.
That's about the same, I just didn't publish the info on the other ports because I didn't think it was pertinent.
Checking
the access log, I had been getting hammered for a
while by something automated on PHP calendar I had
posted- so I shut that down.
I'm not sure I understand this. Does this mean you
shut off the firewall and got the hits, or you saw
the hits being denied? The other log entries you
posted came from the system log or console, and
not the Apache access log.
I can see where that was confusing. Upon reviewing the httpd/access log (as well as any other I thought might provide a clue), there were a slew of hits, all different times of the day from one IP address, all on the PHPicalendar page I had posted. Sometimes the requests would be an individual hit, but most times they would come in groups of ten or twenty all about 4 seconds apart. These were logged all the way back to the oldest entries still in the log files. The computer had been dutifully fulfilling the requests and this most likely explains some system slowness I had been seeing on the machine. Since then I disabled that page and the requests get a 404 reply from Apache. I threw that comment out to justify why I was interested in changing my IP address. By the way, google calendar and iCal integrate really nicely, allowing iCal to subscribe to the google calendar and then I could export the iCal to the PHPicalendar. A little circuitous, but not annoyingly so. Anyway, now that I know that it's being targeted I'll probably just work with google calendar and the google notifier app for macs.
Again, the closest event to
the known start of the problem was the Security
Update 2006-007PPC.
For what it's worth, I've applied the Security Update
on this iMac without this problem. Which is not to
say it's not possible it caused the problem. But if
so, it's still more likely to be something isolated
to your system and not a general bug in the update.
I think I might have figured out the problem. Going through the system log, I noticed the computer sleeping and waking. I went to system prefs and checked the settings, then changed to "never sleep." Seems to be working. I know I didn't change that setting, and I was under the impression that before, the http requests were waking the computer up- although I don't know, I just never had this problem before. To add to the confusion at one point the subnet address of the machine changed because I was trying to debug by doing a network restart and the router was pointing to the wrong computer. I'll have to check with the other users of this machine to see if they altered the setting- but they may not fess up since they know they're not supposed to mess with system prefs- as it is, I've got the parental controls turned on.
As for the stability of the Comcast IP address, I
unplugged the modem for about 6 hours last night,
plugged it back and had the same IP
address.
That's been my experience, too. Comcast's IP
addresses are tied to the MAC address of whatever
customer supplied equipment faces it. I think you
might have to be disconnected from the cable modem
until the DHCP lease expires, and someone else gets
your old IP address, in order to get a new IP
address.
I've been able to force a new IP address by changing
the MAC address on my router. However, if you decide
to try this, only use the MAC address from a
device you have in your physical possession. For
example, you could clone the MAC address from one of
your computers to the router. Just make sure you go
back to the router's real MAC address if you get rid
of the computer.
Remember, you have to reboot the cable modem any time
you change the MAC address of the device connected to
it. Just like you would if you connected a different
computer directly to the cable modem.
charlie
Thanks, I'll try that. I'm going to give it another day or two to see if it's stable again.
dan
iMac G4, MacBook Mac OS X (10.4.8)

Security Update 2006-005 || sleep issues

Similar Messages

Maybe you are looking for