|
 |
|
Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
|
|
|
|
|
Secunia Advisory:
|
SA28136
|
|
|
Release Date:
|
2007-12-18
|
|
Last Update:
|
2007-12-24
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
Hijacking
Security Bypass
Cross Site Scripting
Exposure of system information
Exposure of sensitive information
Privilege escalation
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Apple Macintosh OS X
|
|
| | CVE reference: | CVE-2006-0024 (Secunia mirror)
CVE-2007-1218 (Secunia mirror)
CVE-2007-1659 (Secunia mirror)
CVE-2007-1660 (Secunia mirror)
CVE-2007-1661 (Secunia mirror)
CVE-2007-1662 (Secunia mirror)
CVE-2007-3798 (Secunia mirror)
CVE-2007-3876 (Secunia mirror)
CVE-2007-4131 (Secunia mirror)
CVE-2007-4351 (Secunia mirror)
CVE-2007-4572 (Secunia mirror)
CVE-2007-4708 (Secunia mirror)
CVE-2007-4709 (Secunia mirror)
CVE-2007-4710 (Secunia mirror)
CVE-2007-4766 (Secunia mirror)
CVE-2007-4767 (Secunia mirror)
CVE-2007-4768 (Secunia mirror)
CVE-2007-4965 (Secunia mirror)
CVE-2007-5379 (Secunia mirror)
CVE-2007-5380 (Secunia mirror)
CVE-2007-5398 (Secunia mirror)
CVE-2007-5476 (Secunia mirror)
CVE-2007-5770 (Secunia mirror)
CVE-2007-5847 (Secunia mirror)
CVE-2007-5848 (Secunia mirror)
CVE-2007-5849 (Secunia mirror)
CVE-2007-5858 (Secunia mirror)
CVE-2007-5850 (Secunia mirror)
CVE-2007-5851 (Secunia mirror)
CVE-2007-5853 (Secunia mirror)
CVE-2007-5854 (Secunia mirror)
CVE-2007-5855 (Secunia mirror)
CVE-2007-5856 (Secunia mirror)
CVE-2007-5857 (Secunia mirror)
CVE-2007-5859 (Secunia mirror)
CVE-2007-5860 (Secunia mirror)
CVE-2007-5861 (Secunia mirror)
CVE-2007-5863 (Secunia mirror)
CVE-2007-6077 (Secunia mirror)
CVE-2007-6165 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
Apple has issued a security update for Mac OS X, which fixes multiple vulnerabilities.
1) A format string error in the URL handler of Address Book can be exploited to execute arbitrary code when a user views a specially crafted web page.
2) An error in the handling of downloaded files in CFNetwork can be exploited via directory traversal attacks to automatically download files to arbitrary folders when a user is enticed to visit a specially crafted web page.
3) An unspecified error exists in ColorSync when processing images with an embedded ColorSync profile, which can be exploited to cause a memory corruption.
Successful exploitation may allow execution of arbitrary code.
4) A race condition exists in the "CFURLWriteDataAndPropertiesToResource" API, which can lead to files being created with insecure permissions.
5) A boundary error exists in the printer driver for CUPS. This can be exploited to cause a buffer overflow and allows an admin user to execute arbitrary code with system privileges by passing a specially crafted URI to the CUPS service.
6) A boundary error in CUPS can be exploited by malicious people to compromise a vulnerable system.
For more information:
SA27233
7) An integer underflow error in the CUPS backend in the handling of SNMP responses can be exploited to cause a stack-based buffer overflow by sending a specially crafted SNMP response.
Successful exploitation allows execution of arbitrary code, but requires that SNMP is enabled.
8) A boundary error in Desktop Services can be exploited to cause a heap-based buffer overflow when a user opens a directory containing a specially crafted .DS_Store file.
Successful exploitation may allow execution of arbitrary code.
9) An input validation error in tar can be exploited by malicious people to compromise a user's system.
For more information:
SA26573
10) An unspecified error in iChat can be exploited by malicious people on the local network to initiate a video connection without the user's approval.
11) An unspecified error exists within IO Storage Family when handling GUID partition maps within a disk image. This can be exploited to execute arbitrary code when a user is enticed to open a specially crafted disk image.
12) Launch Services does not handle HTML files as potentially unsafe content. This can be exploited to disclose sensitive information or conduct cross-site scripting attacks by enticing a user to open a specially crafted HTML file.
13) A vulnerability in Mail in the handling of unsafe file types can be exploited to compromise a user's system.
For more information:
SA27785
14) An error in Mail can cause the application to default to SMTP plaintext authentication if the server supports only MD5 Challenge-Response authentication and plaintext authentication.
15) Some vulnerabilities in perl can be exploited by malicious people to compromise a vulnerable system.
For more information:
SA27546
16) A security issue in python can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.
For more information:
SA26837
17) Plug-ins in Quick Look are not restricted from making network requests. This may lead to the disclosure of sensitive information when previewing an HTML file.
18) URLs contained in movie files may be accessed when creating an icon for a movie file or previewing a movie file using QuickLook.
19) Some security issues in ruby can be exploited by malicious people to conduct spoofing attacks.
For more information:
SA26985
20) Some vulnerabilities and a security issue in Ruby on Rails can be exploited by malicious people to disclose sensitive information or to conduct session fixation attacks.
For more information:
SA25699
SA27781
21) An error in Safari allows a page to navigate the subframes of any other page. This can be exploited to conduct cross-site scripting attacks and to disclose sensitive information when a user visits a specially crafted web page.
22) An unspecified error in Safari in the handling of RSS feeds can be exploited to cause a memory corruption and may allow execution of arbitrary code when a user accesses a specially crafted URL.
23) Some boundary errors in Samba can be exploited by malicious people to compromise a vulnerable system.
For more information:
SA27450
24) Some boundary errors in the Shockwave Plug-in can be exploited by malicious people to compromise a user's system.
For more information:
SA19218
25) A boundary error in the processing of command line arguments to "mount_smbfs" and "smbutil" can be exploited to cause a stack-based buffer overflow and execute arbitrary code with system privileges.
26) The distribution definition file used in Software Update is received by using HTTP without any authentication and allows execution of arbitrary commands.
Successful exploitation requires a MitM (Man-in-the-Middle) attack.
27) An error due to an insecure file operation exists in the handling of output files in SpinTracer. This may allow a malicious, local user to execute arbitrary code with system privileges.
28) An unspecified error exists in the Microsoft Office Spotlight Importer, which can be exploited to cause a memory corruption when a user downloads a specially crafted .xls file.
Successful exploitation may allow execution of arbitrary code.
29) Some vulnerabilities in tcpdump can be exploited by malicious people to cause a DoS or to compromise a user's system.
For more information:
SA24318
SA26135
30) Some vulnerabilities exist the Perl Compatible Regular Expressions (PCRE) library used by XQuery, which can potentially be exploited to compromise a vulnerable system.
For more information:
SA27543
Solution:
Apply Security Update 2007-009 v1.1.
Security Update 2007-009 1.1 (10.4.11 Universal):
http://www.apple.com/support/download...ityupdate20070091110411universal.html
Security Update 2007-009 1.1 (10.4.11 PPC):
http://www.apple.com/support/downloads/securityupdate20070091110411ppc.html
Security Update 2007-009 1.1 (10.5.1):
http://www.apple.com/support/downloads/securityupdate2007009111051.html
Provided and/or discovered by:
2) The vendor credits Sean Harding.
3) The vendor credits Tom Ferris, Adobe Secure Software Engineering Team (ASSET).
5) The vendor credits Dave Camp, Critical Path Software.
7) The vendor credits Wei Wang, McAfee Avert Labs.
12) The vendor credits Michal Zalewski, Google Inc.
13) The vendor credits Xeno Kovah, originally reported in Mac OS X 10.5 by heise Security.
15) The vendor credits Tavis Ormandy and Will Drewry, Google Security Team.
18) The vendor credits Lukhnos D. Liu, Lithoglyph Inc.
25) Sean Larsson, VeriSign iDefense Labs.
26) Moritz Jodeit.
27) The vendor credits Kevin Finisterre, DigitalMunition.
Changelog:
2007-12-19: Added link to iDefense Labs. Updated credits section. Added link to US-CERT.
2007-12-24: Vendor issues updated patches as previous patches caused Safari to crash. Updated "Solution" section.
Original Advisory:
Apple:
http://docs.info.apple.com/article.html?artnum=307179
http://docs.info.apple.com/article.html?artnum=307224
iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=633
Other References:
SA19218:
http://secunia.com/advisories/19218/
SA24318:
http://secunia.com/advisories/24318/
SA25699:
http://secunia.com/advisories/25699/
SA26135:
http://secunia.com/advisories/26135/
SA26573:
http://secunia.com/advisories/26573/
SA26837:
http://secunia.com/advisories/26837/
SA26985:
http://secunia.com/advisories/26985/
SA27233:
http://secunia.com/advisories/27233/
SA27450:
http://secunia.com/advisories/27450/
SA27543:
http://secunia.com/advisories/27543/
SA27546:
http://secunia.com/advisories/27546/
SA27781:
http://secunia.com/advisories/27781/
SA27785:
http://secunia.com/advisories/27785/
US-CERT VU#905292:
http://www.kb.cert.org/vuls/id/905292
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
125 Related Secunia Security Advisories, displaying 10
|
|
|
1. Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
|
|
2. Apple Mac OS X ARDAgent Privilege Escalation Vulnerability
|
|
3. Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
|
|
4. Apple iCal Memory Corruption Vulnerability
|
|
5. Mac OS X Security Update Fixes Multiple Vulnerabilities
|
|
6. Apple Mac OS X "ipcomp6_input()" Denial of Service
|
|
7. Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
|
|
8. Mac OS X Java Multiple Vulnerabilities
|
|
9. Mac OS X "cs_validate_page()" Local Denial of Service
|
|
10. Mac OS X vpnd Denial of Service Vulnerability
|
Show all related advisories
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
|
|
Secunia PSI
Scan | Patch | Track
Free Download
|
|
|
Secunia Poll
|
|
|
|
|
 |
|
|
Most Popular Advisories
|
|
|
|
|
|
