Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

In the event of finding a security vulnerability in the Linux world, the procedure involved would be to report the vulnerability...

  • ...to the developers or the maintainers of the package in a particular operating system.
  • ...to the security team of that particular operating system.

Then patches are made and CVE's are released.

I'm curious about how does open source vulnerability reporting work in the OSX world? Do the developers release CVE's if a security issue is brought to their notice?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

You can contact Apple about this at product-security@apple.com (or you can open a Radar report if you're a developer), or you contact the maintainer of the package.
Often the mail addresses can be found in the README (or AUTHORS) of the source code, or on the project's website.

Yes - both Apple (specifically) and the open source developers (in general) do reference CVE in patch and security emails and participate using that mechanism for tracking reported vulnerabilities.

share|improve this answer
    
Yes - making sure Apple is directly aware of problems in code they bundle is very important. I like the two pronged approach of letting Apple and the original maintainer of the open source know to reinforce the message and ensure both parties can evaluate your report. –  bmike Feb 10 '12 at 18:02

The procedure for reporting security vulnerabilities varies but the place to report would be directly to the open source project. If the application is hosted in the app store then you could report directly to Apple.

share|improve this answer

Apples official security posture is Apple Product Security.

But I would say that your best bet would be to submit vulnerabilities via the Apple Bug Reporter and their product-security email address . Additionally, if the part with the vulnerability is an open-source project, you should also notify the open source project as well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.