|
Mac OS X Security Update Fixes Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA15227
|
|
|
Release Date:
|
2005-05-04
|
|
Last Update:
|
2005-05-17
|
|
Popularity:
|
17,365 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
Security Bypass
Spoofing
Exposure of sensitive information
Privilege escalation
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Apple Macintosh OS X
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
| | CVE reference: | CVE-2004-0687
CVE-2004-0688
CVE-2004-1051
CVE-2004-1307
CVE-2004-1308
CVE-2005-0342
CVE-2005-0594
CVE-2005-1330
CVE-2005-1331
CVE-2005-1332
CVE-2005-1333
CVE-2005-1335
CVE-2005-1336
CVE-2005-1337
CVE-2005-1338
CVE-2005-1339
CVE-2005-1340
CVE-2005-1341
CVE-2005-1342
CVE-2005-1343
CVE-2005-1344
|
|
Description:
Apple has issued a security update for Mac OS X, which fixes various vulnerabilities.
1) A boundary error in htdigest can be exploited to cause a buffer overflow by passing an overly long realm argument.
NOTE: htdigest is by default only locally accessible and not setuid / setgid.
2) An integer overflow error in the AppKit component when processing TIFF files can be exploited by malicious people to compromise a user's system.
For more information:
SA13607
3) An error in the AppKit component when parsing certain TIFF images can result in an invalid call to the "NXSeek()" function, which will crash an affected Cocoa application.
4) An error within the handling of AppleScript can be exploited to display code to a user that is different than the code, which will actually run.
5) An error in the Bluetooth support may cause Bluetooth-enabled systems to share files via the Bluetooth file exchange service without notifying the user properly.
6) An input validation error can be exploited to access arbitrary files on a Bluetooth-enabled system using directory traversal attacks via the Bluetooth file and object exchange services.
7) The chfn, chpass, and chsh utilities invoke certain external helper programs insecurely, which can be exploited by malicious, local users to gain escalated privileges.
8) A vulnerability in Finder can be exploited by malicious, local users to perform certain actions on a vulnerable system with escalated privileges due to insecure creation of ".DS_Store" files.
For more information:
SA14188
9) A boundary error within the Foundation framework when handling environment variables can be exploited to cause a buffer overflow and may allow execution of arbitrary code.
10) An error in Help Viewer can be exploited to run JavaScript without the normally imposed security restrictions.
11) A security issue in the LDAP functionality may under certain circumstances result in passwords initially being stored in plain text.
12) Errors within the parsing of XPM files can potentially be exploited by malicious people to compromise a vulnerable system.
For more information:
SA12549
13) An error in lukemftpd can be exploited by malicious users to bypass chroot restrictions. In order to restrict users to their home directory, both their full name and short name must be listed in the "/etc/ftpchroot" file. However, the problem is that users can change their full name and thereby bypass this restriction.
14) A boundary error in the Netinfo Setup Tool (NeST) when processing input passed to the "-target" command line parameter can be exploited by malicious, local users to cause a buffer overflow and execute arbitrary code with escalated privileges on a vulnerable system.
15) When enabling the HTTP proxy service in Server Admin, it is by default possible for everyone (including users on the Internet) to use the proxy service.
16) A vulnerability in sudo within the environment clearing can be exploited by malicious, local users to gain escalated privileges.
For more information:
SA13199
17) An error in the Terminal utility can be exploited to inject data via malicious input containing escape sequences in window titles.
18) An error in the Terminal utility can be exploited to inject commands into a user's Terminal session via malicious input containing escape characters in x-man-path URIs.
19) A boundary error in vpnd can be exploited by malicious, local users to cause a buffer overflow via an overly long Server_id parameter and execute arbitrary code with escalated privileges on systems configured as a VPN server.
Solution:
Apply Security Update 2005-005.
Security Update 2005-005 (Client):
http://www.apple.com/support/downloads/securityupdate2005005client.html
Security Update 2005-005 (Server):
http://www.apple.com/support/downloads/securityupdate2005005server.html
Provided and/or discovered by:
1) JxT
3) Henrik Dalgaard
4) David Remahl
5) Kevin Finisterre, digitalmunition.com.
6) Kevin Finisterre, digitalmunition.com.
10) David Remahl
13) Rob Griffiths
14) Nico
17) David Remahl
18) David Remahl
19) Jason Aras and Pieter de Boer
Changelog:
2005-05-05: Added link to additional iDEFENSE advisory.
2005-05-09: Added link to US-CERT vulnerability note.
2005-05-10: Added links to US-CERT vulnerability notes.
2005-05-17: Added links to US-CERT vulnerability notes.
Original Advisory:
Apple:
http://docs.info.apple.com/article.html?artnum=301528
David Remahl:
http://remahl.se/david/vuln/004/
http://remahl.se/david/vuln/010/
http://remahl.se/david/vuln/011/
http://remahl.se/david/vuln/012/
digitalmunition.com:
http://www.digitalmunition.com/DMA[2005-0502a].txt
iDEFENSE:
http://www.idefense.com/application/poi/display?id=239&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=240&type=vulnerabilities
Other References:
SA12549:
http://secunia.com/advisories/12549/
SA13199:
http://secunia.com/advisories/13199/
SA13607:
http://secunia.com/advisories/13607/
SA14188:
http://secunia.com/advisories/14188/
US-CERT VU#140470:
http://www.kb.cert.org/vuls/id/140470
US-CERT VU#145486:
http://www.kb.cert.org/vuls/id/145486
US-CERT VU#258390:
http://www.kb.cert.org/vuls/id/258390
US-CERT VU#331694:
http://www.kb.cert.org/vuls/id/331694
US-CERT VU#354486:
http://www.kb.cert.org/vuls/id/354486
US-CERT VU#356070:
http://www.kb.cert.org/vuls/id/356070
US-CERT VU#582934:
http://www.kb.cert.org/vuls/id/582934
US-CERT VU#706838:
http://www.kb.cert.org/vuls/id/706838
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
Today
|
New advisories:
|
18 |
|
New vulnerabilities:
|
50 |
|
Updated advisories:
|
25 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
 Solutions | More...
|
|
