March 2003 - Security-announce

QuickTime 6.1 for Windows is available
by Product Security 31 Mar '03

31 Mar '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2003-03-31 QuickTime Player for Windows A potential vulnerability in Apple's QuickTime Player for Windows could allow a remote attacker to compromise a target system. This exploit is only possible if the attacker can convince a user to load a specially crafted QuickTime URL. Upon successful exploitation, arbitrary code can be executed under the privileges of the QuickTime user. CVE Candidate ID: CAN-2003-0168 Versions affected: QuickTime Player versions 5.x and 6.0 for Windows. QuickTime Player for Mac OS and Mac OS X are not affected. Recommendation: Install QuickTime version 6.1 for Windows QuickTime 6.1 for Windows is available via: http://www.apple.com/quicktime/download/ - or - "Update Existing Software" menu item in QuickTime Player Credit to Texonet (http://www.texonet.com/) for discovering this vulnerability. Apple Product Security http://www.apple.com/support/security/ -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQEVAwUBPoixCSFlYNdE6F9oAQIOsQgAl+bbm4FwcobpmHHvZRY7zf71BZh6USfn chgtHB3n4L/vnoZrFK8z4f66/Cn8mCjy+vF9Pfk3FcUyJnHed3wm6fVlkbnwJCCJ p2b8fK+HwNyXYXaR8D0o7eFbR9N3GRu1caN4+zhKYehQVMnzkopLI9LzHF3iKVC7 9ULLwNheRoiQbd5+q1wtkaj1fweXfqHG/LO2+kKaBGNhhrSgipFI1iamvQTZ8o5A CCfT1RTejcZQY0PnMnqS9+S/wqT9bbRCkMVY3+9HBTZAzrhudED/yDMqwFKv2ofP 51JG5FaDNUT8LVFm6kfRzR719MHqVojGIgNNzpnvGNRb8bWmFE9MKw== =sB+X -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0

APPLE-SA-2003-03-24 Samba, OpenSSL
by Product Security 24 Mar '03

24 Mar '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2003-03-24 Samba, OpenSSL Security Update 2003-03-24 is now available. It contains fixes for recent vulnerabilities in: * OpenSSL: Fixes CAN-2003-0147, a timing attack on RSA keys. * Samba: Fixes CAN-2003-0085 and CAN-2003-0086 which could allow unauthorized remote access to the host system. The built-in Windows file sharing in Mac OS X is based on Samba. Windows file sharing is off by default in Mac OS X, but it is recommended that all users install this Security Update. Note: This update only applies the security fixes to the currently-shipping 2.2.3 version of Samba on Mac OS X 10.2.4, and the Samba version is otherwise unchanged. The presence of the following file indicates that the update has been applied: /Library/Receipts/SecurityUpd2003-03-24.pkg Affected systems: Mac OS X 10.2.4 and earlier Mac OS X Server 10.2.4 and earlier System requirements: Mac OS X 10.2.4 or Mac OS X Server 10.2.4 Customers with earlier Mac OS X versions are encouraged to either upgrade to Mac OS X 10.2.4, or visit the Samba and OpenSSL web sites for information on the available fixes. Security Update 2003-03-24 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: http://www.info.apple.com/kbnum/n120199 To help verify the integrity of Security Update 2003-03-24 from the Software Downloads web site: The download file is titled: SecurityUpd2003-03-24.dmg Its SHA-1 digest is: 0a80081453bca85493fcbaccd6adad222b41809e Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQEVAwUBPn+J9yFlYNdE6F9oAQLn5wgAovbpUeGt5l94+F0uo+bbF6Qfb/WVG5Kk 3sciromi3Jo/UnAGWyloFU/o1DZeyqqBgZiqGucwXC2T6M9mkIlf2qSFchkWcyBm atau0h0ey1gd7KNrfXszwb41jxal4WqYw/rg2h0Dgf+gKZ+ZKd5DDFTuIbCu9jWO vB7+mW3WJ2zopRjXwEwOTkZApq2wH0DEUbK+R3Qg7B0LvLwKnOK6ATHbN7p2Y7zi itVYrEcNR5bPDBVu1rzv5TiwoqNrDjBpuuTRvekpK5eugXRCHXhjlZ+XimafvKrj RwnD3zM+E+vPeDiEL0/dnY+sQ3zyadZxZO8NyFFtmOQEMj/ANeot/A== =065h -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0

security vulnerability in Samba
by Product Security 17 Mar '03

17 Mar '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We are aware of the recently-announced security vulnerability in the third-party Samba software, and are preparing a software update to incorporate the fix from the Samba team. Samba is shipped with Mac OS X and Mac OS X Server, but is not enabled by default. This means that most customers of Mac OS X and Mac OS X Server are not affected. For systems that have enabled Samba, we recommend reading the information available from the Samba site http://www.samba.org/ and taking the measures that are best for the particular system environment. The Apple software update will be available for Mac OS X 10.2.4 and Mac OS X Server 10.2.4. Customers with earlier versions of Mac OS X who make use of Samba are encouraged to either update to Mac OS X 10.2.4, or to obtain Samba version 2.2.8 directly from the Samba site. Apple Product Security team http://www.apple.com/support/security/ PGP Key ID: 0x44E85F68 Fingerprint: AE43 8996 9250 78A6 D587 3CA8 2165 60D7 44E8 5F68 -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQEVAwUBPnYDViFlYNdE6F9oAQJgNQf+KrEnXgtWTdBjVEbtS7X3Vea1C2PBdo01 AaTDQWkPrPpSeaELuGSzck0OP+p3GtvSe1RFXZHd+lk5aTiX0Hd3mAtiNT+0oxDs G62X8ixfBszzNTWMtm91jAinIyJt1V593BwyrGvRo93Kukp+jd47lYvYFVNQk9a+ aDPanK4RcUZyNytL+X+HGzT0C1rbH1othaCZ+vGXGV5+7TmgdkhhNR5nzB3ejJRL YlLbK4hyfh/pwgm0BS2Hh4ON8dt8Cx00vCsNroJuapkDZUU1iUdsI/kLCeJHDW94 +WJUttZZdTDKmmmUtG/j+oHLJoq7+0xwEjKy5W4kT1nY0ZFU6WBKcA== =l6IN -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0

APPLE-SA-2003-03-03 sendmail
by Product Security 03 Mar '03

03 Mar '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2003-03-03 sendmail Security Update 2003-03-03 is now available. It contains fixes for the following potential security issues: * Sendmail: Fixes CAN-2002-1337 where a remote attacker could gain elevated privileges on affected hosts. Sendmail is not enabled by default on Mac OS X, so only those systems which have explictly enabled sendmail are vulnerable. All customers of Mac OS X, however, are encouraged to apply this update. * OpenSSL: Fixes CAN-2003-0078, where it is theoretically possible for a third-party to extract the original plaintext of encrypted messages sent over the network. Security Update 2003-03-03 applies this fix for Mac OS X 10.2.4, and customers of earlier Mac OS X versions may obtain the patch from the OpenSSL web site: http://www.openssl.org/ Security Update 2003-03-03 may be obtained from: * Software Update pane in System Preferences (updating from Mac OS X 10.1.5 and 10.2.4) - OR - * Apple's Software Downloads web site: Updating from Mac OS X 10.2.4: http://www.info.apple.com/kbnum/n120195 The download file is named: "1024SecUpd2003-03-03.dmg" Its SHA-1 digest is: 2eb722f340d4e57aa79bb5422b94d556888cbf38 Security Update 2003-03-03 for Mac OS X 10.1.5 is planned to be available on March 4. Information is also posted to the Apple Support web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQEVAwUBPmOrFyFlYNdE6F9oAQKKGwf+M/zZAtIErkTeyAvWvJ/JpltKxCpMDsTv vl0MBWLg/qtF6ZJdFOkwybpvMMzGK67B6MACH+42NMLPVA61iRLX551B5AYaG9Vv oBzDff89eMPxl+xcx+JK9mgkXRPkpSWw0XZxvLXagjhfWXlGAZbEF399os+/TTQF xvWOV4X6/v0D1KPmbOPmgRiOzjprS4cmDrI/LcKVkWFDLJVmDJ2LqoomIQmvldZQ wC3X/xrIqN0UUI368xfi8MTIIGwQmyNLG4SfqMU1GmyldsNCrRbj0PyQcunfUtmL pYmN6Lui5HI1QshnEQGrB4pcIpzdUrDsQIkW8yVfVMVHibkN/sTXlw== =0V8+ -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0