Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
Database
Search
Advisories by Product
Advisories by Vendor
Terminology
Report Vulnerability
Insecure Library Loading
Highly critical

Mac OS X Security Update Fixes Multiple Vulnerabilities

-

Release Date:  2005-05-04    Last Update:  2005-05-17    Views:  26,939

Secunia Advisory SA15227

Where:

From remote

Impact:

Security Bypass, Spoofing, Exposure of sensitive information, Privilege escalation, System access

Solution Status:

Vendor Patch

Operating System:

CVE Reference(s):

Description


Apple has issued a security update for Mac OS X, which fixes various vulnerabilities.

1) A boundary error in htdigest can be exploited to cause a buffer overflow by passing an overly long realm argument.

NOTE: htdigest is by default only locally accessible and not setuid / setgid.

2) An integer overflow error in the AppKit component when processing TIFF files can be exploited by malicious people to compromise a user's system.

For more information:
SA13607

3) An error in the AppKit component when parsing certain TIFF images can result in an invalid call to the "NXSeek()" function, which will crash an affected Cocoa application.

4) An error within the handling of AppleScript can be exploited to display code to a user that is different than the code, which will actually run.

5) An error in the Bluetooth support may cause Bluetooth-enabled systems to share files via the Bluetooth file exchange service without notifying the user properly.

6) An input validation error can be exploited to access arbitrary files on a Bluetooth-enabled system using directory traversal attacks via the Bluetooth file and object exchange services.

7) The chfn, chpass, and chsh utilities invoke certain external helper programs insecurely, which can be exploited by malicious, local users to gain escalated privileges.

8) A vulnerability in Finder can be exploited by malicious, local users to perform certain actions on a vulnerable system with escalated privileges due to insecure creation of ".DS_Store" files.

For more information:
SA14188

9) A boundary error within the Foundation framework when handling environment variables can be exploited to cause a buffer overflow and may allow execution of arbitrary code.

10) An error in Help Viewer can be exploited to run JavaScript without the normally imposed security restrictions.

11) A security issue in the LDAP functionality may under certain circumstances result in passwords initially being stored in plain text.

12) Errors within the parsing of XPM files can potentially be exploited by malicious people to compromise a vulnerable system.

For more information:
SA12549

13) An error in lukemftpd can be exploited by malicious users to bypass chroot restrictions. In order to restrict users to their home directory, both their full name and short name must be listed in the "/etc/ftpchroot" file. However, the problem is that users can change their full name and thereby bypass this restriction.

14) A boundary error in the Netinfo Setup Tool (NeST) when processing input passed to the "-target" command line parameter can be exploited by malicious, local users to cause a buffer overflow and execute arbitrary code with escalated privileges on a vulnerable system.

15) When enabling the HTTP proxy service in Server Admin, it is by default possible for everyone (including users on the Internet) to use the proxy service.

16) A vulnerability in sudo within the environment clearing can be exploited by malicious, local users to gain escalated privileges.

For more information:
SA13199

17) An error in the Terminal utility can be exploited to inject data via malicious input containing escape sequences in window titles.

18) An error in the Terminal utility can be exploited to inject commands into a user's Terminal session via malicious input containing escape characters in x-man-path URIs.

19) A boundary error in vpnd can be exploited by malicious, local users to cause a buffer overflow via an overly long Server_id parameter and execute arbitrary code with escalated privileges on systems configured as a VPN server.


Solution:
Apply Security Update 2005-005.

Further details available to Secunia VIM customers

Provided and/or discovered by:
1) JxT
3) Henrik Dalgaard
4) David Remahl
5) Kevin Finisterre, digitalmunition.com.
6) Kevin Finisterre, digitalmunition.com.
10) David Remahl
13) Rob Griffiths
14) Nico
17) David Remahl
18) David Remahl
19) Jason Aras and Pieter de Boer

Original Advisory:
Apple:
http://docs.info.apple.com/article.html?artnum=301528

David Remahl:
http://remahl.se/david/vuln/004/
http://remahl.se/david/vuln/010/
http://remahl.se/david/vuln/011/
http://remahl.se/david/vuln/012/

digitalmunition.com:
http://www.digitalmunition.com/DMA[2005-0502a].txt

iDEFENSE:
http://www.idefense.com/application/poi/display?id=239&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=240&type=vulnerabilities

Deep Links:
Links available to Secunia VIM customers

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: Mac OS X Security Update Fixes Multiple Vulnerabilities

No posts yet

-

You must be logged in to post a comment.



 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Factsheets
Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability