Security Update: Bash "Shellshock" Vulnerability

Take this at face value, but we had a ticket open with them in regards to this exploit for tracking reasons, and I specifically asked the SUS question. Here is the response.

> This getting released to Software Updates?
>

There are no immediate plans to release these as a software update.

As always, if you have any additional questions or information about this issue, please let me know.

Thanks,
Dan N
AppleCare Enterprise Customer Support Engineering

>>There are no immediate plans to release these as a software update. >>

Apple sure is strange with some of the decisions they make.

Nice. Let's not actually make it easy for Mac users to install this 'security' update.
By not publishing it to SUS, the majority of average Joe Mac users will never even know about this and won't get it installed until and if Apple rolls this into another security update later that does show up in SUS. Or until they upgrade their Mac to Yosemite. Maybe that's the plan. A little birdie told me 10.10 has reportedly gone GM, so shouldn't be long now.

apple GM or for real GM?
Yes, I AM still miffed about the changes to Mavericks after it went 'GM'. :)

For real GM. Check macworld.com. There's an article about it.

So Apple really isn't going to make this available via Software Update? That seems crazy to me.

its a 3MB package how hard is it to make a policy to just install it? And better yet you can enforce the .5 update that is necessary with it. Seems like what I bought the Casper Suite for is a situation just like this, not sure why you bought it.
And this vulnerability is so unlikely to affect "most" Mac users, and while it makes no sense why they are not putting it in ASU/SUS why worry about the general population. My guess is hearing whats happening on the Gentoo linux distribution (patches every day last week for bash) that the current two fixes are really not all there are, and while its possible to exploit this its still less dangerous than users installing software or running scripts they download off the internet from devious people.

and changes after the last Seed or Beta version have been the norm for over a year now, I would not expect that to change anytime soon.

It wouldn't be too hard to handle this with Casper policies. It would be much easier to use my existing SUS infrastructure though. I wouldn't have to create different policies for 10.7/10.8/10.9 if it was in SUS. It just makes more sense to me to handle all OS updates with SUS vs Casper. I also have a bunch of notebooks that are set to look to Apple's SUS servers and install updates automatically. That is nice because a bunch of my users don't make it back to our network frequently to run Casper policies.

I think you make a good point with the linux updates. Perhaps Apple is holding off with putting something out via Software Updates until they know that no new vulnerabilities are uncovered.

I built the policy last week and haven't looked back, but I think Apple's choice to not included it in SUS is lame.

What's the worst thing that results, machines that likely aren't vulnerable get a 3MB patch? It needs to be replaced when a new version is available?

Maybe apple doesn't want to publicize to (or remind) their consumer customer base that the vulnerability exists when it shows up for them during software update. Granted, it isn't a huge client vulnerability, but a whole bunch of us are pushing it to clients anyway.