|
|
|
|
Mac OS X Security Update Fixes Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA26235
|
|
|
Release Date:
|
2007-08-01
|
|
Last Update:
|
2007-08-08
|
|
Popularity:
|
9,425 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
Security Bypass
Cross Site Scripting
Spoofing
Manipulation of data
Exposure of sensitive information
Privilege escalation
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Vendor Patch
|
|
| OS: | Apple Macintosh OS X
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
| | CVE reference: | CVE-2004-0996
CVE-2004-2541
CVE-2005-0758
CVE-2005-3128
CVE-2006-2842
CVE-2006-3174
CVE-2006-4019
CVE-2006-6142
CVE-2007-0450
CVE-2007-0478
CVE-2007-1001
CVE-2007-1262
CVE-2007-1358
CVE-2007-1460
CVE-2007-1461
CVE-2007-1484
CVE-2007-1521
CVE-2007-1583
CVE-2007-1711
CVE-2007-1717
CVE-2007-1860
CVE-2007-2403
CVE-2007-2404
CVE-2007-2405
CVE-2007-2406
CVE-2007-2407
CVE-2007-2408
CVE-2007-2409
CVE-2007-2410
CVE-2007-2442
CVE-2007-2443
CVE-2007-2446
CVE-2007-2447
CVE-2007-2589
CVE-2007-2798
CVE-2007-3742
CVE-2007-3744
CVE-2007-3745
CVE-2007-3746
CVE-2007-3747
CVE-2007-3748
CVE-2007-3944
|
|
Description:
Apple has issued a security update for Mac OS X, which fixes multiple vulnerabilities.
1) An error within the handling of FTP URIs in CFNetwork can be exploited to run arbitrary FTP commands in context of the user's FTP client, when a user is enticed to click on a specially crafted FTP URI.
2) An input validation error can cause applications using CFNetwork to become vulnerable to HTTP response splitting attacks.
3) A design error exists in the Java interface to CoreAudio, which can be exploited to free arbitrary memory, when a user is enticed to visit a web site containing a specially crafted Java applet.
4) An unspecified error exists in the Java interface to CoreAudio, which can be exploited to read or write out of bounds of the allocated heap by enticing a user to visit a web site containing a specially crafted Java applet.
5) A unspecified error exists in the Java interface to CoreAudio, which can be exploited to instantiate or manipulate objects outside the bounds of the allocated heap, when a user is enticed to visit a web site containing a specially crafted Java applet.
Successful exploitation of vulnerabilities #3 to #5 may allow arbitrary code execution.
6) Two vulnerabilities in cscope can be exploited by malicious, local users to perform certain actions on a vulnerable system with escalated privileges and by malicious people to potentially compromise a user's system.
For more information:
SA13237
7) A boundary error within the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) code in iChat can be exploited on the local network to crash the application or to execute arbitrary code, by sending a specially crafted packet.
8) Some vulnerabilities in Kerberos can be exploited by malicious users and malicious people to compromise a vulnerable system.
For more information:
SA25800
9) A boundary error exists within the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) code in mDNSResponder. This can be exploited on the local network to cause a heap-based buffer overflow by sending a specially crafted packet.
Successful exploitation allows execution of arbitrary code with root privileges.
10) An integer underflow exists in PDFKit within the handling of PDF files in Preview and may be exploited to execute arbitrary code when a user opens a specially crafted PDF file.
11) Multiple vulnerabilities exist in PHP, which can be exploited to disclose potentially sensitive information, to cause a DoS (Denial of Service), to bypass certain security restrictions, to conduct cross-site scripting attacks, or to compromise a vulnerable system.
For more information:
SA24814
SA24356
SA24440
SA24505
SA24542
SA25123
12) An error exists in Quartz Composer due to an uninitialized object pointer when handling Quartz Composer files and may be exploited to execute arbitrary code when a specially crafted Quartz Composer file is viewed.
13) Some vulnerabilities exist in Samba, which can be exploited by malicious people to compromise a vulnerable system.
For more information:
SA25232
14) An unspecified error in Samba can be exploited to bypass file system quotas.
15) Some vulnerabilities in Squirrelmail can be exploited by malicious people to disclose and manipulate certain sensitive information or to conduct cross-site scripting, cross-site request forgery, and script insertion attacks.
For more information:
SA16987
SA20406
SA21354
SA23195
SA25200
16) Some vulnerabilities in Apache Tomcat can be exploited by malicious people to conduct cross-site scripting attacks or to bypass certain security restrictions.
For more information:
SA24732
SA25383
SA25721
17) An error in WebCore can be exploited to load Java applets even when Java is disabled in the preferences.
18) An error in WebCore can be exploited to conduct cross-site scripting attacks.
For more information see vulnerability #1 in:
SA23893
19) An error in WebCore can be exploited by malicious people to gain knowledge of sensitive information.
For more information see vulnerability #2 in:
SA23893
20) An error in WebCore when handling properties of certain global objects can be exploited to conduct cross-site scripting attacks when navigating to a new URL with Safari.
21) An error in WebKit within in the handling of International Domain Name (IDN) support and Unicode fonts embedded in Safari can be exploited to spoof a URL.
This is similar to:
SA14164
22) A boundary error in the Perl Compatible Regular Expressions (PCRE) library in WebKit and used by the JavaScript engine in Safari can be exploited to cause a heap-based buffer overflow when a user visits a malicious web page.
23) Input validation errors exists in bzgrep and zgrep.
For more information:
SA15047
Solution:
Apply Security Update 2007-007.
Security Update 2007-007 (10.4.10 Server Universal):
http://www.apple.com/support/download...pdate200700710410serveruniversal.html
Security Update 2007-007 (10.4.10 Universal):
http://www.apple.com/support/downloads/securityupdate200700710410universal.html
Security Update 2007-007 (10.4.10 Server PPC):
http://www.apple.com/support/downloads/securityupdate200700710410serverppc.html
Security Update 2007-007 (10.4.10 PPC):
http://www.apple.com/support/downloads/securityupdate200700710410ppc.html
Security Update 2007-007 (10.3.9 Server):
http://www.apple.com/support/downloads/securityupdate20070071039server.html
Security Update 2007-007 (10.3.9):
http://www.apple.com/support/downloads/securityupdate20070071039.html
Provided and/or discovered by:
2) The vendor credits Steven Kramer, sprintteam.nl.
9) Neil Kettle (mu-b) of www.digit-labs.org, reported via iDefense.
14) The vendor credits Mike Matz, Wyomissing Area School District.
17) The vendor credits Scott Wilde.
19) Secunia Research
22) The vendor credits Charlie Miller and Jake Honoroff of Independent Security Evaluators.
Changelog:
2007-08-03: Removed link from "Other References" section.
2007-08-08: Updated vulnerability #9 and credits section. Added link to iDefense.
Original Advisory:
Apple:
http://docs.info.apple.com/article.html?artnum=306172
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=573
Other References:
SA13237:
http://secunia.com/advisories/13237/
SA15047:
http://secunia.com/advisories/15047/
SA16987:
http://secunia.com/advisories/16987/
SA20406:
http://secunia.com/advisories/20406/
SA21354:
http://secunia.com/advisories/21354/
SA23195:
http://secunia.com/advisories/23195/
SA23893:
http://secunia.com/advisories/23893/
SA24814:
http://secunia.com/advisories/24814/
SA24356:
http://secunia.com/advisories/24356/
SA24440:
http://secunia.com/advisories/24440/
SA24505:
http://secunia.com/advisories/24505/
SA24542:
http://secunia.com/advisories/24542/
SA24732:
http://secunia.com/advisories/24732/
SA25800:
http://secunia.com/advisories/25800/
SA25123:
http://secunia.com/advisories/25123/
SA25200:
http://secunia.com/advisories/25200/
SA25232:
http://secunia.com/advisories/25232/
SA25383:
http://secunia.com/advisories/25383/
SA25721:
http://secunia.com/advisories/25721/
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
1st Dec, 2008
|
New advisories:
|
33 |
|
New vulnerabilities:
|
55 |
|
Updated advisories:
|
56 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
 Solutions | More...
|
|
|
|
Send Feedback to Secunia
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
|
|
|
