April 2002 - Security-announce

Mac OS X Update 10.1.4 available
by Product Security 17 Apr '02

17 Apr '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mac OS X Update 10.1.4 is now available and includes the following security enhancement for your system: * BSD-based TCP/IP connections now check and block broadcast or multicast IP destination addresses Mac OS X Update 10.1.4 may be obtained either via: The Software Update pane in System Preferences or Apple's Software Downloads web page: http://www.info.apple.com/support/downloads.html Further details are available via the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html There may be issues in verifying this using GPG at present. -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.3 iQA/AwUBPL4B9A57Cn4JaxpHEQLVzwCgzfBjhTDubTQX4oemsMOgrCVieHUAn0ta 6Pzd8dx+INk4QLW5hp3YcR8E =4/jT -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0

Security Update - April 2002 available (re-send)
by Product Security 05 Apr '02

05 Apr '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Security Update - April 2002 is now available and includes the following security enhancements for your system: Apache - updated to version 1.3.23 in order to incorporate the mod_ssl security fix Apache Mod_SSL - updated to version 2.8.7-1.3.23 to address a buffer overflow vulnerability which could potentially be used to run arbitrary code. groff -- updated to version 1.17.2 to address the vulnerability CVE ID: CAN-2002-0003, where an attacker could gain rights as the 'lp' user remotely. mail_cmds - updated to fix a vulnerability where users could be added to the mail group OpenSSH - updated to version 3.1p1 to address the vulnerability reported in FreeBSD Security Advisory FreeBSD-SA-02:13, where an attacker could influence the contents of the memory. PHP - updated to version 4.1.2 to address the vulnerability reported in CERT CA-2002-05, which could allow an intruder to execute arbitrary code with the privileges of the web server. rsync - updated to version 2.5.2 to address a vulnerability which could lead to corruption of the stack and possibly to execution of arbitrary code as the root user, as reported in FreeBSD Security Advisory FreeBSD-SA-02:10 sudo - updated to version 1.6.5p2 to address the vulnerability reported in FreeBSD Security Advisory FreeBSD-SA-02:06, where a local user may obtain superuser privileges. How to obtain the update - ------------------------ Security Update - April 2002 may be obtained either via: - the Software Update pane in System Preferences or - Apple's Software Downloads web page: http://www.info.apple.com/support/downloads.html Security web site - ----------------- Further details are available via the Apple Product Security web site at: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.3 iQA/AwUBPK3TRQ57Cn4JaxpHEQI7+QCfbrNad+DjiQa0CLC1vgF2h7vOsZwAn0ti PYOYzXYHgkV8NUEYIrHnlGbP =sgh+ -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored. We've received several request to have the Security Update message re-sent since the PGP signature was bad due to line breaks and the mail system.

1 0

Security Update - April 2002 available
by Apple Security 05 Apr '02

05 Apr '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iQA/AwUBPK0bLg57Cn4JaxpHEQKrUQCg34Uz0udzn1nqa/ocHXKOlL3O2EQAoIe8 qo/vqqwQrH3db7pL/xne84ur =wZ3Y -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored. Security Update - April 2002 is now available and includes the following security enhancements for your system: Apache - updated to version 1.3.23 in order to incorporate the mod_ssl security fix Apache Mod_SSL - updated to version 2.8.7-1.3.23 to address a buffer overflow vulnerability which could potentially be used to run arbitrary code. http://online.securityfocus.com/advisories/3937 groff -- updated to version 1.17.2 to address the vulnerability CVE ID: CAN-2002-0003, where an attacker could gain rights as the 'lp' user remotely. http://online.securityfocus.com/advisories/3859 mail_cmds - updated to fix a vulnerability where users could be added to the mail group OpenSSH - updated to version 3.1p1 to address the vulnerability reported in FreeBSD Security Advisory FreeBSD-SA-02:13, where an attacker could influence the contents of the memory. ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD- SA-02:13.openssh.asc PHP - updated to version 4.1.2 to address the vulnerability reported in CERT CA-2002-05, which could allow an intruder to execute arbitrary code with the privileges of the web server. http://www.cert.org/advisories/CA-2002-05.html rsync - updated to version 2.5.2 to address a vulnerability which could lead to corruption of the stack and possibly to execution of arbitrary code as the root user, as reported in FreeBSD Security Advisory FreeBSD-SA-02:10 ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD- SA-02:10.rsync.asc sudo - updated to version 1.6.5p2 to address the vulnerability reported in FreeBSD Security Advisory FreeBSD-SA-02:06, where a local user may obtain superuser privileges. ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD- SA-02:06.sudo.asc How to obtain the update - - ------------------------ Security Update - April 2002 may be obtained via: - the Software Update pane in System Preferences and it will also be posted to: - Apple's Software Downloads web page: http://www.info.apple.com/support/downloads.html This message is signed with Apple's Product Security PGP key, and details are available via: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com>

1 0