|
 |
|
Mac OS X Security Update Fixes Multiple Vulnerabilities
|
|
|
|
|
Secunia Advisory:
|
SA19064
|
|
|
Release Date:
|
2006-03-02
|
|
Last Update:
|
2006-03-06
|
|
|
Critical:
|
Extremely critical
|
|
Impact:
|
Security Bypass
Cross Site Scripting
Privilege escalation
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Apple Macintosh OS X
|
|
| | CVE reference: | CVE-2005-2713 (Secunia mirror)
CVE-2005-2714 (Secunia mirror)
CVE-2005-3319 (Secunia mirror)
CVE-2005-3353 (Secunia mirror)
CVE-2005-3391 (Secunia mirror)
CVE-2005-3392 (Secunia mirror)
CVE-2005-3706 (Secunia mirror)
CVE-2005-3712 (Secunia mirror)
CVE-2005-4217 (Secunia mirror)
CVE-2005-4504 (Secunia mirror)
CVE-2006-0383 (Secunia mirror)
CVE-2006-0384 (Secunia mirror)
CVE-2006-0386 (Secunia mirror)
CVE-2006-0387 (Secunia mirror)
CVE-2006-0388 (Secunia mirror)
CVE-2006-0389 (Secunia mirror)
CVE-2006-0390 (Secunia mirror)
CVE-2006-0391 (Secunia mirror)
CVE-2006-0394 (Secunia mirror)
CVE-2006-0395 (Secunia mirror)
|
|
|
Want to know the next time vulnerabilities are fixed in this product?
- Companies can be alerted via email and SMS! |
|
|
Description:
Apple has issued a security update for Mac OS X, which fixes multiple vulnerabilities.
1) Various security issues exist in the PHP Apache module and scripting environment.
For more information:
SA17371
2) An error in automount makes it possible for malicious file servers to cause a vulnerable system to mount file systems with reserved names, which can cause a DoS (Denial of Service) or potentially allow arbitrary code execution.
3) An input validation error in the BOM framework when unpacking certain archives can be exploited to cause files to be unpacked to arbitrary locations and overwrite files via directory traversal attacks.
4) The "passwd" program, when used with the "-i" parameter, allows the creation of files in arbitrary locations with "root" privileges. The created file can potentially have insecure file permissions due to "passwd" failing to set the umask. This can be exploited via symlink attacks to create or overwrite arbitrary files.
5) User directories are insecurely mounted when a FileVault image is created, which may allow unauthorised access to files.
6) An error in IPSec when handling certain error conditions can be exploited to cause a DoS against VPN connections.
7) An integer overflow error in the "vm_allocate()" syscall in the LibSystem component can be exploited by malicious people to cause a heap-based buffer overflow via applications when requesting large amounts of memory. This can potentially be exploited to execute arbitrary code in the context of a vulnerable application.
8) The "Download Validation" in the Mail component fails to warn users about unsafe file types when an e-mail attachment is double-clicked.
9) In certain cases a Perl program may fail to drop privileges.
For more information:
SA17922
10) A boundary error in rsync can be exploited by authenticated users to cause a heap-based buffer overflow when it's allowed to transfer extended attributes. This can be exploited to crash the rsync service or execute arbitrary code.
11) A boundary error in WebKit's handling of certain HTML can be exploited to cause a heap-based buffer overflow. This can be exploited via a malicious web site to execute arbitrary code on a user's system.
12) A boundary error in Safari when parsing JavaScript can be exploited to cause a stack-based buffer overflow and allows execution of arbitrary code when a malicious web page including specially crafted JavaScript is viewed.
13) An error in Safari's security model when handling HTTP redirection can be exploited to execute JavaScript in the local domain via a specially crafted web site.
14) An error in Safari / LaunchServices may cause a malicious application to appear as a safe file type. This may cause a malicious file to be executed automatically when the "Open safe files after downloading" option is enabled.
This vulnerability is related to:
SA18963
15) An input validation error in the Syndication (Safari RSS) component can be exploited to conduct cross-site scripting attacks when subscribing to malicious RSS content.
Solution:
Apply Security Update 2006-001.
Mac OS X 10.4.5 (PPC):
http://www.apple.com/support/downloads/securityupdate2006001macosx1045ppc.html
Mac OS X 10.4.5 Client (Intel):
http://www.apple.com/support/download...date2006001macosx1045clientintel.html
Mac OS X 10.3.9 Client:
http://www.apple.com/support/downloads/securityupdate20060011039client.html
Mac OS X 10.3.9 Server:
http://www.apple.com/support/downloads/securityupdate20060011039server.html
Provided and/or discovered by:
3) The vendor credits Stéphane Kardas, CERTA. The vulnerability was also discovered by an anonymous person and reported via iDEFENSE.
4) Vade 79 (the vendor also credits Ilja van Sprundel).
6) The vendor credits OUSPG from the University of Oulu, NISCC, and CERT-FI.
7) The vendor credits Neil Archibald, Suresec LTD.
10) The vendor credits Jan-Derk Bakker.
11) The vendor credits Suresec LTD.
Changelog:
2006-03-03: Added additional information from iDEFENSE.
2006-03-06: Added additional information from Suresec LTD. Updated "Description" and "Original Advisory" sections.
Original Advisory:
Apple:
http://docs.info.apple.com/article.html?artnum=303382
Vade79:
http://fakehalo.us/xosx-passwd.pl
iDEFENSE:
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=399
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=400
Suresec LTD:
http://www.suresec.org/advisories/adv10.pdf
http://www.suresec.org/advisories/adv11.pdf
Other References:
SA18963:
http://secunia.com/advisories/18963/
SA17922:
http://secunia.com/advisories/17922/
SA17371:
http://secunia.com/advisories/17371/
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
121 Related Secunia Security Advisories, displaying 10
|
|
|
1. Mac OS X Security Update Fixes Multiple Vulnerabilities
|
|
2. Apple Mac OS X "ipcomp6_input()" Denial of Service
|
|
3. Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
|
|
4. Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
|
|
5. Mac OS X Java Multiple Vulnerabilities
|
|
6. Mac OS X "cs_validate_page()" Local Denial of Service
|
|
7. Mac OS X vpnd Denial of Service Vulnerability
|
|
8. Mac OS X Local Denial of Service Vulnerability
|
|
9. Apple Mail Command Execution Vulnerability
|
|
10. Apple Mac OS X Application Firewall Weaknesses and Security Issue
|
Show all related advisories
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
|
|
Secunia PSI
Scan | Patch | Track
Free Download
|
|
|
Secunia Poll
|
|
|
|
|
 |
|
|
Most Popular Advisories
|
|
|
|
|
|
