By Katie Marsal

Published: 06:00 PM EST (03:00 PM PST)

Apple Computer on Tuesday clamped down on a number of vulnerabilities in its Mac OS X operating system that could pose as backdoors for hackers or malicious users.

In a recommended security release labeled Security Update 2006-004 -- the fourth such update this year -- Apple said it tightened loose ends in AFP Server, Bluetooth, Bom, DHCP, dyld, fetchmail, gnuzip, ImageIO, LaunchServices, OpenSSH, telnet and WebKit.

In particular, the update improves Bluetooth Setup Assistant by increasing the length of the automatically generated pairing passkey from six characters to eight characters. It also adds additional checks to prevent against maliciously-crafted GIF, TIFF, Radiance or Canon RAW images that could lead to application crashes and arbitrary code execution.

Similarly, Apple increased preventative measures surrounding maliciously-crafted: Zip archives, BOOTP requests, TELNET servers and HTML documents. It also patched a vulnerability where an attacker attempting to log in to an OpenSSH server with a nonexistent account could causes the authentication process to hang. "An attacker can exploit this behavior to detect the existence of a particular account," Apple said. "A large number of such attempts may lead to a denial of service."

Another improvement focuses on Safari's ability to detect safe files from those that could potentially include malicious JavaScript files. Previous versions of the browser may have erroneously identified certain files containing HTML as "safe". If such a file is downloaded in Safari and Safari's "Open `safe' files after downloading option is enabled, the HTML document would automatically be opened from a local URI. "This would allow any JavaScript code embedded in the document to bypass access restrictions normally imposed on remote content," Apple explained. "This update provides additional checks to identify potentially malicious file types so that they are not automatically opened."

Other security improvements in Security Update 2006-004 target access loopholes in File Sharing and a vulnerability in the Mac OS X dynamic loader where malicious local users could influence the loading of dynamic libraries in order to gain elevated privileges.

A complete list of security enhancements is available through Apple's support site.