December 2003 - Security-announce

APPLE-SA-2003-12-19 Security Update for Jaguar
by Apple Product Security 20 Dec '03

20 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2003-12-19 Security Update 2003-12-19 for Jaguar Security Update 2003-12-19 for Jaguar is available for Mac OS X 10.2.8 and Mac OS X Server 10.2.8. It contains security enhancements for the following: AppleFileServer: Fixes CAN-2003-1007 to improve the handling of malformed requests. cd9660.util: Fixes CAN-2003-1006, a buffer overflow vulnerability in the filesystem utility cd9660.util. Credit to KF of Secure Network Operations for reporting this issue. Directory Services: Fixes CAN-2003-1009. The default settings are changed to prevent an inadvertent connection in the event of a malicious DHCP server on the computer's local subnet. Further information is provided in Apple's Knowledge Base article: http://docs.info.apple.com/article.html?artnum=32478 Credit to William A. Carrel for reporting this issue. fetchmail: Fixes CAN-2003-0792. Updates are provided to fetchmail that improve its stability when receiving malformed messages. fs_usage: Fixes CAN-2003-1010. The fs_usage tool has been improved to prevent a local privilege escalation vulnerability. This tool is used to collect system performance information and requires admin privileges to run. Credit to Dave G. of @stake for reporting this issue. rsync: Fixes CAN-2003-0962 by improving the security of the rsync server. System initialization: Fixes CAN-2003-1011. The system initialization process has been improved to restrict root access on a system that uses a USB keyboard. Note: The following fixes which appear in "Security Update 2003-12-19 for Panther" are not included in "Security Update 2003-12-19 for Jaguar" since the Jaguar versions of Mac OS X and Mac OS X Server are not vulnerable to these issues: - CAN-2003-1005: ASN.1 Decoding for PKI - CAN-2003-1008: Screen Saver text clippings ================================================ Security Update 2003-12-19 for Jaguar may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: http://www.info.apple.com/kbnum/n120291 The download file is named: "SecurityUpd2003-12-19Jag.dmg" Its SHA-1 digest is: b0c5d1ef54020db7580798fddd7a1e132e653896 Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQEVAwUBP+RshHeI0z6bzFr0AQJJhAgAtSkJrSfWVR/AxPsJ1CXOpKNoZuOvdems 6elRfBkuSLK9ETauqKKvJcZa/Wf2D+Mzusz+BYpmDHKAXWIhqcjPjSFJjeHzri8/ /ienm69poqa7Miu+ow6KKsvVsniO8DeAjw7FkFnD8SmvKrkKvbvQVLh0WEHPPB9Y 5lepyEuzsaB8DWOl2DwuDN+0HWgGWrSPSV1hY/VX4HJQPD0ibqqkEcs6tf82kglN E3s/vFWNkDzkCt2awf3l7vtgV4EZV4Xnaylkzq5b0rLSc3q0gXfHjlB1Ujubx06w NrecGLBggzYvl9CPisDADXjt/gJhmi76OktRytg6QRDlEZf/OuPMkA== =kTh7 -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0

APPLE-SA-2003-12-19 Security Update for Panther
by Apple Product Security 20 Dec '03

20 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2003-12-19 Security Update 2003-12-19 for Panther Security Update 2003-12-19 for Panther is available for Mac OS X 10.3.2 and Mac OS X Server 10.3.2. It contains security enhancements for the following: AppleFileServer: Fixes CAN-2003-1007 to improve the handling of malformed requests. ASN.1 Decoding for PKI: Fixes CAN-2003-1005 which could cause a potential denial of service when receiving malformed ASN.1 sequences. This is related but separate from CAN-2003-0851. cd9660.util: Fixes CAN-2003-1006, a buffer overflow vulnerability in the filesystem utility cd9660.util. Credit to KF of Secure Network Operations for reporting this issue. Directory Services: Fixes CAN-2003-1009. The default settings are changed to prevent an inadvertent connection in the event of a malicious DHCP server on the computer's local subnet. Further information is provided in Apple's Knowledge Base article: http://docs.info.apple.com/article.html?artnum=32478 Credit to William A. Carrel for reporting this issue. fetchmail: Fixes CAN-2003-0792. Updates are provided to fetchmail that improve its stability when receiving malformed messages. fs_usage: Fixes CAN-2003-1010. The fs_usage tool has been improved to prevent a local privilege escalation vulnerability. This tool is used to collect system performance information and requires admin privileges to run. Credit to Dave G. of @stake for reporting this issue. rsync: Fixes CAN-2003-0962 by improving the security of the rsync server. Screen Saver: Fixes CAN-2003-1008. When the Screen Saver login window is present, it is no longer possible to write a text clipping to the desktop or an application. Credit to Benjamin Kelly for reporting this issue. System initialization: Fixes CAN-2003-1011. The system initialization process has been improved to restrict root access on a system that uses a USB keyboard. ================================================ Security Update 2003-12-19 for Panther may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: http://www.info.apple.com/kbnum/n120292 The download file is named: "SecurityUpd2003-12-19.dmg" Its SHA-1 digest is: 112674677572232f640d03122b25527d84fbbbf8 Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQEVAwUBP+Rsp3eI0z6bzFr0AQI/MwgAqqUXmeRPg2xLQlbGiK15uDhgrcOuE27V 5fi8IvkiAWMN/qjJofG3y+crtmZwTea0Z8qvcw8EcbMRtuhqzyCu43HFTE8wFJ4w FqmwihZQANu8IHye9tgl36CiPJvY3bYWPxd3GobAQKZp81/OIhY3H2aB79Oa3N3o 6lBPHInyLmRswlOa9s7v6wSJAK/9MXa7dwSLtaaFsVg7R8kfe4atZ0tAlc8rHAnS k0sZq1z6hPeiXHRxFIeozwTr6P5QLZB/3YuRYLtgYudojOauV1/X4/ltsOb5Kdk/ HUdrNSZfoECPI78BecWblnsGG91Tgd20GIcTke06o0zWvZa2vXWJDg== =3ZBF -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0

APPLE-SA-2003-12-05 Security Update 2003-12-05
by Apple Product Security 05 Dec '03

05 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2003-12-05 Security Update 2003-12-05 Security Update 2003-12-05 is now available for Mac OS X 10.3.1 and Mac OS X 10.2.8. The update contains a security enhancement for the following: Safari: Fixes CAN-2003-0975 to ensure that Safari will provide access to a user's cookie information only to authorized websites. The update is available for both Mac OS X 10.3.1 and Mac OS X 10.2.8. ================================================ Security Update 2003-12-05 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: Updating from Mac OS X 10.3.1 ============================= http://www.info.apple.com/kbnum/n120283 The download file is named: "SecurityUpd2003-12-05.dmg" Its SHA-1 digest is: 6d42a8ccb7341f8cf86c751762fdc195b6752734 Updating from Mac OS X 10.2.8 ============================= http://www.info.apple.com/kbnum/n120282 The download file is named: "SecurityUpd2003-12-05Jag.dmg" Its SHA-1 digest is: 3d1137f851a3656a10eed2177c5869382a815375 Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQEVAwUBP9EMvXeI0z6bzFr0AQIpxwf/Q3T8ivP8LLtTAUqw8iAosa+wyIhBwdZ+ Qc/OoR+1hlYEaAff91bRtQVeKruMqRTPaFnczTNRh5Du7CKQaCWpZnwYWyNBZpU3 V/BxWzPzP+TL4k6IWfYLjF2n9FDRd1JWrfGiX+qh0QcGH62bfkB60FPSyUiA8mWb nqp0d+G++masfmLLnBFuwcOBrBUg/dxWFosBi1ziZ44rHtVNEc3IbIGppQFgzkbQ 4VM3nV3MykaIfzCBqe5U9fl08FkUrnCnw4K5ZuV4GdhoCM7vwCTFZ/5pOMfcPZ7I JI4mK+HOAYFDSv86WZ10eSqP36Z34U4FRlspUqy8U0n7pqw6hIAPzw== =G9Wg -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0