May 2005 - Security-announce

APPLE-SA-2005-05-31 QuickTime 7.0.1
by Apple Product Security 31 May '05

31 May '05

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-05-31 QuickTime 7.0.1 QuickTime 7.0.1 is now available and delivers the following security improvement for the Quartz Composer Plugin: CVE-ID: CAN-2005-1334 Available for: QuickTime 7.0 Impact: With QuickTime 7.0, a QuickTime movie containing a maliciously crafted Quartz Composer object can leak a data to an arbitrary web location. Description: Quartz Composer objects can be wrapped in a QuickTime track, and can be delivered as a QuickTime movie. With QuickTime 7.0, a Quartz Composer object can gather local data and send it via an encoded URL to an arbitrary web location. The QuickTime 7.0.1 update modifies the QuickTime Quartz Composer Plugin to prevent access to remote web locations. This issue does not occur in QuickTime for Windows. Credit to David Remahl of www.remahl.se/david for reporting this issue. QuickTime 7.0.1 is available at http://www.apple.com/quicktime/download/mac.html for QuickTime version 7 The download file is named: "QuickTimeInstallerX.dmg" Its SHA-1 digest is: 4aa63c334280e69aa0cf5256ee4b3afed1d45c65 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQEVAwUBQpy9KYHaV5ucd/HdAQJxaAf/R8BKFFoN2nAXZzzRqNM1ZEFzE9E32WyF E0RoM2gFIaz5VtyTxr28UODhmbFLbN3I2wq18NXIOx6XMzhiA7K+thqj7yeqILkC jllxDmnuwrECSTDFZsJxU05tbD/xfvpbEDOoKNay741lGAVXDDwhjtZclWB44ZOr MQc5ufeE2h07jfj1/DXw8eZKEkn8ctOZQxtPSCRiVReYZMzWS6Ixe+Xj9XHCZXaS s6q2w6ecj01/DqfjeJMLUAiJAs2iB/KzAkoxUseenhh1wHLFqqYOdtksSRpTRtG+ E5MVdqeqt4DOyCF4Mz2SoYHl58DihDRU5DS5V4lljBuCU3ArW6fjZA== =/7H3 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

(no subject)
by Apple Product Security 26 May '05

26 May '05

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-05-25 Keynote 2.0.2 Keynote 2.0.2 is now available and delivers the following security improvement: CVE-ID: CAN-2005-1408 Impact: A maliciously modified Keynote presentation could be constructed to retrieve files from the local system Description: With a specially crafted Keynote presentation and the use of the "keynote:" URI handler, it is possible that local files could be read and then sent to an arbitrary network location. This issue has been addressed in two ways: references to external resources have been limited, and the registration of the "keynote:" URI handler has been removed. This issue does not affect Keynote versions prior to Keynote 2. Credit to David Remahl of www.remahl.se/david for reporting this issue. Keynote 2.0.2 is available at http://www.apple.com/iwork/keynote/download/ for Keynote versions 2 and 2.0.1 The download file is named: "Keynote2.0.2.dmg" Its SHA-1 digest is: 48e5befa0ef44b91fe3abd21a948e7ec4795a711 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQEVAwUBQpU98IHaV5ucd/HdAQLaNAf/a5a9TIF28L3jD+KwAVvgS+e5R7omo7MJ jaw0evZ96Iui9pKUYOZx2x2fvpMsVOumJzNQ84MDuJlzUeDK5xWa+mfE+zt5x+Ml 5+/8XVrRRAMrYfF6/7xD4YhdC9C7boe3LPH//GlPkczDezAqCr4bxL6ogE8F8Sl3 jBVjBM1OLKFeDTTVyKlz6aUVUejqvBLKLAjXFbYQLT7d46K4q56ysjqX3OdQ4ZRD 0bP1hDkV4/yUqOlxrF/w2gHelvl56QV97lKMyDkueB+hYkN4Ge5pFqbaC8n1GNRN 0VXDlUzj8OUKTujvivLWz/5QZrWLgruwd6QvO3HioAru7etsMX+HSQ== =qRIm -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2005-05-19 Mac OS X v10.4.1
by Apple Product Security 19 May '05

19 May '05

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-05-19 Mac OS X v10.4.1 Mac OS X v10.4.1 is now available and delivers the following security enhancements: Bluetooth Available for: Mac OS X v10.4, Mac OS X Server v10.4 CVE-ID: CAN-2005-1333 Impact: Directory traversal via Bluetooth file and object exchange Description: Due to insufficient input checking, the Bluetooth file and object exchange services could be used to access files outside of the default file exchange directory. This update addresses the issue by adding enhanced filtering for path-delimiting characters. Credit to kf_lists[at]digitalmunition[dot]com for reporting this issue. Dashboard CVE-ID: CAN-2005-1474 Available for: Mac OS X v10.4, Mac OS X Server v10.4 Impact: Malicious websites can download and install widgets via Safari without the Safe Download Validation warning Description: This update blocks the automatic installation of Dashboard widgets. Mac OS X's Safe Download Validation warning is enabled, requiring user approval before a Dashboard widget is installed by Safari. This issue does not affect Mac OS X versions prior to 10.4. Further information on removing Dashboard widgets that you have installed is available from this article: http://docs.info.apple.com/article.html?artnum=301629 Kernel CVE-ID: CAN-2005-1472 Available for: Mac OS X v10.4, Mac OS X Server v10.4 Impact: Users can discover the names of files placed in normally unsearchable places Description: Two system calls designed to allow efficient searching of filesystem objects incorrectly checked the permissions on enclosing directories and would reveal the names of files. The incorrect checking only occurred for directories without the POSIX read, but with the POSIX execute bits set for group and other. In practice this issue only affects files stored in users ~/Public/Drop Box. This update addresses the issue by correctly honoring the POSIX permission bits on directories. Credit to John M. Glenn of San Francisco for reporting this issue. Kernel CVE ID: CAN-2005-0974 CERT: VU#713614 Available for: Mac OS X v10.4, Mac OS X Server v10.4 Impact: Local system users can cause a local denial of service Description: A vulnerability in the nfs_mount() call due to insufficient checks on input values could allow unprivileged local users to create a denial of service via a kernel panic. SecurityAgent CVE-ID: CAN-2005-1473 Available for: Mac OS X v10.4, Mac OS X Server v10.4 Impact: Users with physical access to a system with a locked screensaver can start background applications Description: A contextual menu feature in Mac OS X 10.4 allows URLs to be opened from a text input field. This could be used to launch an application behind a locked screensaver window. This update addresses the issue by removing the contextual menu from screensaver text input fields. Mac OS X v10.4.1 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.4 The download file is named: "MacOSXUpdate10.4.1.dmg" Its SHA-1 digest is: 7f4e0af21fff6cb80d271ccd9278637c660b51ad For Mac OS X Server v10.4 The download file is named: "MacOSXSvrUpdate10.4.1.dmg" Its SHA-1 digest is: bf311da7dd3cc3f039ed9188412f8eaa994a4650 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQEVAwUBQo0amoHaV5ucd/HdAQLHMAgAjRkX8+OfCJ/qeXzJ+XixNa5c2rYktzCM etI9mBjEU3plouTkA7zP49F9+BSYaYilRZDFLwGrkGNBMrB9evcYUCAQuVQiFFV2 n+aRAgYGgTXv2IGbxf6//DTAeipzOT9WwzmzILXeNM69uRj8TMHl2v7ooDmIDSSK ke28UlZ9RpGPwUDwJ8clkJQZPvsIWllnsdZM2nQfR6PqVs3r8QLIMrcTcTAVMrr0 jUknS3CAUeiWNBnURDslDp5L+tQs9CCYTAhiS+nGIcfhha5dda+J/La7RB1wlNep PatMFO+E7v4/zlV7ALuPrYvT16I78QypdZScahy/4fXTrMKg1DZOWQ== =Dvj/ -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2005-05-09 iTunes 4.8
by Apple Product Security 09 May '05

09 May '05

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-05-09 iTunes 4.8 iTunes 4.8 is now available and, among other enhancements, delivers the following security improvement: CVE-ID: CAN-2005-1248 Impact: A buffer overflow in iTunes could cause a denial of service and lead to execution of arbitrary code Description: The MPEG4 file parsing code in iTunes versions prior to 4.8 contains a buffer overflow vulnerability. Parsing a maliciously-crafted MPEG4 file could cause iTunes to terminate or potentially execute arbitrary code. iTunes 4.8 addresses this issue by improving the validation checks used when loading MPEG4 files. Credit to Mark Litchfield of NGS Software for reporting this issue. iTunes 4.8 is freely available at http://www.apple.com/itunes/download/ for Mac OS X v10.2.8 or later, Microsoft Windows XP, and Microsoft Windows 2000 For Mac OS X: The download file is named: "iTunes4.8.dmg" Its SHA-1 digest is: 5a86f278f9f83192a7789ad123d5d62f67a6a316 For Windows 2000 or XP: The download file is named: "iTunesSetup.exe" Its SHA-1 digest is: 12582d193b27991c8f069331ab12d107c569bde2 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQEVAwUBQn+6yYHaV5ucd/HdAQLYzQf/SDN1AnjwypPbB7UuNOeR3PnBSNyV+Z1k L+EwCmtafm1tx2G8m8wAX0WYJ+k79cFSxfA7A8LzVGcZwN7uYjf7JT7YDmOHiMGB rJFKakNmP5iSfRObSKXylfUkjBMhriiQyYzBrsbtIPjHo/HhD3UCcKcOX0/ghFJn WPow+OatAPQWMV2ieyEDL1Yxr42SknmZrCEndrGDisPiT204R5SV38vAF4PDafbm 0/fB24UW2TPfAa/Ga50hO3IGEusAeeCRl/VJFI9bOmDcHLAAajNh9zWODZ/3j49S nbiuGlzyf23lI2mdmSZ743DxeuojIahM9wpotpWdqKMTyej4/DkbkA== =T7Wp -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

New PGP key for Apple Product Security
by Apple Product Security 04 May '05

04 May '05

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In accordance with established policy, we update the Apple Product Security PGP key once a year. Key information is available from our web site at: http://www.apple.com/support/security/pgp/ Here is our new PGP key which is effective immediately and valid until May 15, 2006. Key ID: 0x9C77F1DD Key Type: RSA Expires: 5/15/06 Key Size: 2048/2048 Fingerprint: 830F 4CB5 19C1 FC4D A512 2F45 81DA 579B 9C77 F1DD UserID: Apple Product Security - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGP 8.1 mQENBEJxhh8BCAC01U1charC3vsCbP3P2BWfyw+RLwy/0n4reCSpEYC25RT7BRwJ q92njTRLmEqulWSkzgN4PK5jYHTwfJf0zKPWDe5vrxlqUZ+mYc0kmI+SSGmBETY8 ZUAPuTAUKaR4oxHkaAPIkRHgVJMpkPfr0+aOI2JtY1jxDI3yT5nbhlphuM/BTfJs wVneaQgb5MvuzH4p8Wyetq2oLOm4u2OlW6sEtrhQ5S/daEewWKAxolV1JlFqjJOW rUGrSxdq45R+A1HGT6ZPop2nU3B5RppVGXoBpkfrUPPX7y7e7TfmdNv824dahsUN k9X4a5egsaOYs0zIT4GG7RJHEmWPpAr4ez93ABEBAAG0M0FwcGxlIFByb2R1Y3Qg U2VjdXJpdHkgPHByb2R1Y3Qtc2VjdXJpdHlAYXBwbGUuY29tPokBOQQQAQIAIwUC QnGGHwUJAfedAAcLCQgHAwIKAhkBBRsDAAAABR4BAAAAAAoJEIHaV5ucd/HdQBgH /Awfzn22OzdiB/lyp5hoSy2LbYkKogkHVYuBj2QhHPvSgo1g9tVsZWkBCm2sA6Cj Jvebq1a4XuaxS5Rd7DuLbWKP93/z4Ho7zxFgy/ehrHU72tEYhq0tIV0+CtNcf1xK ulBdNtiApWn3DYX8TU+HIzn+cX4Rn5GAvUk8lAlzW4HB1+ztsz0IbIdiw/yxKds4 FZB6e+ocouCMgNRXfUXqG+/CK/EAY9dVSic0bf7TIf1UQHV31WXFtPwYNgCbh5B1 zK9OmXMLMc3NHbc40gDCWVhDwVPhiUoK7BgPj0VRVdFelotleVRowbUCLBkvQeIw l6dgQT9HTr4aR5U2FYOcZdeJARUDBRBCcYbUnLDmjAjPhNABAjb6B/9SjKcjx8CF DpbLw5eGdzeMHkwRNXa+0kIhjSVFyir8zyl+VDTbvUcje7igveiSOkcXC2eazY9E qOMx0gUXX0FDqv6kBmtJ4QvJChO2obdd9aS0qNKMcCtneiM/bQ2SaxPDbYEtuHUh Kmm279USa9M27g77ofpN5p4tHFVCv0SM6iWBSvwER+0ZxvYMdOU09yCoeD1GhX6R OdFQfhG8qDHUJ2PrxNHYDn4c0h+biY13/2JWXDA5eItxugPDUdlysysXA76V/aL4 OUOHWw+dZtq9GQdrZcxSk6nt0R5ctzcvwzseIFBjKHrYatFIP78rFrt0gn8TdrM5 IHc/Afb4YuY3uQENBEJxhh8BCACxkWNFJVaex43Js1msCXiTxwaQuriGyolCV/vN li4HZNzrR50GagZl+BxzeVHcYR2pa6MO4uAO9VNIqq0IC5gqXJQzNgCTnVpHgIzJ 705zu2omeNu+uF4BA0M1g0sIlQwCptzDns4iL5eatZKak6GPkLwnzcC9Hh44YERa NB+etbFBNPL3MSHQaSuIY/NDOVe71xHmfwdaS+D1dTI0TTaIC/+V721mhn+Wxc3E Ol03UQOjV7qjnjGwI2VoyE/slOdhIME38RIUWGsQojV0NSAwGeXC0+DLbn8cW8/J JQVqFmYdvTyX/ipASHaV0Z//eiYYo8UVowaJkCcXEZhQMBM1ABEBAAGJASgEGAEC ABIFAkJxhh8FCQH3nQAFGwwAAAAACgkQgdpXm5x38d0bWQf/YT+GnHrYAezsNisV 8jWaz2lXloDilbTb6BmDkhe127U40DAZucYG2wZNdWawvuauLfOOxqW8m5g/DkIM EKBL67K5rx71Bkbj1AX+XrL6gIXgZj1nNGdNVUXcUu0M1Z9ZO7P8KYuEuyp9F7/r k2CzyXMjdr0pO076h5C851dOpObGYV6HiscteTx0O5Xb4gmbdDGWduvB5jQo6iEK u0+S/WNf3PyGt+aBCHaoIScyXrlN3aynn356xJ3qRaO0tZdZc0r0ZIzab8auX6nF p88CfXaGcIwKTdMwwyJPGDo+sv5LCat3gy5Uh0nx8G7aG9wlrj6cnL87Ev2DqiO6 TLbEaw== =FHy5 - -----END PGP PUBLIC KEY BLOCK----- This message is signed with the current key, which can be obtained from: http://www.apple.com/support/security/pgp/archive/ Apple Product Security team http://www.apple.com/support/security/ -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQEVAwUBQnkpx5yw5owIz4TQAQKnMwf+M0RM4sbzA/Az3YNBcUhae6SONT+WTTNL 58GWYIdwO3cT2XJNS++BkCzWfXyk6h38507+77g0HaxgOBL+NTL+uNphty8SaSJZ eqX7zROlnXnGdqJPWvVNCyfviuQVWmXdYRuE/lDgc0dCyHqTCPFC+Z6eRsFHziOs vQ0kjDJbJ+ACaaJpnA1BRopZoXjPTEPn+CXvVQ8Tp/K6i2x4JDywBk8N4tQOHpjr /h6bEiOzyTJo04xS2bCaYcZQ/ThsnjIJ446b4UmO6HoaRXaT1tCo4YKOZBGs4AqD 12SXtnfIMKnOs0gLG8LSk5AjizwR5zM60DTDkqVxbQaLc8G52QObWQ== =aJLh -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

Resend: APPLE-SA-2005-05-03 Security Update 2005-005
by Apple Product Security 03 May '05

03 May '05

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com Re-send with valid signature ... -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-05-03 Security Update 2005-005 Security Update 2005-005 is now available and delivers the following security enhancements: Apache CVE-ID: CAN-2005-1344 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: The htdigest program contains a buffer overflow, which if used improperly in a CGI application, could allow a remote system compromise Description: The htdigest program could be used in a CGI application to manage user access controls to a web server. htdigest contains a buffer overflow. This update fixes the buffer overflow in htdigest. Apple does not provide any CGI applications that use the htdigest program. Credit to JxT of SNOsoft for reporting this issue. AppKit CVE-ID: CAN-2004-1308, CAN-2004-1307 CERT: VU#125598, VU#539110 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: An integer overflow in the handling of TIFF files could permit arbitrary code execution Description: A malformed TIFF image could contain parameters that result in image data overwriting the heap. This issue has been addressed by adding additional tests when calculating the space needed for an image. AppKit CVE-ID: CAN-2005-1330 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: A Cocoa application will quit through an unhandled exception from NXSeek() Description: A malformed TIFF image can cause a call to NXSeek() with an offset outside the image. This raises an exception which is not handled. The default handler then causes the application to exit. This update causes an error to be returned to the application. Credit to Henrik Dalgaard of Echo One for reporting this issue. AppleScript CVE-ID: CAN-2005-1331 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Scripts created using the applescript: URI mechanism could display code differently than that which would actually run Description: The applescript: URI mechanism is a feature that allows AppleScript code to be distributed via a hyperlink. When an applescript: URI is clicked, the AppleScript Editor opens and displays the code that has been downloaded. If the code is then compiled and run, it may not execute exactly as it is displayed. This issue has been addressed by rejecting URIs containing characters that could be used to mislead the user. Credit to David Remahl of www.remahl.se/david for reporting this issue. Bluetooth CVE-ID: CAN-2005-1332 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Bluetooth-enabled systems may allow file exchange without prompting users Description: The Bluetooth file exchange service is enabled by default on systems with Bluetooth capability. This could allow files to be shared without properly notifying the user. In addition, the default directory for file sharing may be used by other applications, leading to unintentional file sharing. Security Update 2005-005 disables Bluetooth file exchange and changes the location of the default transfer directory on systems where the old default directory is set. In addition, new users of a system must now enable Bluetooth file exchange before it is allowed. Users with Bluetooth-enabled systems should read the article at http://docs.info.apple.com/article.html?artnum=301381 for more information on the changes provided by this update. Credit to kf_lists[at]digitalmunition[dot]com for reporting this issue. Bluetooth CVE-ID: CAN-2005-1333 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Directory traversal via Bluetooth file and object exchange Description: Due to insufficient input checking, the Bluetooth file and object exchange services could be used to access files outside of the default file exchange directory. Security Update 2005-005 addresses this issue by adding enhanced filtering for path-delimiting characters. Credit to kf_lists[at]digitalmunition[dot]com for reporting this issue. Directory Services CVE-ID: CAN-2005-1335 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: chfn/chpass/chsh could be manipulated to give privileges to an unprivileged user Description: chfn/chpass/chsh is a hard-linked set of SUID programs. Certain code paths use external helper programs in an insecure manner which could lead to a privilege escalation. This update provides secure mechanisms for running helper programs. Finder CVE-ID: CAN-2005-0342 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Unsafe handling of .DS_Store files could be used by local attackers to overwrite files and lead to privilege escalation Description: Finder uses .DS_Store files to store and retrieve information used to display folders on the system. When writing these files, Finder could follow a link resulting in the overwrite of an arbitrary file. In addition, these files could contain data supplied by malicious users, allowing them to gain privileges by altering system configuration files. Security Update 2005-005 addresses this issue by updating Finder to check that .DS_Store files are not links before writing to them. Foundation CVE-ID: CAN-2005-1336 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Buffer overflow via an environment variable for applications using the Foundation framework Description: The incorrect handling of an environment variable within the Foundation framework can result in a buffer overflow that may be used to execute arbitrary code. This issue has been addressed by improved handling of the environment variable. Help Viewer CVE-ID: CAN-2005-1337 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Help Viewer could be used to run Javascript without the restrictions normally imposed Description: When Javascript is loaded for a remote site, it is executed in a restricted environment. The environment restrictions are not applied for local Javascript files loaded by the Help Viewer. Security Update 2005-005 addresses this by only allowing Help Viewer to load registered pages. Credit to David Remahl of www.remahl.se/david for reporting this issue. LDAP CVE-ID: CAN-2005-1338 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Passwords could initially be stored into LDAP in plain text when using an LDAP server not running on Mac OS X Description: When a system is bound to an LDAP server that has "ldap_extended_operation" disabled or not supported, and new accounts are created using the Workgroup Manager, then the initial password can be stored in the clear. If the password is modified using the Inspector it will be correctly stored in a hashed form. This issue does not occur when using the Apple supplied Open Directory server. For servers not supporting "ldap_extended_operation", this update now stores new passwords in the hashed form. libXpm CVE ID: CAN-2004-0687 CERT: VU#882750 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: A vulnerability in the parsing of malformed XPM files could allow arbitrary code execution Description: The xpmParseColors() function in the XFree86 libXpm library contains a vulnerability in the parsing of malformed image files that may lead to a stack overflow and could allow arbitrary code execution. Images downloaded via a web browser may use the XPM format and allow remote exploitability. libXpm is not installed by default on Mac OS X or Mac OS X Server systems. It is an optional install item via the X11 package. Credit to Chris Evans <chris(a)scary.beasts.org> for reporting this issue. libXpm CVE ID: CAN-2004-0688 CERT: VU#537878 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: A vulnerability in the parsing of malformed XPM files could allow arbitrary code execution Description: Multiple libXpm routines contain integer overflow vulnerabilities that may allow an attacker to cause a denial-of-service condition or execute arbitrary code. Images downloaded via a web browser may use the XPM format and allow remote exploitability. libXpm is not installed by default on Mac OS X or Mac OS X Server systems. It is an optional install item via the X11 package. Credit to Chris Evans <chris(a)scary.beasts.org> for reporting this issue. lukemftpd CVE-ID: CAN-2005-1339 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: When using the chroot feature of ftp, users can bypass the restriction by using their full name Description: The ftp server allows users to login with either their full name or their short name. In order to restrict users to their home directory, all permitted login names must be listed in /etc/ftpchroot. Users are permitted to change their full name. This issue has been addressed by mapping full names to short names before checking the /etc/ftpchroot restriction list. Credit to Rob Griffiths of macosxhints.com for reporting this issue. NetInfo CVE-ID: CAN-2005-0594 Available for: Mac OS X Server v10.3.9 Impact: The Netinfo Setup Tool (NeST) contains a buffer overflow that could permit arbitrary code execution Description: NeST is a SUID tool. It contains a buffer overflow that could permit arbitrary code execution. This update prevents the buffer overflow from occurring. Credit to iDEFENSE Labs for reporting this issue. Server Admin CVE-ID: CAN-2005-1340 Available for: Mac OS X Server v10.3.9 Impact: Enabling the HTTP proxy service also enables it for users not on your network if there are no access restrictions Description: When the HTTP proxy service is enabled in Server Admin it does not restrict which networks can access it. If there are no external access controls, then users on the Internet can also use the proxy. The HTTP proxy service is disabled by default. This update adds a user interface component to Server Admin which allows the HTTP proxy to be restricted to local networks. sudo CVE-ID: CAN-2004-1051 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Bash scripts run via sudo can be subverted Description: Sudo versions prior to 1.6.8p2 do not properly sanitize their environment . A malicious local user with permission to run a bash shell script could exploit this to run arbitrary commands. Apple does not provide any pre-authorized bash shell scripts by default. This issue is addressed by removing bash shell functions from the environment before running subsequent commands. Terminal CVE-ID: CAN-2005-1341 CERT: VU#994510 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Malicious input could cause data to be inserted into a user's Terminal command line Description: The Terminal utility allows window titles to be read as input via a particular escape sequence. This could allow malicious content to inject data when it is displayed in a Terminal session. Security Update 2005-005 addresses the issue by removing handlers for this insecure escape sequence. Credit to David Remahl of www.remahl.se/david for reporting this issue. Terminal CVE-ID: CAN-2005-1342 CERT: VU#356070 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Escape characters embedded in x-man-path URIs could insert commands into a user's Terminal session Description: The x-man-path URI scheme provides support for displaying manual pages via the Terminal utility. Insufficient validation of these URIs can allow data to be inserted a Terminal session. Security Update 2005-005 addresses this by adding escape sequence validation to the URI handler. Credit to David Remahl of www.remahl.se/david for reporting this issue. VPN CVE-ID: CAN-2005-1343 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: A local user can obtain root privileges if the system is being used as a VPN server Description: A buffer overflow in "vpnd" could be used by a local user to obtain root privileges if the system is configured as a VPN server. This problem does not occur on systems that are configured as a VPN client. This issue cannot be exploited remotely. This update prevents the buffer overflow from occurring. Credit to Pieter de Boer of the master SNB at the Universiteit van Amsterdam (UvA) for reporting this issue. Security Update 2005-005 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.3.9 The download file is named: "SecUpd2005-005Pan.dmg" Its SHA-1 digest is: 81c479d52830163f0992482a0b3586acf2cb1cad For Mac OS X Server v10.3.9 The download file is named: "SecUpdSrvr2005-005Pan.dmg" Its SHA-1 digest is: eb3f5300e2c6062c10e9466eb3c822952e8aba83 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQEVAwUBQnf4upyw5owIz4TQAQJf3ggAk2JyzpL47gkJN1JiajlrCThvwxIDGFDT cM2LxLQjtLlysUqi0AxovdJ/D68DWZlsHQCdWYgVXIRP0Mg9W9nJEg9eXs474zoi foeDmGMPH4bVCnYvwp8c4IfCB8pkvON5jyh/kwYUQaYtE1Tm/ufN3fXz53kjJEFa /i+qfKbnC2rzzGe/HQsRhMO8ngnKMXp+ROezknBKLl9/teRpQMxZRFoU+8Oe8sQz yGp4+/VrIb05497AqMWqfHiak23a8s6c5up82cn+ggt/QCIPdeWKMn4+Aa2uTr1T Y284kk8Y6G8yiKHu8e9NXNol+Mo/WojJWj2L58Katk8zkCxu5Buc/w== =k6RY -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2005-05-03 Security Update 2005-005
by Apple Product Security 03 May '05

03 May '05

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2005-05-03 Security Update 2005-005 Security Update 2005-005 is now available and delivers the following security enhancements: Apache CVE-ID: CAN-2005-1344 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: The htdigest program contains a buffer overflow, which if used improperly in a CGI application, could allow a remote system compromise Description: The htdigest program could be used in a CGI application to manage user access controls to a web server. htdigest contains a buffer overflow. This update fixes the buffer overflow in htdigest. Apple does not provide any CGI applications that use the htdigest program. Credit to JxT of SNOsoft for reporting this issue. AppKit CVE-ID: CAN-2004-1308, CAN-2004-1307 CERT: VU#125598, VU#539110 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: An integer overflow in the handling of TIFF files could permit arbitrary code execution Description: A malformed TIFF image could contain parameters that result in image data overwriting the heap. This issue has been addressed by adding additional tests when calculating the space needed for an image. AppKit CVE-ID: CAN-2005-1330 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: A Cocoa application will quit through an unhandled exception from NXSeek() Description: A malformed TIFF image can cause a call to NXSeek() with an offset outside the image. This raises an exception which is not handled. The default handler then causes the application to exit. This update causes an error to be returned to the application. Credit to Henrik Dalgaard of Echo One for reporting this issue. AppleScript CVE-ID: CAN-2005-1331 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Scripts created using the applescript: URI mechanism could display code differently than that which would actually run Description: The applescript: URI mechanism is a feature that allows AppleScript code to be distributed via a hyperlink. When an applescript: URI is clicked, the AppleScript Editor opens and displays the code that has been downloaded. If the code is then compiled and run, it may not execute exactly as it is displayed. This issue has been addressed by rejecting URIs containing characters that could be used to mislead the user. Credit to David Remahl of www.remahl.se/david for reporting this issue. Bluetooth CVE-ID: CAN-2005-1332 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Bluetooth-enabled systems may allow file exchange without prompting users Description: The Bluetooth file exchange service is enabled by default on systems with Bluetooth capability. This could allow files to be shared without properly notifying the user. In addition, the default directory for file sharing may be used by other applications, leading to unintentional file sharing. Security Update 2005-005 disables Bluetooth file exchange and changes the location of the default transfer directory on systems where the old default directory is set. In addition, new users of a system must now enable Bluetooth file exchange before it is allowed. Users with Bluetooth-enabled systems should read the article at http://docs.info.apple.com/article.html?artnum=301381 for more information on the changes provided by this update. Credit to kf_lists[at]digitalmunition[dot]com for reporting this issue. Bluetooth CVE-ID: CAN-2005-1333 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Directory traversal via Bluetooth file and object exchange Description: Due to insufficient input checking, the Bluetooth file and object exchange services could be used to access files outside of the default file exchange directory. Security Update 2005-005 addresses this issue by adding enhanced filtering for path-delimiting characters. Credit to kf_lists[at]digitalmunition[dot]com for reporting this issue. Directory Services CVE-ID: CAN-2005-1335 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: chfn/chpass/chsh could be manipulated to give privileges to an unprivileged user Description: chfn/chpass/chsh is a hard-linked set of SUID programs. Certain code paths use external helper programs in an insecure manner which could lead to a privilege escalation. This update provides secure mechanisms for running helper programs. Finder CVE-ID: CAN-2005-0342 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Unsafe handling of .DS_Store files could be used by local attackers to overwrite files and lead to privilege escalation Description: Finder uses .DS_Store files to store and retrieve information used to display folders on the system. When writing these files, Finder could follow a link resulting in the overwrite of an arbitrary file. In addition, these files could contain data supplied by malicious users, allowing them to gain privileges by altering system configuration files. Security Update 2005-005 addresses this issue by updating Finder to check that .DS_Store files are not links before writing to them. Foundation CVE-ID: CAN-2005-1336 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Buffer overflow via an environment variable for applications using the Foundation framework Description: The incorrect handling of an environment variable within the Foundation framework can result in a buffer overflow that may be used to execute arbitrary code. This issue has been addressed by improved handling of the environment variable. Help Viewer CVE-ID: CAN-2005-1337 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Help Viewer could be used to run Javascript without the restrictions normally imposed Description: When Javascript is loaded for a remote site, it is executed in a restricted environment. The environment restrictions are not applied for local Javascript files loaded by the Help Viewer. Security Update 2005-005 addresses this by only allowing Help Viewer to load registered pages. Credit to David Remahl of www.remahl.se/david for reporting this issue. LDAP CVE-ID: CAN-2005-1338 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Passwords could initially be stored into LDAP in plain text when using an LDAP server not running on Mac OS X Description: When a system is bound to an LDAP server that has "ldap_extended_operation" disabled or not supported, and new accounts are created using the Workgroup Manager, then the initial password can be stored in the clear. If the password is modified using the Inspector it will be correctly stored in a hashed form. This issue does not occur when using the Apple supplied Open Directory server. For servers not supporting "ldap_extended_operation", this update now stores new passwords in the hashed form. libXpm CVE ID: CAN-2004-0687 CERT: VU#882750 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: A vulnerability in the parsing of malformed XPM files could allow arbitrary code execution Description: The xpmParseColors() function in the XFree86 libXpm library contains a vulnerability in the parsing of malformed image files that may lead to a stack overflow and could allow arbitrary code execution. Images downloaded via a web browser may use the XPM format and allow remote exploitability. libXpm is not installed by default on Mac OS X or Mac OS X Server systems. It is an optional install item via the X11 package. Credit to Chris Evans <chris(a)scary.beasts.org> for reporting this issue. libXpm CVE ID: CAN-2004-0688 CERT: VU#537878 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: A vulnerability in the parsing of malformed XPM files could allow arbitrary code execution Description: Multiple libXpm routines contain integer overflow vulnerabilities that may allow an attacker to cause a denial-of-service condition or execute arbitrary code. Images downloaded via a web browser may use the XPM format and allow remote exploitability. libXpm is not installed by default on Mac OS X or Mac OS X Server systems. It is an optional install item via the X11 package. Credit to Chris Evans <chris(a)scary.beasts.org> for reporting this issue. lukemftpd CVE-ID: CAN-2005-1339 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: When using the chroot feature of ftp, users can bypass the restriction by using their full name Description: The ftp server allows users to login with either their full name or their short name. In order to restrict users to their home directory, all permitted login names must be listed in /etc/ftpchroot. Users are permitted to change their full name. This issue has been addressed by mapping full names to short names before checking the /etc/ftpchroot restriction list. Credit to Rob Griffiths of macosxhints.com for reporting this issue. NetInfo CVE-ID: CAN-2005-0594 Available for: Mac OS X Server v10.3.9 Impact: The Netinfo Setup Tool (NeST) contains a buffer overflow that could permit arbitrary code execution Description: NeST is a SUID tool. It contains a buffer overflow that could permit arbitrary code execution. This update prevents the buffer overflow from occurring. Credit to iDEFENSE Labs for reporting this issue. Server Admin CVE-ID: CAN-2005-1340 Available for: Mac OS X Server v10.3.9 Impact: Enabling the HTTP proxy service also enables it for users not on your network if there are no access restrictions Description: When the HTTP proxy service is enabled in Server Admin it does not restrict which networks can access it. If there are no external access controls, then users on the Internet can also use the proxy. The HTTP proxy service is disabled by default. This update adds a user interface component to Server Admin which allows the HTTP proxy to be restricted to local networks. sudo CVE-ID: CAN-2004-1051 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Bash scripts run via sudo can be subverted Description: Sudo versions prior to 1.6.8p2 do not properly sanitize their environment . A malicious local user with permission to run a bash shell script could exploit this to run arbitrary commands. Apple does not provide any pre-authorized bash shell scripts by default. This issue is addressed by removing bash shell functions from the environment before running subsequent commands. Terminal CVE-ID: CAN-2005-1341 CERT: VU#994510 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Malicious input could cause data to be inserted into a user's Terminal command line Description: The Terminal utility allows window titles to be read as input via a particular escape sequence. This could allow malicious content to inject data when it is displayed in a Terminal session. Security Update 2005-005 addresses the issue by removing handlers for this insecure escape sequence. Credit to David Remahl of www.remahl.se/david for reporting this issue. Terminal CVE-ID: CAN-2005-1342 CERT: VU#356070 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: Escape characters embedded in x-man-path URIs could insert commands into a user's Terminal session Description: The x-man-path URI scheme provides support for displaying manual pages via the Terminal utility. Insufficient validation of these URIs can allow data to be inserted a Terminal session. Security Update 2005-005 addresses this by adding escape sequence validation to the URI handler. Credit to David Remahl of www.remahl.se/david for reporting this issue. VPN CVE-ID: CAN-2005-1343 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 Impact: A local user can obtain root privileges if the system is being used as a VPN server Description: A buffer overflow in "vpnd" could be used by a local user to obtain root privileges if the system is configured as a VPN server. This problem does not occur on systems that are configured as a VPN client. This issue cannot be exploited remotely. This update prevents the buffer overflow from occurring. Credit to Pieter de Boer of the master SNB at the Universiteit van Amsterdam (UvA) for reporting this issue. Security Update 2005-005 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.3.9 The download file is named: "SecUpd2005-005Pan.dmg" Its SHA-1 digest is: 81c479d52830163f0992482a0b3586acf2cb1cad For Mac OS X Server v10.3.9 The download file is named: "SecUpdSrvr2005-005Pan.dmg" Its SHA-1 digest is: eb3f5300e2c6062c10e9466eb3c822952e8aba83 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP 8.1 iQEVAwUBQnfhP5yw5owIz4TQAQLM0gf/ac2bQDY6G+rY27jv0BWXrij0GM9Ay+vk g9ikbfpVL/IgQLdpjllpn4dHj5NT0l+3TmQmZ1ACkVCsp+tmjr1TXt5k6siy+iHH RvMZqQGYs7CPZsmqY9bvQpGVHM38E+fo4nn7t00LasCzGuJxDzJqeEswEjN+ANV4 Tj+CYFmJXieWcczt/0QLcDQdLohXxTRy+sgYzABOO0A91KqRixO2Y+cHjCBsp5jg OzcMVxg37Rez+w8U29tDfUiZoUCGcxGfGhIAPPQp0GFE2wW0cJ+JJe7Yk3LAVefG dyFZV5qky9pY8t52Vuw0J+QAJhKWwqkCw67gNrZsOw2Dq/AD9hnMFQ== =MIEm -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0