Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
Database
Search
Advisories by Product
Advisories by Vendor
Terminology
Report Vulnerability
Insecure Library Loading
Highly critical

Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

-

Release Date:  2008-05-29    Last Update:  2008-05-30    Views:  18,269

Secunia Advisory SA30430

Where:

From remote

Impact:

Security Bypass, Cross Site Scripting, Exposure of system information, Exposure of sensitive information, Privilege escalation, DoS, System access

Solution Status:

Vendor Patch

Operating System:

CVE Reference(s):

Description


Apple has issued a security update for Mac OS X, which fixes multiple vulnerabilities.

1) An error in AFP server allows connected users or guests to access files and directories that are not within a shared directory.

2) Some vulnerabilities in Apache can be exploited by malicious people to conduct cross-site scripting attacks or to cause a DoS (Denial of Service).

For more information:
SA18008
SA18307
SA26273
SA26636
SA28081

The vulnerabilities affect Mac OS X Server v10.4.x.

3) An unspecified error in AppKit can potentially be exploited to execute arbitrary code when a user opens a specially crafted document file with an editor that uses AppKit (e.g. TextEdit).

4) Multiple unspecified errors exist in the processing of Pixlet video files. These can be exploited to cause memory corruption and potentially allow for execution of arbitrary code when a user opens a specially crafted movie file.

5) An unspecified error exists in Apple Type Services when processing embedded fonts in PDF files. This can be exploited to cause a memory corruption when a PDF file containing a specially crafted embedded font is printed.

Successful exploitation may allow execution of arbitrary code.

6) An error in Safari's SSL client certificate handling can lead to an information disclosure of the first client certificate found in the keychain when a web server issues a client certificate request.

7) An integer overflow exists in CoreFoundation when handling CFData objects. This can be exploited to cause a heap-based buffer overflow if an application calls "CFDataReplaceBytes" with an invalid "length" argument.

8) An error due to an uninitialised variable in CoreGraphics can potentially be exploited to execute arbitrary code when a specially crafted PDF is opened.

9) A weakness is caused due to users not being warned before opening certain potentially unsafe content types.

10) An error when printing to password-protected printers with debug logging enabled may lead to the disclosure of sensitive information.

11) Some vulnerabilities in Adobe Flash Player can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting attacks, or to potentially compromise a user's system.

For more information:
SA28083

12) An integer underflow error in Help Viewer when handling help:topic URLs can be exploited to cause a buffer overflow when a specially crafted help:topic URL is accessed.

Successful exploitation may allow execution of arbitrary code.

13) A conversion error exists in ICU when handling certain character encodings. This can potentially be exploited bypass content filters and may lead to cross-site scripting and disclosure of sensitive information.

14) Input passed to unspecified parameters in Image Capture's embedded web server is not properly sanitised before being used. This can be exploited to disclose the content of local files via directory traversal attacks.

15) An error in the handling of temporary files in Image Capture can be exploited by malicious, local users to manipulate files with the privilege of a user running Image Capture.

16) A boundary error in the BMP and GIF image decoding engine in ImageIO can be exploited to disclose content in memory.

17) Some vulnerabilities in ImageIO can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerabilities are caused due to the use of vulnerable libpng code.

For more information:
SA27093
SA27130

18) An integer overflow error in ImageIO within the processing of JPEG2000 images can be exploited to cause a heap-based buffer overflow when a specially crafted JPEG2000 image is viewed.

Successful exploitation of this vulnerability may allow execution of arbitrary code.

19) An error in Mail is caused due to an uninitialised variable and can lead to disclosure of sensitive information and potentially execution of arbitrary code when mail is sent through an SMTP server over IPv6.

20) A vulnerability in Mongrel can be exploited by malicious people to disclose sensitive information.

For more information:
SA28323

21) The sso_util command-line tool requires that passwords be passed to it in its arguments, which can be exploited by malicious, local users to disclose the passwords.

22) An error in Wiki Server can be exploited to determine valid local user names when nonexistent blogs are accessed.


Solution:
Update to Mac OS X 10.5.3 or apply Security Update 2008-003.

Further details available to Secunia VIM customers

Provided and/or discovered by:
The vendor credits:
1) Alex deVries and Robert Rich
3) Rosyna of Unsanity
5) Melissa O'Neill, Harvey Mudd College
9) Brian Mastenbrook
12) Paul Haddad, PTH Consulting
16) Gynvael Coldwind, Hispasec
19) Derek Morr, Pennsylvania State University
21) Geoff Franks, Hauptman Woodward Institute
22) Don Rainwater, University of Cincinnati

Original Advisory:
http://support.apple.com/kb/HT1897

Deep Links:
Links available to Secunia VIM customers

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

No posts yet

-

You must be logged in to post a comment.



 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Factsheets
Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability