Feeling left out because those Windows users seem to get all the good security holes? Sure, Apple issues "Security Updates" every once in a while, but really, when was the last time a Mac security flaw led to global disruption and billions of dollars' worth of lost productivity? Exactly. We Mac users sort of get the short end of the stick in this whole deal.

Well, it may not be the Blaster worm or anything, but faithful viewer William Carrel still gives us something we can give thanks for: he's publicized a "new" Mac OS X security hole over at Carrel.org which is slightly more exciting than the ones we typically see: apparently a "malicious DHCP response can grant root access" to clever evildoers, which, as you probably know, means that they could do pretty much anything to your Mac that they want, short of painting it red with a cool flame on the side. (More's the pity-- wouldn't that look bitchin'?)

Most of the lame Mac OS X security flaws we hear about aren't so serious as to allow root access to a Mac, especially without requiring physical access to the keyboard, so this latest advisory is already more exciting than usual. But get this: on top of potentially handing the Bad Guys the proverbial keys to the castle (as new Windows flaws do four or five times a month), this DHCP hole is reportedly present and wide open with default settings under Panther and Jaguar (both regular and Server versions), and probably earlier versions of Mac OS X as well. It's not quite Microsoftian in scale, but it's getting closer. Hooray for progress!

For what it's worth, exploiting the hole requires the Black Hats to run a DHCP server on a network reachable by your Mac, so this is apparently mostly an issue for people with AirPort cards or connected to large local networks. We're sure a fix from Apple is coming (although William waited 48 days after telling Apple about the hole before finally spreading the word himself), but in the meantime read the advisory for several workarounds that can protect you. They take literally about twenty seconds and maybe fifteen mouse clicks to perform. And just be thankful there isn't even any typing involved, lazybones.