May 2004 - Security-announce

APPLE-SA-2004-05-28 Mac OS X 10.3.4
by Apple Product Security 29 May '04

29 May '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2004-05-28 Mac OS X Update 10.3.4 Mac OS X Update 10.3.4 is now available and contains security enhancements for the following: NFS: Improves logging when tracing system calls. Credit to David Brown <dave(a)spoonguard.org> for reporting this issue. LoginWindow: Improves the handling of directory services lookups and console log files. Credit to aaron(a)vtty.com for reporting the issue. Packaging: Improves package installation. Credit to aaron(a)vtty.com for reporting the isssue. TCP/IP: provides better handling of out-of-sequence TCP packets. AppleFileServer: Improves the use of SSH and reporting errors. Terminal: Improves the handling of URLs. Credit to Rene Puls <rpuls(a)gmx.net> for reporting this issue. Note: CVE Candidate IDs will be published to the Security Updates page when available: http://docs.info.apple.com/article.html?artnum=61798 ================================================ Mac OS X 10.3.4 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: Updating from Mac OS X 10.3.3 ============================= http://www.apple.com/support/downloads/macosxupdate_10_3_4.html The download file is named: "MacOSXUpdate10.3.4.dmg" Its SHA-1 digest is: dd2e1576cfd2792f0c012d552d41556192ce7415 Updating from Mac OS X 10.3 - 10.3.2 ==================================== http://www.apple.com/support/downloads/macosxcombined1034update.html The download file is named: "MacOSXUpdateCombo10.3.4.dmg" Its SHA-1 digest is: 061a2560cdd239e8d60e36678a3ea31d1aef5534 Updating from Mac OS X Server 10.3.3 ==================================== http://www.apple.com/support/downloads/macosxupdate_10_3_4.html The download file is named: "MacOSXServerUpdate10.3.4.dmg" Its SHA-1 digest is: c9d04735eb1b381fe8786cc1424fa734abb28c32 Updating from Mac OS X Server 10.3 - 10.3.2 =========================================== http://www.apple.com/support/downloads/macosxcombinedserver1034update. html The download file is named: "MacOSXSrvrUpdCombo10.3.4.dmg" Its SHA-1 digest is: 2579754ab996c4e070bd3bd7c3789792754e6adc Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQEVAwUBQLfX+Jyw5owIz4TQAQK+sgf9H3P1/mVZGdqjnejfIezii+jzQnZZaZuv tCbePSyLEKrn6evHZvUyEdRVIpcbZAU3ymxCNPgg/Mv5gdln/PAdUSYb/wvtUbxM CB08zYqpD8IsPS5zay8SotYPJsXw+RagbI4zjB8i+mm9Wep/R/zu/iC0G/3/6ItN qeD8hTF0spGqSrGR0XAUiIBKmUCvel4KFcvxADwGrjCjCUOleQlwE8+nkdUc3/Cd 53oREzuqsboTjaQOcqAToj9n9JzT9R5Oip0PngkXOloAp8ITKQAj6kLrAYMxTe5l piMH6xElS8VydC7M1wZchUxYHdhKFtlHC/6fWPP/k2vT/QGyt7+pWA== =C0Or -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0

APPLE-SA-2004-05-21 Security Update 2004-05-24
by Apple Product Security 22 May '04

22 May '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2004-05-21 Security Update 2004-05-24 Security Update 2004-05-24 is now available and contains security enhancements for the following: HelpViewer: Fixes CAN-2004-0486 to ensure that HelpViewer will only process scripts that it initiated. Credit to lixlpixel <me(a)lixlpixel.com> for reporting this issue. This issue has been widely reported as a problem with the Safari web browser, but can affect other web browsers. This update will fix the issue for Safari and other web browsers. Terminal: Fixes CAN-2004-0485 to improve URL processing within Terminal. Credit to Reni Puls <rpuls(a)gmx.net> for reporting this issue. ================================================ Security Update 2004-05-24 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: For Mac OS X 10.3.3 "Panther" and Mac OS X 10.3.3 Server ======================================================== http://www.apple.com/support/downloads/securityupdate__2004-05-24_( 10_3_3).html The download file is named: "SecUpd2004-05-24Pan.dmg" Its SHA-1 digest is: 8e505ac4e36393f44e9d1b27ac0bd9a9e9f5b6a2 For Mac OS X 10.2.8 "Jaguar" and Mac OS X 10.2.8 Server ======================================================= http://www.apple.com/support/downloads/securityupdate_2004-05-24_( 10_2_8).html The download file is named: "SecUpd2004-05-24Jag.dmg" Its SHA-1 digest is: 8c084551505fb4e7131afbf8bce14475bdc5f946 Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQEVAwUBQK6iU5yw5owIz4TQAQILmQgAk3/3Ia/WtAVYx3DjK46A/EdaHFiWFBkm wZAoj0YNCMbjrKJviqthqNRBQsro08WKDA9/xBJ94drHNfTye9WwRuFYa5zg7SnV JIVxcHHxv4qVn5zWy147fCCA+Xdoe45pWOBr2tQ4FM0HtI3mY2C2qlhNznUePRI3 E8FhgLV9QPaXwaBp/Lcn2/CbFbAY5jjpPRd+fEq2jcphkDW4+zgLn0O8SjSEyc7w +XgYC8Ku/o+GAPNYjZ8oKMLzGeWlCxHpiMjQH9Lauq7U3/u1rqL6LG7bsqei3eEC x7CIALNsXoGTV58dPq+yYr51IjnLnj1deGX3ZMikjK/k85639ADEYA== =2I2M -----END PGP SIGNATURE----- [demime 0.98b removed an attachment of type application/pkcs7-signature which had a name of smime.p7s] _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0

Apple Product Security PGP key updated
by Apple Product Security 18 May '04

18 May '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In accordance with established policy, we update the Apple Product Security PGP key once a year. Key information is available from our web site at: http://www.info.apple.com/usen/security/security_pgp.html Here is our new PGP key which is effective immediately and valid until May 15, 2005. Key ID: 0x08CF84D0 Key Type: RSA Expires: 5/15/05 Key Size: 2048/2048 Fingerprint: ADDE FA62 D9B7 013E 07BC 8971 9CB0 E68C 08CF 84D0 UserID: Apple Product Security - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGP 8.0.2 mQENBECS0jcBCAC6IwH8fWxHUKJ0bSymxiAze6WPHtJLluDoZOfsXg0YoO68K1ll Bqqp7X0timHdjE+GD9y2Bnc7nTCiI8GX/QWqBq3VjV4Wb1EmdaLQmK7EpZ0AlVng eJXMLzxFR0NMohxn81fkqOln2VNlfU0SC2nRDwkZdUZAtwGeMcnlsM7esxb0tW9Y 50Gwd0ogc0FmS95T28gJapHyYAD+9zUVBo7LdiHAcCH1Pe5DQL0BiuT1PjEaq1cK uFHJ7iG3QQp3d02AnHYXbXsNicgPmXqThNxRhgtHCmIwLA8NMmjGNe1ZVth2BGzO q5DADYjWXqX4oAECuqCzOhk62mziefxhYf3TABEBAAG0M0FwcGxlIFByb2R1Y3Qg U2VjdXJpdHkgPHByb2R1Y3Qtc2VjdXJpdHlAYXBwbGUuY29tPokBMwQQAQIAHQUC QJLSNwUJAfT6AAcLCQgHAwIKAhkBBRsDAAAAAAoJEJyw5owIz4TQvx0IAK73Tv4G nch+rywsCbHGmCr6Cww3UEpU2KMwP8VkW8PueUnGibBSwfFhnUGhvnwCANnXRuzq DacpL/uc35yTAzEfKUaSBJWGgiDojj8rvGMVWmYcnTOmS+oWoT0xUx7UIPQM3clv e6Nk0FR9L4yd6Z+vuDk+uiCXEWRWQrEU3z3DW6zVi85hZTGV0pAsgGrRdSkjM60I hJEcAJxqNdetDOjp0CBbVaW2xvWWiVdtPR+Ok7/8krt98c0tSr1EDQNatkchc7d0 Ms2xpfMLyFYVFkb8RE0jXhbCV6M6FsQcRGs07+ZN8JPxXFY59p/apybUNxId3pGS lcjv3Wp9Aq7hiT6JARUDBRBAktL9d4jTPpvMWvQBAoHTCADFTdJ5UCgkkiE3LymT OSojoJaofF0nEfqZLca82/WWccG1mq7PxhGITmj6n+L3ZOWxGa+89jCbQ7P8iyE9 jYAuDHHqiAjEu3K8RXbPdvIhGG75BoQfj4/OU9+poq4AyrmPSeyyI5STiXl821v6 bVSajRyUA86cl/UihM2wUy9EJfgcLOxkvfK3VwtH+Wz2sP3trTU/e2t9JlpM6nqk RVt6uE0DMEUq2cgoIW4geHDhKE6eBlix5BwcomsDTB/h9WzO8Gjiy7ViPiu8eaon jZ3z8qWwaX+6p1dYzaHzgOhKrCt0CTUc+rPtzIABtBOKuRSJd8fJ6SgLmJQDvfiA HVSeuQENBECS0jsBCADMgtjLSbvA/8LQ1iIqjVpx/DB7SrgSwcxYKiAPfblWVzeA YydtiA49Ni7QZBLkneNwP7lBSI7YtJiHCPxlyiJHWyQgY24LqGbiHVl3IT7+sYJf LIluJce7JxdpOlZoFS2t5pflbGgNJ1K13vp3gNZODZowBmzCOQkxxJkcZztUQCut gqnU0vjN70e/AXWMAFdc2T4JaRMoJfeQXv/TTgG/KVkX0BDQUlZ9I5cxrVof09ns 8ljr3+J66oEGjYshvNdSivzVcOS62l0MlMz2h4hmuiO9LeMV4cwkNFFDXF7n2wKj wVEbsGDwwfgwc4ZaHo0lEWaeb1jlz8b+8K4YWEwHABEBAAGJASgEGAECABIFAkCS 0jsFCQH0+gAFGwwAAAAACgkQnLDmjAjPhNC2pwgAtqP2nxxz15zQ+l0dEEbJ811C YZV5I/NIwTSaKPO6KBt8Xln2CNAIO6y65RL+OzLuerKMSy7YQOwXHBVQOydh2JeR XwUckFEDb6AxRu/7AuTYkiQk2c3jMbJPqTGUC8RqKMxuFxxnK9dZuPNJcEv2p7uI W4iO2Szc1nsvBT7JtuPlN6j0yUlUsq1zJLQOn0LHqkiWOPW/NspK4Izc75RW6EGH vFaqhx88Y91E7E5psjfQ6t5VUip9c17aGVvCdrYBz2L7Oz0e8przWg/use/Y5TnH cd9cIuncMyEk+FVaEet5WC8/MF3HLrADKeb748HBENOYXwXo1xZesMJiCA2yjg== =ynQ7 - -----END PGP PUBLIC KEY BLOCK----- This message is signed with the current key, which can be obtained from: http://www.info.apple.com/usen/security/security_pgp_archive.html Apple Product Security team http://www.apple.com/support/security/ -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQEVAwUBQJLg/HeI0z6bzFr0AQJJTwgAwJZ4RlYn5crWetfM6RC5P2ClXT1i2Q9t lup3vjHMIQyPySMSlmM+hWfz5Rh3ypgl8VBs3IZrEU2tszpS/2TfJeA7R9yEtLI0 SzwjJynD/DhiDL1jKqJOguUaDJGKTUzyXI8FzhbKpPUJ7uJemovf82UqalVAbsjp 4X2zJgYdDJ98W7GKijGMfNdkaU4H+VFZ2pbMN6E0KtYZImJj13qMcC1B6NYHKCT4 B3uUY0M+DxIGss9ur27z0AAlenaH4XyZwMvrAT49hWtRI18Zxw93FDtPRsRxI/zw AyZU+PO0JVumxVcArGMxMfU6tERFoXcLpCqpPD9x/vLPLq0mjoddig== =HMeT -----END PGP SIGNATURE----- [demime 0.98b removed an attachment of type application/pkcs7-signature which had a name of smime.p7s] _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0

Re: Encrypted document
by Apple Product Security 16 May '04

16 May '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Please disregard the message below. We are not sure how it was sent, and any messages should require explicit admin approval. Will contact our listadmin on Monday to see what may have happened. All legitimate messages to this list are signed with the Apple Product Security PGP key, available from: http://www.info.apple.com/usen/security/security_pgp.html Apple Product Security team http://www.apple.com/support/security/ PGP Key ID: 0x08CF84D0 Fingerprint: ADDE FA62 D9B7 013E 07BC 8971 9CB0 E68C 08CF 84D0 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= On May 16, 2004, at 9:43 AM, rond(a)apple.com wrote: > See attach. > > [demime 0.98b removed an attachment of type application/octet-stream which had a name of Message.com] -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQEVAwUBQKef1Jyw5owIz4TQAQIWVwf/ReWXdGaD/FetUppE8D2UkulLMJVjaGy8 1QkHgS8sAA9Tlrj2+NfJ4hK/ZjIiD+j+0rQbed//zKf/mGEFj2va6djWvRpD2jdX TS9jCh2jkwaPIEQB3iAagPDheXIaOOesKX9JBhOTayinMKgVIco/rnIaeGViahFU MhxxCqgTcLfPOXzXxUDufFIVzCPM3EOnludSVUeOumUdUa7UvYmR9UOD4jrXPpbb hdhA3uzdnxJ+WhbSpQym7+fkJghUH0QYrKG//QCMa/SOveJNM3h2kDRY+TBCxai4 27OOC3Rp2/ifEwzULMcUAiGyjK8wnTIjG0z+Ke7Un5dPgXC+1L/T+Q== =CB6s -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0

Encrypted document
by rond＠apple.com 16 May '04

16 May '04

See attach. [demime 0.98b removed an attachment of type application/octet-stream which had a name of Message.com] _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0

APPLE-SA-2004-05-03 Security Update 2004-05-03
by Apple Product Security 03 May '04

03 May '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2004-05-03 Security Update 2004-05-03 Security Update 2004-05-03 is now available and contains security enhancements for the following: CoreFoundation: Fixes CAN-2004-0428 to improve the handling of an environment variable. Credit to aaron(a)vtty.com for reporting this issue. Apache 2: Fixes CAN-2003-0020, CAN-2004-0113 and CAN-2004-0174 by updating to Apache 2 to version 2.0.49. RAdmin: Fixes CAN-2004-0429 to improve the handling of large requests AppleFileServer: Fixes CAN-2004-0430 to improve the handling of long passwords. Credit to Dave G. from @stake for reporting this issue. IPSec: Fixes CAN-2004-0155 and CAN-2004-0403 to improve the security of VPN tunnels. IPSec in Mac OS X is not vulnerable to CAN-2004-0392. Notes: - Security Update 2004-05-03 is available for both Mac OS X 10.3.3 and Mac OS X 10.2.8 - Security Update 2004-04-05 has been incorporated into this update ================================================ Security Update 2004-05-03 may be obtained from: * Software Update pane in System Preferences * Apple's Software Downloads web site: For Mac OS X 10.3.3 "Panther" ============================= http://download.info.apple.com/Mac_OS_X/061-1213.20040503.vngr3/2Z /SecUpd2004-05-03Pan.dmg The download file is named: "SecUpd2004-05-03Pan.dmg" Its SHA-1 digest is: 6f35539668d80ee536305a4146bd982a93706532 For Mac OS X Server 10.3.3 ========================== http://download.info.apple.com/Mac_OS_X/061-1215.20040503.mPp9k/2Z /SecUpdSrvr2004-05-03Pan.dmg The download file is named: "SecUpdSrvr2004-05-03Pan.dmg" Its SHA-1 digest is: 3c7da910601fd36d4cdfb276af4783ae311ac5d7 For Mac OS X 10.2.8 "Jaguar" ============================= http://download.info.apple.com/Mac_OS_X/061-1217.20040503.BmkY5/2Z /SecUpd2004-05-03Jag.dmg The download file is named: "SecUpd2004-05-03Jag.dmg" Its SHA-1 digest is: 11d5f365e0db58b369d85aa909ac6209e2f49945 For Mac OS X Server 10.2.8 ========================== http://download.info.apple.com/Mac_OS_X/061-1219.20040503.Zsw3S/2Z /SecUpdSrvr2004-05-03Jag.dmg The download file is named: "SecUpdSrvr2004-05-03Jag.dmg" Its SHA-1 digest is: 28859a4c88f6e1d1fe253388b233a5732b6e42fb Information will also be posted to the Apple Product Security web site: http://www.apple.com/support/security/security_updates.html This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.2 iQEVAwUBQJa38XeI0z6bzFr0AQKEjAf9HAvSxFVwKjmzZ1ZcqmVWhCfkNA9TIby7 Z9WOeAIhSFX1GVyetjQIeODLBYVj8bACK2fDj+deRv60VC6IQOxQNTSI5EwlkI/O Tnz9q77WwV0IaNugfZHWQglKiH6j5ZhMg9xZUQTEpJChPS6u0NN3J4nhj7diqlbK 4a6N+HLQ4jQvk4hpQoFYRGOVnHzso2SJpKUN5uJ2obTSUw528Gchugr1Uez4/m9G Pb5BZewX877Qc3t1icnlNxSXSru2TIrqef4+ZuJlek5N8lN0oda2KQ7pvkc0/raO oJnLTiJoGFxLV5jLw7PBd7bIRpUJXZa/xtyg1lj8XUf0r5SFGRVwww== =wmAo -----END PGP SIGNATURE----- _______________________________________________ security-announce mailing list | security-announce(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/security-announce Do not post admin requests to the list. They will be ignored.

1 0