July 2002 - Security-announce

Security Update 7-18-02 is available
by Apple Product Security 20 Jul '02

20 Jul '02

-----BEGIN PGP SIGNED MESSAGE----- Security Update 7-18-02 is now available. It contains Software Update client version 1.4.7 which adds cryptographic signature verification to the software update command line tool thereby increasing the security of the Software Update process. The software update command line tool is primarily designed as a means for XServe system administrators to easily update a Mac OS X server. The previous release of Software Update client 1.4.6 provided two ways to run the software update process: via the existing graphical user interface within System Preferences, and as a command line tool. Software Update client 1.4.6 was released via Security Update 7-12-02 to provide cryptographic signature verification as quickly as possible for the more widely-used graphical user interface provided within System Preferences. Software Update client 1.4.7 now contains the cryptographic signature verification via either means of invoking the software update process. Customers can now choose to run Software Update either via the command line or from within the System Preferences application. Further information on the softwareupdate command line tool is available via "man softwareupdate" after installation. Security Update 7-18-02 may be obtained from: * Apple's Software Downloads web site: If updating from Mac OS X 10.1.1 or higher: http://depot.info.apple.com/security7-18/ If updating from Mac OS X 10.1: http://depot.info.apple.com/security7-18v10.1/ * Software Update pane in System Preferences (for 10.1.1 or later) To help verify the integrity of Software Update client 1.4.7 from the Software Downloads web site: The download file for Mac OS X 10.1.1 or higher is titled: SecurityUpdate7-18-02.dmg Its SHA-1 digest is: d407af740a6265730e7b56f6de5360011ce0c7c6 The download file for Mac OS X 10.1 is titled: SecUpd7-18-02forv.10.1.dmg Its SHA-1 digest is: 547d4614db75ce82c3f7eef822f9ef482998bf98 Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.3 iQEVAwUBPTnACiFlYNdE6F9oAQEtXQgAsT+/NXFle+xJMEw73IWhDIk7ruPhcuny T7FKt2+ySDITy2Fe5mqJwwv2WDxLw7n6PhlU4gYdQCT8lmRnCpN9+g/Ep10EAjnH IhJz5phQnIEPwhwStHNcZ8GnEJjJw0d1RJxlh4L6mKTPh4+4o2Q7yMUlHnjDNi2J L+som7e1hch84e1vK5mAnTDjHERilmxAlLdCu1bNjrSR4PZDJlDCLYvWpKPpgZuy yF+nBAMOb/LLqs13I+Tyg7ZQBlZ8pAaAbF3yamoMj1BRaZfgaFVGJOZiMbNN+dAw +kgg6abMnIRMPnCZ+c+FCxc/oZ51Uqlre+eEugvsybGZT33Y89c7mg== =YZtU -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0

Security Update 7-12-02 is available
by Apple Product Security 13 Jul '02

13 Jul '02

-----BEGIN PGP SIGNED MESSAGE----- Security Update 7-12-02 is now available. It contains Software Update client version 1.4.6 which fixes CVE ID CAN-2002-0676 to increase the security of the Software Update process. Affected systems: Systems with Software Update client 1.4.5 or earlier System requirements: Mac OS X 10.1 or later, or Mac OS X Server 10.1.x or later New features: Software packages that are available for download via the Software Update process are now cryptographically signed. Software Update client 1.4.6 checks for a valid signature before installing new packages. Downloaded packages which do not contain a valid signature are deleted from the system. Security Update 7-12-02 may be obtained from: - - Apple's Software Downloads web site (for Mac OS X 10.1 or later) http://www.info.apple.com/kbnum/n75304 - - Software Update pane in System Preferences (for 10.1.1 or later) To help verify the integrity of Software Update client 1.4.6 from the Software Downloads web site, the download file is titled "SecurityUpdate7-12-02.dmg" and its SHA-1 digest is: 2c039c683b7001defc35f93ba1f68db3e33e41fc Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.3 iQEVAwUBPTBFVCFlYNdE6F9oAQF0Uwf+Kroxcn3NxZLuQVP+HngZiMsJ6ThHwebX kdcq/MG6Ma0Y77Ce6VRn20ebuTeYymwJXwblXol060tS6xeM/Ropvg1GxTr2P202 1B1DD8kfz/iFUJ6Bc7292JWUs8SqUrI3OuzeJk/2aFuUQaJIg66Ul7KS5iVLlkl1 szro4iML2N2Z74DQGaRr0rF0FegRJhZ9ZNKxKdNCQiTkrBC5rlIbPqGMYvyVk9gw QLpEdXOrFze2hXBoQKwnmj5sj+co4SeJYX5nOn809bgfZ1mDFO/pwW33tFJGI7KQ +SVdIfWLBiZdTQMbsxQn9BdHWxoevzn5r5u8mkprtn49khrNzIQH0A== =QZsp -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0

Mac OS X and Mac OS X Server - "In Evaluation" under Common Criteria
by Product Security 01 Jul '02

01 Jul '02

-----BEGIN PGP SIGNED MESSAGE----- Apple has engaged Science Applications International Corporation (SAIC) to conduct a Common Criteria evaluation of Mac OS X and Mac OS X Server. The Common Criteria is an internationally accepted standard that permits comparability between the results of independent security evaluations by providing a common set of requirements for the security functions of IT products and for assurance measures applied to them during a security evaluation. The evaluation will be conducted by SAIC's Common Criteria Testing Laboratory (CCTL), participating in the National Information Assurance Partnership (NIAP) Common Criteria Evaluation and Validation Scheme (CCEVS). The Lab will conduct the evaluation in accordance with the Common Criteria for Information Technology Security Evaluation (ISO 15408) Evaluation Assurance Level 3 requirements. Mac OS X and Mac OS X Server will be evaluated against the functional requirements of the Controlled Access Protection Profile. We are excited to be working with SAIC to validate the security of Mac OS X so our customers will have an internationally accepted standard to help guide purchases and product development. For further information, please refer to the following resources: * Science Applications International Corporation (SAIC) home page: http://www.saic.com/ * National Information Assurance Partnership (NIAP) home page: http://niap.nist.gov/ * Common Criteria home page: http://www.commoncriteria.org/ -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.3 iQEVAwUBPR/HViFlYNdE6F9oAQF+Mwf+OrQodUTLQ/oX6eoYAUQNywF2a2DUrE+7 EJaHLnaqw6IZdvN0kRsAtNTlrEfs14T/MOOZapFafhyZHC/pSgP+RAy+dlTOrW9b h6qE/ZQng8nmJLSD3S238+/P9Kek47doBBltpc2/vRdX+goWqP2AKnNp08De/s03 oZMZNfLaqIwuzmLOqANwofnAmFtwJWKpR+RLG84Mw4Ji/y8lsQLNe7FiYv+hM3c6 uXUDhdd5JMU5Sb1EmDC2mTNxz3LScLfdsBVBye0zYHG+Q5fal50cc9EoUleyRsr/ hg67B859DFMjMmdBun2Syac9JRlpJT5/JtHCvahq5fTS4N/BWLdgyw== =i5ku -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0

Mac OS X not vulnerable to resolver vulnerability
by Apple Product Security 01 Jul '02

01 Jul '02

-----BEGIN PGP SIGNED MESSAGE----- Mac OS X and Mac OS X Server are not vulnerable to the Buffer Overflow in Multiple DNS Resolver Libraries reported in CERT Advisory CA-2002-19 (CVE ID CAN-2002-0651). Further details on the vulnerability are available at: http://www.cert.org/advisories/CA-2002-19.html -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.3 iQEVAwUBPSBoHyFlYNdE6F9oAQFAoQf/W2EhggAc2FvZdMu7+LmeqGUY6WYJRq89 vzHqeUN4AgIgoxcKnnhnJgX+Mr+Zciq8BWYgO+o4SbAO3Har7cRgrT3NMTimo7AN 3u/vdx1KcFuVj0nULqKKP2dzLddM1Yw8Sw/He6shTTAqBIo+YisKbW1oN6DVAim0 6+H4fwX5hVZX/LmwvMtJg6rBhtKJX4257N9dky3LSOnLqLJhstEhS9WTyIDOdlJ4 I663jVxmhjztYu34iogGRc3TwDkIFnd3GgEhLfy0MmyjJdsuQmlB9Hc3IZmcM9uF ubaBXpAgadP1twWsKgIRYtZAzcR38JEAxn7NNOAVizh+QyZaQwMEog== =76d7 -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0