Apple has issued a security update for Mac OS X, which fixes various vulnerabilities.

1) A boundary error in htdigest can be exploited to cause a buffer overflow by passing an overly long realm argument.

NOTE: htdigest is by default only locally accessible and not setuid / setgid.

2) An integer overflow error in the AppKit component when processing TIFF files can be exploited by malicious people to compromise a user's system.

For more information:
SA13607

3) An error in the AppKit component when parsing certain TIFF images can result in an invalid call to the "NXSeek()" function, which will crash an affected Cocoa application.

4) An error within the handling of AppleScript can be exploited to display code to a user that is different than the code, which will actually run.

5) An error in the Bluetooth support may cause Bluetooth-enabled systems to share files via the Bluetooth file exchange service without notifying the user properly.

6) An input validation error can be exploited to access arbitrary files on a Bluetooth-enabled system using directory traversal attacks via the Bluetooth file and object exchange services.

7) The chfn, chpass, and chsh utilities invoke certain external helper programs insecurely, which can be exploited by malicious, local users to gain escalated privileges.

8) A vulnerability in Finder can be exploited by malicious, local users to perform certain actions on a vulnerable system with escalated privileges due to insecure creation of ".DS_Store" files.

For more information:
SA14188

9) A boundary error within the Foundation framework when handling environment variables can be exploited to cause a buffer overflow and may allow execution of arbitrary code.

10) An error in Help Viewer can be exploited to run JavaScript without the normally imposed security restrictions.

11) A security issue in the LDAP functionality may under certain circumstances result in passwords initially being stored in plain text.

12) Errors within the parsing of XPM files can potentially be exploited by malicious people to compromise a vulnerable system.

For more information:
SA12549

13) An error in lukemftpd can be exploited by malicious users to bypass chroot restrictions. In order to restrict users to their home directory, both their full name and short name must be listed in the "/etc/ftpchroot" file. However, the problem is that users can change their full name and thereby bypass this restriction.

14) A boundary error in the Netinfo Setup Tool (NeST) when processing input passed to the "-target" command line parameter can be exploited by malicious, local users to cause a buffer overflow and execute arbitrary code with escalated privileges on a vulnerable system.

15) When enabling the HTTP proxy service in Server Admin, it is by default possible for everyone (including users on the Internet) to use the proxy service.

16) A vulnerability in sudo within the environment clearing can be exploited by malicious, local users to gain escalated privileges.

For more information:
SA13199

17) An error in the Terminal utility can be exploited to inject data via malicious input containing escape sequences in window titles.

18) An error in the Terminal utility can be exploited to inject commands into a user's Terminal session via malicious input containing escape characters in x-man-path URIs.

19) A boundary error in vpnd can be exploited by malicious, local users to cause a buffer overflow via an overly long Server_id parameter and execute arbitrary code with escalated privileges on systems configured as a VPN server.

Solution
Apply Security Update 2005-005.
Further details available to Secunia VIM customers

Provided and/or discovered by
1) JxT
3) Henrik Dalgaard
4) David Remahl
5) Kevin Finisterre, digitalmunition.com.
6) Kevin Finisterre, digitalmunition.com.
10) David Remahl
13) Rob Griffiths
14) Nico
17) David Remahl
18) David Remahl
19) Jason Aras and Pieter de Boer

Changelog
Further details available to Secunia VIM customers

Original Advisory
Apple:
http://docs.info.apple.com/article.html?artnum=301528

David Remahl:
http://remahl.se/david/vuln/004/
http://remahl.se/david/vuln/010/
http://remahl.se/david/vuln/011/
http://remahl.se/david/vuln/012/

digitalmunition.com:
http://www.digitalmunition.com/DMA[2005-0502a].txt

iDEFENSE:
http://www.idefense.com/application/poi/display?id=239&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=240&type=vulnerabilities

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers