June 2006 - Security-announce

APPLE-SA-2006-06-29 Mac OS X v10.4.7 package revision
by Apple Product Security 29 Jun '06

29 Jun '06

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2006-06-29 Mac OS X v10.4.7 package revision Mac OS X v10.4.7 was released on Tuesday of this week. The install package that upgrades a Mac OS X v10.4.6 (Intel) system is being revised. The revision is to provide several files related to OpenGL performance that were missing. Only the package that upgrades a Mac OS X v10.4.6 (Intel) system to Mac OS X v10.4.7 (Intel) is being changed. All other Mac OS X v10.4.7 install packages remain unchanged. The change being made to the install package does not affect the security fixes provided in the package. The new package is named: MacOSXUpd10.4.7Intel.dmg It's SHA-1 digest is: 10aa57dfccd63accb0939a894cea202a8910fb45 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQEVAwUBRKRAnomzP5/bU5rtAQiVxAgAi6LFb43HfHsRpMjpI1KUa+0meMZag6/w fOlqsBpcU2MWZYMXRRAv/UPV+Z8IBVQG8jHWciSjxlx8IrwI/lHGtC90YceCTHJN 2TRTob6UY7cItM5y/g12kCMki0+TMnrF2okvxImN1aVfcq3qxmRJXLzPYVieRF+s U0IWfCZw/4F669BuEE1q1KYbiz3UOHEgtNlEBE0CaR5ZWaLb7Z6EGg2gcA2Rx3PT WMbOFJDPPszu1tPMPGmMnPJoMHTcG7jOvcvgA99yoQlwGU/jXZwjP7lTFwblZMAa NQWGbfTM69TbhAbUlW4bVXVblfBERT+CNUEgg3ntwlIenikZwIi35g== =Qntc -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2006-06-29 iTunes 6.0.5
by Apple Product Security 29 Jun '06

29 Jun '06

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2006-06-29 iTunes 6.0.5 iTunes 6.0.5 is now available and, in addition to its other content, fixes the following security issue: CVE-ID: CVE-2006-1467 Available for: Mac OS X v10.2.8 or later, Windows XP / 2000 Impact: An integer overflow in iTunes could cause a denial of service or lead to the execution of arbitrary code Description: The AAC file parsing code in iTunes versions prior to 6.0.5 contains an integer overflow vulnerability. Parsing a maliciously-crafted AAC file could cause iTunes to terminate or potentially execute arbitrary code. iTunes 6.0.5 addresses this issue by improving the validation checks used when loading AAC files. Credit to ATmaCA working with TippingPoint and the Zero Day Initiative for reporting this issue. iTunes 6.0.5 may be obtained from: http://www.apple.com/itunes/download/ For Mac OS X: The download file is named: "iTunes6.0.5.dmg" Its SHA-1 digest is: 668d53a8ca8126a852a470e4b9f7b13c0ecd3db3 For Windows 2000 or XP: The download file is named: "iTunesSetup.exe" Its SHA-1 digest is: 0a82011b904e9fea33b1482deaea93094e008d96 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQEVAwUBRKQn3omzP5/bU5rtAQiG8Qf+K+LYZD/PUTorONxQrCQyLUFNQhJlamQy SL13vqin0o8ogAUQuleAxuwvBPKkopdPTNadkmuABMTXFD+uDv+CyDUE3Z+93rqf d7cC6o1e/GPZIvxyhBkZNZ9R0KsXypxIJdWTGUYECpCtf1GoVtPHut1GTqbqr1h1 qKnjzMhEqtLAlc+kjbPEhB3plEI4ga0YjhYQBLHtpAfVYIvhfJJkhZpynfsMwzpj QXYdUAMlglwjAKNk/JkNJ9TsG4xRGxKuL3WGPxzzOgb5sAcex+/yn0njrWMHLVbx tauOneVnh9CLRTDeYEohk+H/LhUSspnvR7c/bKt2zIC/+RMHjx091w== =ibCr -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2006-06-27 Mac OS X v10.4.7
by Apple Product Security 27 Jun '06

27 Jun '06

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2006-06-27 Mac OS X v10.4.7 Mac OS X v10.4.7 is now available and addresses the following issues: AFP CVE-ID: CVE-2006-1468 Available for: Mac OS X v10.4 - v10.4.6, Mac OS X Server v10.4 - v10.4.6 Impact: File and folder names may be disclosed to unauthorized users Description: An issue in AFP server allows search results to include the names of files and folders for which the user performing the search has no access. This could result in information disclosure if the names themselves are sensitive information. This update addresses the issue by ensuring that search results only include items for which the user is authorized. This issue does not affect systems prior to Mac OS X v10.4. ClamAV CVE-ID: CVE-2006-1989 Available for: Mac OS X Server v10.4 - v10.4.6 Impact: When virus scanning is configured to update automatically, a malicious database mirror may cause arbitrary code execution Description: An issue in ClamAV's automatic virus database updating may result in a stack-based buffer overflow. A malicious or spoofed ClamAV database mirror may be able to cause arbitrary code execution with the privileges of ClamAV. The Mail service, virus scanning, and automatic virus database updates are off by default. This update addresses the issue by incorporating ClamAV 0.88.2. This issue does not affect systems prior to Mac OS X v10.4. ImageIO CVE-ID: CVE-2006-1469 Available for: Mac OS X v10.4 - v10.4.6, Mac OS X Server v10.4 - v10.4.6 Impact: Viewing a maliciously-crafted TIFF image may result in an application crash or arbitrary code execution Description: By carefully crafting a corrupt TIFF image, an attacker can trigger a stack-based buffer overflow which may result in an application crash or arbitrary code execution. This update addresses the issue by performing additional validation of TIFF images. This issue does not affect systems prior to Mac OS X v10.4. launchd CVE-ID: CVE-2006-1471 Available for: Mac OS X v10.4 - v10.4.6, Mac OS X Server v10.4 - v10.4.6 Impact: Local users may gain elevated privileges Description: A format string vulnerability in the setuid program launchd may allow an authenticated local user to execute arbitrary code with system privileges. The issue is present in launchd's logging facility. This update addresses the issue by performing additional validation when logging messages. This issue does not affect systems prior to Mac OS X v10.4. Credit to Kevin Finisterre of DigitalMunition for reporting this issue. OpenLDAP CVE-ID: CVE-2006-1470 Available for: Mac OS X v10.4 - v10.4.6, Mac OS X Server v10.4 - v10.4.6 Impact: Remote attackers may cause Open Directory server to crash Description: By carefully crafting an invalid LDAP request, a remote attacker may be able to trigger an assertion in the OpenLDAP server, resulting in a denial-of-service. This update addresses the issue by discarding the invalid request. This issue does not affect systems prior to Mac OS X v10.4. Credit to the Mu Security research team for reporting this issue. Mac OS X v10.4.7 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.4.6 (PowerPC) The download file is named: "MacOSXUpd10.4.7PPC.dmg" Its SHA-1 digest is: 223d1fc9197a6a96c9d2f2a9110d37abc219c3a6 For Mac OS X v10.4 (PowerPC) through v10.4.6 (PowerPC) The download file is named: "MacOSXUpdCombo10.4.7PPC.dmg" Its SHA-1 digest is: c5c45dd81429520338caaef012b7da0e01a41f84 For Mac OS X v10.4.6 (Intel) The download file is named: "MacOSXUpd10.4.7Intel.dmg" Its SHA-1 digest is: 2a25ed61d586b71ba7282fb896b2c910785ff358 For Mac OS X v10.4.4 (Intel) or v10.4.5 (Intel) The download file is named: "MacOSXUpdCombo10.4.7Intel.dmg" Its SHA-1 digest is: 15b186d5f3a2314a060df3502eda190ad31a354d For Mac OS X Server v10.4.6 The download file is named: "MacOSXServerUpdate10.4.7.dmg" Its SHA-1 digest is: d83c3f6266f95f16e4b3abaebb6cdc89100dc41b For Mac OS X Server v10.4 through v10.4.6 The download file is named: "MacOSXSrvrUpdCombo10.4.7.dmg" Its SHA-1 digest is: 9ec47d4111072c3b908958a95459d0b18173e08c Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQEVAwUBRKAfQomzP5/bU5rtAQjr6ggA0zNiC8PFRj0oSNrzgxp/TqS1BTG7row/ XRL+kQxjeTWZiI7eFQAbVzMSQqkxXRz9umblzUTk1KKZ5ZjIEihW9VxglEjCO23n osDGKIQrzLsJu0hn0PsamqB3yORZrYJST2JVOSpR6TFOxHW3zhLwQ4lZhbSevM/5 oY1vfDS3ov2sJRT/HSp9TMyfNArt2G06hlFPbsWXq3BmMOTGKocrvpQAu4gJD2f7 1yAMuTeZ/yGc0xhzN6iyoZuGZLU2cPNKKC/n+kE/SR68ODYQqWxDuDirNNu3Jp6G X7XiSSoioPEaFdbeSY1P4nkbVnuOwUOTzl4E9WfzTCFKUF3bU3MN7Q== =nyI/ -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0