August 2002 - Security-announce

Security Update 2002-08-23 is available for Jaguar
by Product Security 23 Aug '02

23 Aug '02

-----BEGIN PGP SIGNED MESSAGE----- Security Update 2002-08-23 is now available. This applies the fixes already available in Security Update 2002-08-02 to the Mac OS X 10.2 (Jaguar) release. Security Update 2002-08-02 was designed for the Mac OS X 10.1.5 release. It contains fixes for recent vulnerabilities in: OpenSSL: Fixes security vulnerabilities CAN-2002-0656, CAN-2002-0657, CAN-2002-0655, and CAN-2002-0659. Details are available via: http://www.cert.org/advisories/CA-2002-23.html mod_ssl: Fixes CAN-2002-0653, an off-by-one buffer overflow in the mod_ssl Apache module. Details are available via: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0653 Affected systems: Mac OS X client and Mac OS X Server Note: Mac OS X client is configured by default to have these services turned off, and is only vulnerable if the user has enabled network services which rely on the affected components. It is still recommended for Mac OS X client users to apply this security update to their system. System requirements: Mac OS X 10.2 (Jaguar) Security Update 2002-08-23 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: http://www.info.apple.com/kbnum/n120142 To help verify the integrity of Security Update 2002-08-23 from the Software Downloads web site: The download file is titled: SecurityUpd2002-08-23.dmg Its SHA-1 digest is: fccb3adb478f90650f4484534a79a80bba5f94f3 Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.3 iQEVAwUBPWad3SFlYNdE6F9oAQHuIQf9GdW2n/r7di2U8c4jQU+3JvRtU+HG7Lsl jlKRVNGyaMvUAurxbYB/yHfHcYDtsj26bupzLUpLXbIt54uZxyXo6UTExzpwreaT r+UJm7+q9kG6lcAmrcz2WNzlnD6icXKKuyf/hR8NUo3yBP7MoR6QGjvFqodvTOHR J2YXH8AEPAmWFf511AzbG1yYvlDhocZ+/gBFTlaB3nYt11Edz2yRE4qeumQYEIyf gLFxzp1BVFNDJck66WjPWgHqDuq9QWPBzHl1qhd09ctD84w+Hda972dqxRn08Jo7 jTGs2zmUpyPxLxCHEd5uzRNuMquIoddW2Nsg8LeJNHqRDlklVSJTUA== =CJ2Y -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored. Sun RPC: Fixes CAN-2002-039, a buffer overflow in the Sun RPC XDR decoder. Details are available via: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20823

1 0

Security Update 2002-08-20 is available
by Apple Product Security 21 Aug '02

21 Aug '02

-----BEGIN PGP SIGNED MESSAGE----- Security Update 2002-08-20 is available. It contains: * An enhanced version of the SecureTransport module to improve verification of certificates * OpenSSL 0.9.6e Systems Affected: All versions of Mac OS X and Mac OS X Server SecureTransport Description: In order to enhance certificate verification, Mac OS X is now in full compliance with the Internet X.509 Public Key Infrastructure Certificate and CRL Profile (RFC2459). This is a minor enhancement and there have been no reports of issues in the current version. OpenSSL Description: This update contains the full OpenSSL 0.9.6e version. The previous release of OpenSSL in Security Update 2002-08-02 provided a rapid response patch to the existing version (0.9.6b). Security Update 2002-08-20 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: http://docs.info.apple.com/article.html?artnum=120141 To help verify the integrity of Security Update 2002-08-20 from the Software Downloads web site: The download file is titled: SecurityUpd2002-08-20.dmg Its SHA-1 digest is: 07df0a8bf8def379b84b44894c559838b0065a5f Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.3 iQEVAwUBPWLbNyFlYNdE6F9oAQE8Kwf8CCjBClpxYhPeuq51QHPsakmFBoWVpQJr clnuLjfSehSo5AWXQryQtpbwI9f5DfO6tby5jb1m8mt9QsYpRLm2jRSZADXibn8Q mim+8JyCHnWP4WX4rtiyCfM+SjZKJ3LP7Qn1zT26RsKWWjr3d6eyrw4x66oeXw0i stJHoBmLUKUsyrYUEgpKmpPzefrs7mWWzunApZe13/QyBa7crJPy4weaDn+pHKuA F/2AxjtOAUuCceEJZ7gIYBEmDIW0EZJxa0SIWCkZt5bWAxwpRVPaKfogMdGzkLJ2 nN0tsSdHrf8XfUHLBhuyE483sSaiVmO0DsbJsVmoKi0k7oPweDWChA== =I8qy -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0

Security Update 2002-08-02 for OpenSSL, Sun RPC, mod_ssl
by Product Security 02 Aug '02

02 Aug '02

-----BEGIN PGP SIGNED MESSAGE----- mod_ssl: Fixes CAN-2002-0653, an off-by-one buffer overflow in the mod_ssl Apache module. Details are available via: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0653 Affected systems: Mac OS X client and Mac OS X Server System requirements: Mac OS X 10.1.5 Security Update 2002-08-02 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: http://docs.info.apple.com/article.html?artnum=120139 SSL server: https://depot.info.apple.com/security/129403bc5e184e3b7367.html To help verify the integrity of Security Update 2002-08-02 from the Software Downloads web site: The download file is titled: SecurityUpd2002-08-02.dmg Its SHA-1 digest is: 54f6eebe0398181db8f1129403bc5e184e3b7367 Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.3 iQEVAwUBPUsLOiFlYNdE6F9oAQGAigf+JV+lazuko1g4oZSNFTd2puXCtOGQ0M8c 2cZ/BdaEBA8jLGrPkhWuvmMwpN9z6G9chnN8s9EXiavcBG5e/ejtTo3ZHoOGP7bg 789zLQLK2JTB75nc0fNyx2CdfHlEIM00v8c2jXySLlnqF+kzwqVnjUL7i2O97Fk5 tWXLc2dWK2Nf2SUk0/yLgfjceZKEPCPXTpuKYuah/w9NwzL+LsbPcfXA/H1f4ngc vRPc2sn2HYu9IJw/BrMEsDlS8IWHf6ozXdZ9qaVCVRrZlsd9gSSmB2Jba4be/MRX FauTTepMF9+JfCkx+2wtpwWhBcXoJnjwIZXOXwbbRjqXHmzzgu8D/Q== =fdGO -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored. Security Update 2002-08-02 is now available. It contains fixes for recent vulnerabilities in: OpenSSL: Fixes security vulnerabilities CAN-2002-0656, CAN-2002-0657, CAN-2002-0655, and CAN-2002-0659. Details are available via: http://www.cert.org/advisories/CA-2002-23.html Sun RPC: Fixes CAN-2002-039, a buffer overflow in the Sun RPC XDR decoder. Details are available via: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20823 Note: Mac OS X client is configured by default to have these services turned off, and is only vulnerable if the user has enabled network services which rely on the affected components. It is still recommended for Mac OS X client users to apply this security update to their system.

1 0

STOS Conference, Monterey 8/26 - 30
by Product Security 02 Aug '02

02 Aug '02

-----BEGIN PGP SIGNED MESSAGE----- [STOS] - The Secure Trusted Operating System Consortium is pleased to announce the: 1st Annual - Mac OS X & BSD Security Symposium Monday, August 26, 2002 - Friday August 30, 2002 Hyatt, Monterey, CA (across the street from the Naval Post Graduate School) http://www.stosdarwin.org/event/mont02/ Keynote Speaker (Wednesday morning) Keith T. Schwalm Director of Infrastructure Protection President's Critical Infrastructure Protection Board The symposium is targeted to system and lab administrators, programmers, developers, strategists, and other technical staff involved in the deployment and securing of computer systems. Past [STOS] events have been a networking frenzy for the Mac OS X / Darwin security community. This Mac OS X & BSD Security Symposium will follow in the footsteps of previous [STOS] events by promoting the sharing of ideas and techniques with the goal of maximizing the security of involved systems. With the addition of Robert Watson's TrustedBSD tutorial and several new papers on various aspects of BSD based services, brings even more excitement to this event. There is no other event with the same depth of Mac OS X and BSD Security subject matter as the Mac OS X and BSD Security Symposium. Top 5 Reasons to attend: (1) Only place you can get an in-depth tutorial on using TrustedBSD with Robert Watson of Network Associates Laboratories and the FreeBSD Core Team (2) Only place you will find training on Apple's implementation of CDSA directly from Apple's data security team (3) Unparalleled networking opportunities with those interested in all aspects of Mac OS X / Darwin and BSD security. (4) Birds of a Feather events every night. (5) When else do you get to spend 5 days, during the best time of the year, in the legendary beauty of Monterey, California? Conference Dates Monday, August 26, 2002, through Friday August 30, 2002 Tutorials Monday August 26, through Tuesday August 27, 2002 Research and Proposals Research Papers and Proposals from Wednesday, August 28 through Friday August 30, 2002 Registration http://shopping.oraclesmallbusiness.com/events Pricing Discount Deadline: August 10, 2002 Full Pass - $795.00 - 2 days of tutorials - 3 days of research - 5 days of nightly BOF's Research Pass - $299.00 - 3 days of research - 3 days of BOF's After August 10, 2002 prices go up to Full Pass - $995.00 Research Pass - $499.00 *NOTE: Limited to the first 150 About the [STOS] Consortium [STOS] Website: http://www.stosdarwin.org/ The [STOS] Consortium represents the formal coordination of Public, Private and Academic sectors in an environment of open collaboration to enhance the security of Operating Systems built on the Darwin Open Source project at Apple. We look forward to seeing you all in Monterey, CA ! Shawn Geddis Chairman, [STOS] Consortium geddis(a)stosc.org [STOS] Secure Trusted OS Consortium Website: http://www.stosdarwin.org/ Mail Lists: http://lists.stosdarwin.org/ -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.3 iQEVAwUBPUq/2SFlYNdE6F9oAQH/xQf9E5H8GuG5lB4PjcTvnCqjx+KF6RKahPo3 d0eCaXCaULWMGVrj0QzQ/zLHkiiaXtx5tsiCxYxQk1GxSO6rdZpNOIhPzukMVHbL LXXLTJ3DuBO4tBvlBUC1eXKqZ4SaJeIeVDiiuit3S9EyUphkUqAmS7PDWkoCQVJD heGG6ovEetNkFqVU+TTfHSM/ljLnXI81LDDlrh7xwa+8F91Elj5Er4X0DlByYa0i XrHZ+klVWzqQhou2KW9wF/FHi5zPFvYT+hiteFNF7WHNOOnOo3fEHxwJVpYYBCs1 WaglxVwUToryzLpQiQr1WB4pzYS+60gc1alRpX+804kDhM7/VH483w== =8XYs -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored. Just a few of the top Tutorials: * Building Secure Software John Viega, Chief Technical Officer, Secure Software Solutions * Introduction to the architecture, design, and implementation of TrustedBSD Robert Watson, founder, and head of the TrustedBSD Project * Introduction to Smart Cards in Darwin and Mac OS X Data Security Team, Apple * Introduction to CDSA and Layered Services Data Security Team, Apple * Intro to PKI with Entrust Entrust Implementation Engineers * Mac OS X Forensics Derrick Donnelly, IS&T Security Manager, Apple

1 0