PGP Whole Disk Encryption customers found themselves locked out of their computers when they tried to apply the latest Mac OS X security update.
A massive security update from Apple plugged more than 130 Mac OS X security
holes but left users of PGP's whole disk encryption product locked out of their
Wednesday, customers of PGP, now a division at Symantec, reported being
unable to boot their computers after upgrading to Mac OS X 10.6.5. Later that
day, PGP posted
a warning to its customers
using Mac Whole Disk Encryption (MAC
WDE) urging them not to upgrade.
In a statement today, Symantec explained to eWEEK that the Apple update
released a new version of the boot.efi file that overwrites the previous
edition of the file used by PGP Whole Disk Encryption. As a result, the user's
machine skips the preboot authentication step, effectively preventing the disk
from being unlocked prior to boot. The data on the disk, however, is still
recoverable, the company said.
"If the update to OS X 10.6.5 has already been made and the machine
fails to boot, the data on the machine is not lost," according to
Symantec. "The system can be restored using the PGP Recovery CD.
Instructions can be found in this Knowledgebase
"This appears to be the first time Apple has modified boot.efi in a
minor update, and Symantec is adjusting test procedures accordingly to help
avoid this issue in the future," the company added.
Details on Apple's massive update are available here
. Fifty-five of the bugs patched by Apple
actually were in a non-Apple product-Adobe Flash Player-which in a way
could add ammunition to the public war of the words that has waged
between Adobe Systems and Apple during the past several months. A few
weeks ago, Apple MacBook Air shipped without Flash.
"Apple provides its own version of the Flash plug-in, and dropping the
need to update it shifts the responsibility to Adobe, and frees Apple from
having to worry about these flaws, and from providing them in security updates,"
said Peter James, global spokesperson for Mac-focused security company Intego.
Besides Flash, the other fixes span a variety of areas, including
16 patches for X11, Apple's implementation of the X Window System that
makes it possible to run X11-based applications in Mac OS X. Nine other
fixes impact QuickTime-all of which could be used to run arbitrary code if
"Many of the flaws fixed are quite serious: There is a file sharing
flaw, a couple of PDF bugs and a large number of QuickTime vulnerabilities that
are fixed in this update," James said.