Comments on: NSURLConnection Crashing Epidemic http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic Mac & Technology Writings by Daniel Jalkut Sun, 6 Jul 2008 16:17:38 +0000 http://wordpress.org/?v=2.5.1 By: neuroklinik http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-136343 neuroklinik Wed, 02 Apr 2008 17:42:53 +0000 http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-136343 Daniel: After posting this and conducting more research, I realized that there were likely more than one issue at play. Thanks for the heads up. I'll file a bug. cbf Daniel:

After posting this and conducting more research, I realized that there were likely more than one issue at play.

Thanks for the heads up. I’ll file a bug.

cbf

]]> By: Daniel Jalkut http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-136342 Daniel Jalkut Wed, 02 Apr 2008 14:51:14 +0000 http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-136342 Thanks neuroklinik - but I believe the crash you're seeing is separate from this one that I reported. I've heard from others that there are specifically crashes having to do with proxy servers and NSURLConnection, which it sounds like you're running into. Suggest reporting these bugs to Apple ! Thanks neuroklinik - but I believe the crash you’re seeing is separate from this one that I reported. I’ve heard from others that there are specifically crashes having to do with proxy servers and NSURLConnection, which it sounds like you’re running into.

Suggest reporting these bugs to Apple !

]]> By: neuroklinik http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-136341 neuroklinik Wed, 02 Apr 2008 14:23:47 +0000 http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-136341 FWIW, the patch for CVE-2008-0058 did NOT resolve this issue for me. I'm having severe Safari crashes when behind an authenticating proxy. When on a network where the proxy isn't in play, Safari is much more reliable. Behind the proxy, I can trigger repeatable crashes just by visiting store.apple.com. FWIW, the patch for CVE-2008-0058 did NOT resolve this issue for me.

I’m having severe Safari crashes when behind an authenticating proxy. When on a network where the proxy isn’t in play, Safari is much more reliable. Behind the proxy, I can trigger repeatable crashes just by visiting store.apple.com.

]]> By: Daniel Jalkut http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-136130 Daniel Jalkut Tue, 18 Mar 2008 22:36:39 +0000 http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-136130 Awesome! They had told me they were looking into a fix but I wasn't sure when it would show up :) What great news. Awesome! They had told me they were looking into a fix but I wasn’t sure when it would show up :) What great news.

]]> By: heavyboots http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-136129 heavyboots Tue, 18 Mar 2008 21:34:31 +0000 http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-136129 Dude! Never mind, I think they got it in the security update AND they credited you! Foundation CVE-ID: CVE-2008-0058 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Visiting a maliciously crafted website may lead to a denial of service or arbitrary code execution Description: A thread race condition exists in NSURLConnection's cache management, which can cause a deallocated object to receive messages. Triggering this issue may lead to a denial of service, or arbitrary code execution with the privileges of Safari or another program using NSURLConnection. This update addresses the issue by removing an unsynchronized caching operation. This issue does not affect systems running Mac OS X v10.5 or later. Credit to Daniel Jalkut of Red Sweater Software for reporting this issue. Dude! Never mind, I think they got it in the security update AND they credited you!

Foundation

CVE-ID: CVE-2008-0058

Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11

Impact: Visiting a maliciously crafted website may lead to a denial of service or arbitrary code execution

Description: A thread race condition exists in NSURLConnection’s cache management, which can cause a deallocated object to receive messages. Triggering this issue may lead to a denial of service, or arbitrary code execution with the privileges of Safari or another program using NSURLConnection. This update addresses the issue by removing an unsynchronized caching operation. This issue does not affect systems running Mac OS X v10.5 or later. Credit to Daniel Jalkut of Red Sweater Software for reporting this issue.

]]> By: Daniel Jalkut http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-136125 Daniel Jalkut Tue, 18 Mar 2008 18:20:51 +0000 http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-136125 I dunno heavyboots. We can hope! Time will definitely tell... I dunno heavyboots. We can hope! Time will definitely tell…

]]> By: heavyboots http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-136124 heavyboots Tue, 18 Mar 2008 18:18:23 +0000 http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-136124 Just out of curiosity, do you know if the Safari 3.1 update snuck in a fix for this? Just out of curiosity, do you know if the Safari 3.1 update snuck in a fix for this?

]]> By: Mark http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-135750 Mark Sat, 02 Feb 2008 21:12:52 +0000 http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-135750 actually 2 min after I hit submit the entire thing went bang yet again. this is insane and needs to be fixed. M actually 2 min after I hit submit the entire thing went bang yet again. this is insane and needs to be fixed.

M

]]> By: Mark http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-135749 Mark Sat, 02 Feb 2008 21:07:57 +0000 http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-135749 Hi Finally had to bite the bullet and upgrade from 10.39 to 10.4 and really wishing I hadn't. Thanks for putting this up as I was starting wonder if my old G4 DP MDD 867 was getting too long in the tooth. Everything is crashing and safari barely runs!!! Feel like a PC user here... They'd better bloody fix it soon. M Hi

Finally had to bite the bullet and upgrade from 10.39 to 10.4 and really wishing I hadn’t.

Thanks for putting this up as I was starting wonder if my old G4 DP MDD 867 was getting too long in the tooth. Everything is crashing and safari barely runs!!!

Feel like a PC user here…

They’d better bloody fix it soon.

M

]]> By: Justin Miller http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-135706 Justin Miller Thu, 31 Jan 2008 14:20:09 +0000 http://www.red-sweater.com/blog/452/nsurlconnection-crashing-epidemic#comment-135706 <em>The developer of del.icio.us client Pukka has also documented this problem on his blog.</em> Tom beat me to it, but yes, I've seen some pretty regular crashing plaguing Leopard users (10.5 and 10.5.1) but nothing on Tiger yet. Mine is related to authentication over HTTPS and/or proxy servers. You can see this happening in Safari as well: http://bugs.webkit.org/show_bug.cgi?id=14159 The developer of del.icio.us client Pukka has also documented this problem on his blog.

Tom beat me to it, but yes, I’ve seen some pretty regular crashing plaguing Leopard users (10.5 and 10.5.1) but nothing on Tiger yet. Mine is related to authentication over HTTPS and/or proxy servers. You can see this happening in Safari as well:

http://bugs.webkit.org/show_bug.cgi?id=14159

]]>