Apple Mac OS X Security Update Locks PGP Customers Out

PGP Whole Disk Encryption customers found themselves locked out of their computers when they tried to apply the latest Mac OS X security update.

A massive security update from Apple plugged more than 130 Mac OS X security holes but left users of PGP's whole disk encryption product locked out of their systems.

Wednesday, customers of PGP, now a division at Symantec, reported being unable to boot their computers after upgrading to Mac OS X 10.6.5. Later that day, PGP posted a warning to its customers using Mac Whole Disk Encryption (MAC WDE) urging them not to upgrade.

In a statement today, Symantec explained to eWEEK that the Apple update released a new version of the boot.efi file that overwrites the previous edition of the file used by PGP Whole Disk Encryption. As a result, the user's machine skips the preboot authentication step, effectively preventing the disk from being unlocked prior to boot. The data on the disk, however, is still recoverable, the company said.

"If the update to OS X 10.6.5 has already been made and the machine fails to boot, the data on the machine is not lost," according to Symantec. "The system can be restored using the PGP Recovery CD. Instructions can be found in this Knowledgebase Article.

"This appears to be the first time Apple has modified boot.efi in a minor update, and Symantec is adjusting test procedures accordingly to help avoid this issue in the future," the company added. 

Details on Apple's massive update are available here. Fifty-five of the bugs patched by Apple actually were in a non-Apple product-Adobe Flash Player-which in a way could add ammunition to the public war of the words that has waged between Adobe Systems and Apple during the past several months. A few weeks ago, Apple MacBook Air shipped without Flash.

"Apple provides its own version of the Flash plug-in, and dropping the need to update it shifts the responsibility to Adobe, and frees Apple from having to worry about these flaws, and from providing them in security updates," said Peter James, global spokesperson for Mac-focused security company Intego.

Besides Flash, the other fixes span a variety of areas, including 16 patches for X11, Apple's implementation of the X Window System that makes it possible to run X11-based applications in Mac OS X. Nine other fixes impact QuickTime-all of which could be used to run arbitrary code if successful exploited.

"Many of the flaws fixed are quite serious: There is a file sharing flaw, a couple of PDF bugs and a large number of QuickTime vulnerabilities that are fixed in this update," James said.