November 2005 - Security-announce

APPLE-SA-2005-11-30 J2SE 5.0 Release 3
by Apple Product Security 30 Nov '05

30 Nov '05

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-11-30 J2SE 5.0 Release 3 Available for: Mac OS X v10.4.2 or later with Java 1.3.1 and 1.4.2 Release 2 On November 28, 2005, Sun released Security Alerts #102003, #102050 and #102017. These alerts describe vulnerabilities that are already fixed in Mac OS X v10.4 with Java 1.3.1 & 1.4.2 Release 2 and J2SE 5.0 Release 3. Java 1.3.1 and 1.4.2 Release 2 have been available since September 13, 2005. J2SE 5.0 Release 3 has been available since November 15, 2005. These may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/java2se50release3.html http://www.apple.com/support/downloads/java131and142release2.html For Java 1.3.1 & Java 1.4.2: The download file is named: "Java131and142Release2.dmg" Its SHA-1 digest is: 9e9f752ff56da7ab13f3b11f40b528c901145019 For J2SE 5.0 Release 3: The download file is named: "J2SE50Release3.dmg" Its SHA-1 digest is: c5fe977bd9a2d145e9d122ed80768488c89dcc98 For systems running Mac OS X v10.3.9, the Sun alerts are fixed with Java Security Update, which was released on September 13, 2005. It is available either from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/javasecurityupdate.html The download file is named: "JavaSecurityUpdate4.dmg" Its SHA-1 digest is: b6babb98a98c20bdc7d2ca9b14c56b93ff3813a7 To determine that your system has the latest Java versions installed, start Terminal from Finder at Applications/Utilities/Terminal, and type: For Mac OS X v10.3.9 and Mac OS X v10.4.2 or later: /System/Library/Frameworks/JavaVM.framework/Versions/1.3.1/Commands/java - -version You should see: java version "1.3.1_16" /System/Library/Frameworks/JavaVM.framework/Versions/1.4.2/Commands/java - -version You should see: java version "1.4.2_09" For Mac OS X v10.4.2 or later: /System/Library/Frameworks/JavaVM.framework/Versions/1.5.0/Commands/java - -version You should see: java version "1.5.0_05" Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ44K0YHaV5ucd/HdAQK9nwf9F2kifsbQCm0lH62sXGxLC+UUvIfqL5R+ kBaEpNKH5QnnzthjTLxi8reeQ5bhjyoXUA8mhaY31q0imkLEeXueYGq8J/QPPk0n N+7BVXTXOxSpjISSDK98qfpg5NUNOvXQ43B/qW3RrJ27Zic0bunDfDc77UFSOnmj HwT6VmItXSwKMcM7Dz+Ha3gnxHZrUBFajB66l8xOb80FybE3tOF4St9CXwWyzYNv k7E6d7e0q4OFDAXtIHoLItNcYC9BqO2rRu5hFsCHBYfZ3aB/gShqmou959moMYpD uxl1QNpLmEywRVD1jjzEkD4J5bjvJ9jGOWiP5DMOL4A3V9hXZEF78Q== =e7Ly -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2005-11-29 Security Update 2005-009
by Apple Product Security 30 Nov '05

30 Nov '05

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-11-29 Security Update 2005-009 Re-send with corrected SHA-1 digests for download packages of Security Update 2005-009 for Mac OS X v10.4.3. No other information has been changed. Security Update 2005-009 is now available and delivers the following security enhancements: Apache2 CVE-ID: CVE-2005-2088 Available for: Mac OS X Server v10.3.9, Mac OS X Server v10.4.3 Impact: Cross-site scripting may be possible in certain configurations Description: The Apache 2 web server may allow an attacker to bypass protections using specially-crafted HTTP headers. This behavior is only present when Apache is used in conjunction with certain proxy servers, caching servers, or web application firewalls. This update addresses the issue by incorporating Apache version 2.0.55. apache_mod_ssl CVE-ID: CVE-2005-2700 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: SSL client authentication may be bypassed in certain configurations Description: The Apache web server's mod_ssl module may allow an attacker unauthorized access to a resource that is configured to require SSL client authentication. Only Apache configurations that include the "SSLVerifyClient require" directive may be affected. This update address the issue by incorporating mod_ssl 2.8.24 and Apache version 2.0.55 (Mac OS X Server). CoreFoundation CVE-ID: CVE-2005-2757 Available for: Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Resolving a maliciously-crafted URL may result in crashes or arbitrary code execution Description: By carefully crafting a URL, an attacker can trigger a heap buffer overflow in CoreFoundation which may result in a crash or arbitrary code execution. CoreFoundation is used by Safari and other applications. This update addresses the issue by performing additional validation of URLs. This issue does not affect systems prior to Mac OS X v10.4. curl CVE-ID: CVE-2005-3185 Available for: Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Visiting a malicious HTTP server and using NTLM authentication may result in arbitrary code execution Description: Using curl with NTLM authentication enabled to download an HTTP resource may allow an attacker to supply an overlong user or domain name. This may cause a stack buffer overflow and lead to arbitrary code execution. This update addresses the issue by performing additional validation when using NTLM authentication. This issue does not affect systems prior to Mac OS X v10.4. iodbcadmintool CVE-ID: CVE-2005-3700 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Local users may gain elevated privileges Description: The ODBC Administrator utility includes a helper tool called iodbcadmintool that executes with raised privileges. This helper tool contains a vulnerability that may allow local users to execute arbitrary commands with raised privileges. This update addresses the issue by providing an updated iodbcadmintool that is not susceptible. OpenSSL CVE-ID: CVE-2005-2969 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Applications using OpenSSL may be forced to use the weaker SSLv2 protocol Description: Applications that do not disable SSLv2 or that enable certain compatibility options when using OpenSSL may be vulnerable to a protocol downgrade attack. Such attacks may cause an SSL connection to use the SSLv2 protocol which provides less protection than SSLv3 or TLS. Further information on this issue is available at http://www.openssl.org/news/secadv_20051011.txt. This update addresses the issue by incorporating OpenSSL version 0.9.7i. passwordserver CVE-ID: CVE-2005-3701 Available for: Mac OS X Server v10.3.9, Mac OS X Server v10.4.3 Impact: Local users on Open Directory master servers may gain elevated privileges Description: When creating an Open Directory master server, credentials may be compromised. This could lead to unprivileged local users gaining elevated privileges on the server. This update addresses the issue by ensuring the credentials are protected. Safari CVE-ID: CVE-2005-2491 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Processing a regular expressions may result in arbitrary code execution Description: The JavaScript engine in Safari uses a version of the PCRE library that is vulnerable to a potentially exploitable heap overflow. This may lead to the execution of arbitrary code. This update addresses the issue by providing a new version of the JavaScript engine that incorporates more robust input validation. Safari CVE-ID: CVE-2005-3702 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Safari may download files outside of the designated download directory Description: When files are downloaded in Safari they are normally placed in the location specified as the download directory. However, if a web site suggests an overlong filename for a download, it is possible for Safari to create this file in other locations. Although the filename and location of the downloaded file content cannot be directly specified by remote servers, this may still lead to downloading content into locations accessible to other users. This update addresses the issue by rejecting overlong filenames. Safari CVE-ID: CVE-2005-3703 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: JavaScript dialog boxes in Safari may be misleading Description: In Safari, JavaScript dialog boxes do not indicate the web site that created them. This could mislead users into unintentionally disclosing information to a web site. This update addresses the issue by displaying the originating site name in JavaScript dialog boxes. Credit to Jakob Balle of Secunia Research for reporting this issue. Safari CVE-ID: CVE-2005-3705 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Visiting malicious web sites with WebKit-based applications may lead to arbitrary code execution Description: WebKit contains a heap overflow that may lead to the execution of arbitrary code. This may be triggered by content downloaded from malicious web sites in applications that use WebKit such as Safari. This update addresses the issue by removing the heap overflow from WebKit. Credit to Neil Archibald of Suresec LTD and Marco Mella for reporting this issue. sudo CVE-ID: CVE-2005-1993 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Local users may be able to gain elevated privileges in certain sudo configurations Description: Sudo allows system administrators to grant users the ability to run specific commands with elevated privileges. Although the default configuration is not vulnerable to this issue, custom sudo configurations may not properly restrict users. Further information on this issue is available from: http://www.sudo.ws/sudo/alerts/path_race.html This update addresses the issue by incorporating sudo version 1.6.8p9. syslog CVE-ID: CVE-2005-3704 Available for: Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: System log entries may be forged Description: The system log server records syslog messages verbatim. By supplying control characters such as the newline character, a local attacker could forge entries with the intention to mislead the system administrator. This update addresses the issue by specially handling control characters and other non-printable characters. This issue does not affect systems prior to Mac OS X v10.4. Credit to HELIOS Software GmbH for reporting this issue. Additional Information Also included in this update are enhancements to Safari to improve handling of credit card security codes (Mac OS X v10.3.9 and Mac OS X v10.4.3), CoreTypes to improve handling of Terminal files (Mac OS X v10.4.3), QuickDraw Manager to improve rendering of PICT files (Mac OS X v10.3.9), documentation regarding OpenSSH and PAM (Mac OS X v10.4.3), and ServerMigration to remove unneeded privileges. Security Update 2005-009 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.4.3 The download file is named: "SecUpd2005-009Ti.dmg" Its SHA-1 digest is: 5b9c8a08a46487b39b9ad530147bf1795fb4ac21 For Mac OS X Server v10.4.3 The download file is named: "SecUpdSrvr2005-009Ti.dmg" Its SHA-1 digest is: 7fea60219c6c3e5b3b4f4ea07f01d525f4f08ad6 For Mac OS X v10.3.9 The download file is named: "SecUpd2005-009Pan.dmg" Its SHA-1 digest is: ea17ad7852b3e6277f53c2863e51695ac7018650 For Mac OS X Server v10.3.9 The download file is named: "SecUpdSrvr2005-009Pan.dmg" Its SHA-1 digest is: b03711729697ea8e6b683eb983343f2f3de3af13 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ4z5koHaV5ucd/HdAQLS1gf/drwZ1OTl9fYpqwmrIeBHejjI3PKjN1Do /swlyBuqy0EvBRgVRQYnmVcwNJxvOlZGa6OnWG0CzjbGNZAtpLLGStgO6VW7vuUP xOQn3xjDCO343jBi6uQigCyh4DBhDINsuIvQPldkgpkRkIM86FAYEGlrGG28wjCP vX81EoSRzLQDMDyHBnS9k0+6I2U+i+tLmepCDPH3+hxWeERhaEcUmz64WPS0oaXU yfyX67n/XvhDHnrF5fceaLw+MzZmtIGOoFYTtSK3OgIRwlcYShdh00Cxm2fMaekq ECK3MOHjcqDdCuoJTIf5r6WIJPyR8hPEjSoF3ZruIqH2BkNrsFeqXQ== =Quw1 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2005-11-29 Security Update 2005-009
by Apple Product Security 29 Nov '05

29 Nov '05

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-11-29 Security Update 2005-009 Security Update 2005-009 is now available and delivers the following security enhancements: Apache2 CVE-ID: CVE-2005-2088 Available for: Mac OS X Server v10.3.9, Mac OS X Server v10.4.3 Impact: Cross-site scripting may be possible in certain configurations Description: The Apache 2 web server may allow an attacker to bypass protections using specially-crafted HTTP headers. This behavior is only present when Apache is used in conjunction with certain proxy servers, caching servers, or web application firewalls. This update addresses the issue by incorporating Apache version 2.0.55. apache_mod_ssl CVE-ID: CVE-2005-2700 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: SSL client authentication may be bypassed in certain configurations Description: The Apache web server's mod_ssl module may allow an attacker unauthorized access to a resource that is configured to require SSL client authentication. Only Apache configurations that include the "SSLVerifyClient require" directive may be affected. This update address the issue by incorporating mod_ssl 2.8.24 and Apache version 2.0.55 (Mac OS X Server). CoreFoundation CVE-ID: CVE-2005-2757 Available for: Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Resolving a maliciously-crafted URL may result in crashes or arbitrary code execution Description: By carefully crafting a URL, an attacker can trigger a heap buffer overflow in CoreFoundation which may result in a crash or arbitrary code execution. CoreFoundation is used by Safari and other applications. This update addresses the issue by performing additional validation of URLs. This issue does not affect systems prior to Mac OS X v10.4. curl CVE-ID: CVE-2005-3185 Available for: Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Visiting a malicious HTTP server and using NTLM authentication may result in arbitrary code execution Description: Using curl with NTLM authentication enabled to download an HTTP resource may allow an attacker to supply an overlong user or domain name. This may cause a stack buffer overflow and lead to arbitrary code execution. This update addresses the issue by performing additional validation when using NTLM authentication. This issue does not affect systems prior to Mac OS X v10.4. iodbcadmintool CVE-ID: CVE-2005-3700 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Local users may gain elevated privileges Description: The ODBC Administrator utility includes a helper tool called iodbcadmintool that executes with raised privileges. This helper tool contains a vulnerability that may allow local users to execute arbitrary commands with raised privileges. This update addresses the issue by providing an updated iodbcadmintool that is not susceptible. OpenSSL CVE-ID: CVE-2005-2969 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Applications using OpenSSL may be forced to use the weaker SSLv2 protocol Description: Applications that do not disable SSLv2 or that enable certain compatibility options when using OpenSSL may be vulnerable to a protocol downgrade attack. Such attacks may cause an SSL connection to use the SSLv2 protocol which provides less protection than SSLv3 or TLS. Further information on this issue is available at http://www.openssl.org/news/secadv_20051011.txt. This update addresses the issue by incorporating OpenSSL version 0.9.7i. passwordserver CVE-ID: CVE-2005-3701 Available for: Mac OS X Server v10.3.9, Mac OS X Server v10.4.3 Impact: Local users on Open Directory master servers may gain elevated privileges Description: When creating an Open Directory master server, credentials may be compromised. This could lead to unprivileged local users gaining elevated privileges on the server. This update addresses the issue by ensuring the credentials are protected. Safari CVE-ID: CVE-2005-2491 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Processing a regular expressions may result in arbitrary code execution Description: The JavaScript engine in Safari uses a version of the PCRE library that is vulnerable to a potentially exploitable heap overflow. This may lead to the execution of arbitrary code. This update addresses the issue by providing a new version of the JavaScript engine that incorporates more robust input validation. Safari CVE-ID: CVE-2005-3702 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Safari may download files outside of the designated download directory Description: When files are downloaded in Safari they are normally placed in the location specified as the download directory. However, if a web site suggests an overlong filename for a download, it is possible for Safari to create this file in other locations. Although the filename and location of the downloaded file content cannot be directly specified by remote servers, this may still lead to downloading content into locations accessible to other users. This update addresses the issue by rejecting overlong filenames. Safari CVE-ID: CVE-2005-3703 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: JavaScript dialog boxes in Safari may be misleading Description: In Safari, JavaScript dialog boxes do not indicate the web site that created them. This could mislead users into unintentionally disclosing information to a web site. This update addresses the issue by displaying the originating site name in JavaScript dialog boxes. Credit to Jakob Balle of Secunia Research for reporting this issue. Safari CVE-ID: CVE-2005-3705 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Visiting malicious web sites with WebKit-based applications may lead to arbitrary code execution Description: WebKit contains a heap overflow that may lead to the execution of arbitrary code. This may be triggered by content downloaded from malicious web sites in applications that use WebKit such as Safari. This update addresses the issue by removing the heap overflow from WebKit. Credit to Neil Archibald of Suresec LTD and Marco Mella for reporting this issue. sudo CVE-ID: CVE-2005-1993 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: Local users may be able to gain elevated privileges in certain sudo configurations Description: Sudo allows system administrators to grant users the ability to run specific commands with elevated privileges. Although the default configuration is not vulnerable to this issue, custom sudo configurations may not properly restrict users. Further information on this issue is available from: http://www.sudo.ws/sudo/alerts/path_race.html This update addresses the issue by incorporating sudo version 1.6.8p9. syslog CVE-ID: CVE-2005-3704 Available for: Mac OS X v10.4.3, Mac OS X Server v10.4.3 Impact: System log entries may be forged Description: The system log server records syslog messages verbatim. By supplying control characters such as the newline character, a local attacker could forge entries with the intention to mislead the system administrator. This update addresses the issue by specially handling control characters and other non-printable characters. This issue does not affect systems prior to Mac OS X v10.4. Credit to HELIOS Software GmbH for reporting this issue. Additional Information Also included in this update are enhancements to Safari to improve handling of credit card security codes (Mac OS X v10.3.9 and Mac OS X v10.4.3), CoreTypes to improve handling of Terminal files (Mac OS X v10.4.3), QuickDraw Manager to improve rendering of PICT files (Mac OS X v10.3.9), documentation regarding OpenSSH and PAM (Mac OS X v10.4.3), and ServerMigration to remove unneeded privileges. Security Update 2005-009 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.4.3 The download file is named: "SecUpd2005-009Ti.dmg" Its SHA-1 digest is: 544f51a7bc73a57dbca95e05693904aadb2f94b1 For Mac OS X Server v10.4.3 The download file is named: "SecUpdSrvr2005-009Ti.dmg" Its SHA-1 digest is: b7620426151b8f1073c9ff73b2adf43b3086cc60 For Mac OS X v10.3.9 The download file is named: "SecUpd2005-009Pan.dmg" Its SHA-1 digest is: ea17ad7852b3e6277f53c2863e51695ac7018650 For Mac OS X Server v10.3.9 The download file is named: "SecUpdSrvr2005-009Pan.dmg" Its SHA-1 digest is: b03711729697ea8e6b683eb983343f2f3de3af13 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.1 (Build 2185) iQEVAwUBQ4zotIHaV5ucd/HdAQJiPAf/S7bsLZk3R7I8FBidCKQ/bxSxjhTFx8sK vqsVFNDsXzv+tEa3IP58D8lI8lF94o+50p59qaPWxHzl4HxPVKlH4YCiBesYmVRp FcGo0qbzj5wJzdWADPV+I8O+/CR5k8J35PuKDIzPabnO67nxoXc/DF6go50e5Hr9 Yqs2477ufq0ANd8wG9dF5pfcYwD8KRLfOmfJ9ZVhbG8Up0uO4JH71cTQZIFcKkYf g6N9SCnqx5JqCwsRx85a8WuY1x97K3zqP53/bt4Wzi76VaaSaYj01nVywworTik4 YzOWOckJmWU9+66iby9mKY2mzz+u/vwtiMp577yT4y9FiSg6yp7mWQ== =jnz9 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2005-11-15 iTunes 6 for Windows
by Apple Product Security 15 Nov '05

15 Nov '05

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-11-15 iTunes 6 for Windows CVE-ID: CVE-2005-2938 Available for: Microsoft Windows XP and Microsoft Windows 2000 Impact: iTunes 5 for Windows may launch the wrong helper program Description: Due to the way iTunes 5 for Windows launches its helper application, multiple system paths are searched to determine which program to run. This may allow a malicious user on the local system to create an environment where an alternate program will be executed by iTunes. This has already been addressed in the iTunes 6 release for Windows, available from: http://www.apple.com/itunes/download/ This advisory is being released at this time to coordinate with other vendors whose products were also affected by their implementation of the helper application launch mechanism. Credit to iDEFENSE for reporting this issue. iTunes 6 for Windows may be obtained from: http://www.apple.com/itunes/download/ The download file is named: "iTunesSetup.exe" Its SHA-1 digest is: 56bc7f7d8f293e703fb3801cb07ec16aaaad20c5 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.1 (Build 2185) iQEVAwUBQ3pxoIHaV5ucd/HdAQI+jQf/bWOoNxMlOTGB+wtv2P5DDKDH1r1aecwz Kg5JfbApqTES/nFLE4mcnPfATVvhSXEQ0vgVEdYcf8u8p1LuvOYk4d5Tz/enBHDZ un4j085guj7mnEUspEwtDdV8b9Y88fYrGCOk72UpRpwz5/ENJlo9F44ZAQljX7OX TKYyDDqU1b7q3oWl6ziBPpmuOMDQ21tBs7QDZKmBd9U6dEg8JEWBo+OApnZMaaFF MUU2ChDV3A0TFW4/Do8mgj8zP19r9hu24PMZMF0Qbrb+wP5/XvLYB9DRrXQVenWl tVQBo4HDpSu2EHkyRvMonJ22Bu2MVks1MyG6v5Z8wQJvVMbknLhNKw== =OcPv -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2005-11-04 QuickTime 7.0.3
by Apple Product Security 04 Nov '05

04 Nov '05

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-11-04 QuickTime 7.0.3 QuickTime 7.0.3 delivers the following security enhancements: CVE-ID: CVE-2005-2753 Available for: Mac OS X v10.3.9 or later, Windows 2000/XP Impact: An integer overflow may be exploitable via remotely originated content Description: A sign extension of an embedded "Pascal" style string could result in a very large memory copy. The update treats the string as having unsigned length. Credit to Piotr Bania (bania.piotr(a)gmail.com) for reporting this issue. CVE-ID: CVE-2005-2754 Available for: Mac OS X v10.3.9 or later, Windows 2000/XP Impact: An integer overflow may be exploitable via remotely originated content Description: Improper movie attributes could result in a very large memory copy. The update checks for a valid non-zero size before copying. Credit to Piotr Bania (bania.piotr(a)gmail.com) for reporting this issue. CVE-ID: CVE-2005-2755 Available for: Mac OS X v10.3.9 or later, Windows 2000/XP Impact: A denial of service against any application loading remotely-originated content Description: A missing movie attribute is interpreted as an extension, but the absence of the extension is not flagged as an error, resulting in a de-reference of a NULL pointer. The update requires either the movie attribute or the extension to be present for a well-formed movie. Credit to Piotr Bania (bania.piotr(a)gmail.com) for reporting this issue. CVE-ID: CVE-2005-2756 Available for: Mac OS X v10.3.9 or later, Windows 2000/XP Impact: Compressed PICT data may overwrite application memory from remotely originated content Description: Expansion of compressed PICT data could exceed the size of the destination buffer. The update prevents decompressed data from exceeding the destination buffer size. Credit to Piotr Bania (bania.piotr(a)gmail.com) for reporting this issue. QuickTime 7.0.3 may be obtained from the Software Update pane in System Preferences, or from the Download tab in the QuickTime site http://www.apple.com/quicktime/ For Mac OS X v10.3.9 or later The download file is named: "QuickTimeInstallerX.dmg" Its SHA-1 digest is: 7e08669fe822c44d53f125e5c73bd65009c43e29 For Windows 2000/XP The download file is named: "iTunesSetup.exe" Its SHA-1 digest is: 56bc7f7d8f293e703fb3801cb07ec16aaaad20c5 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.2 (Build 2425) iQEVAwUBQ2ufToHaV5ucd/HdAQLnNQf9H01iKdIceozvnWYfHFbZP2cw2cCBdGni HWvZbsigLEWV+tXgjKUHzzcL+Z02r7m148h6kNHB0CnUqH0Y/M1/2Y7s5YzjsLOY x/iHVU6fPSheYu2BUVWRfRrrTBsVzInZu/5OixiBiXEVKvqki9ca37WcmN/7G1HU 5qmq/u9Ho0P+0Nnllfsu5JfdAvEprxW5uj4KVdgIqA14N4D9fh+9ZVOUdU692qSP lVIlEa571j9rLSlCNgLYWMZm08R101YAB5HJDgLXXtBpxV9GEe99rchxtjq8Q4Jt Lp01qSPMLHE+xnNVHtGYUIOqB/u9gb2+/QlmDlFbVAMnkxfHfuD20g== =5T9F -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0