May 2007 - Security-announce

APPLE-SA-2007-05-31 Xserve Lights-Out Management Firmware Update 1.0
by Apple Product Security 31 May '07

31 May '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2007-05-31 Xserve Lights-Out Management Firmware Update 1.0 Xserve Lights-Out Management Firmware Update 1.0 is now available. Along with functionality improvements (see release notes), it also addresses the following security issue: Xserve Lights-Out Management Firmware CVE-ID: CVE-2007-2387 Available for: Intel-based Xserve systems Impact: A remote user may be able to gain admin privileges on an Xserve system with IPMI configured in a particular manner Description: A security vulnerability in Apple's implementation of IPMI may allow an unprivileged ipmitool user to gain administrative privileges on an Xserve system. This update addresses the issue by requiring a password for remote usage of IPMI. This issue only affects Intel-based Xserve systems. Credit to James Wilson of LithiumCorp for reporting this issue. Xserve Lights-Out Management Firmware Update 1.0 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ The download file is named: "LOMUpdate.dmg" Its SHA-1 digest is: ee757ce005e627872535eb2a707785f556d636a7 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQEVAwUBRl8ZqsgAoqu4Rp5tAQj7ggf+Pr7tvWBYrWonkrtg3TVnBblw8Fn+ESZb ZUPbnrazCarkVFjOBuk792YC6Rj8CmSvtyZdQ3QZiQDUucbeXYHjeb2z22pEhDLH Zg02Ut9FKIRgGz8QKBvqDkbr5QS+qWZutuHN7AcjcceACaXcJoAOXNOS9wNpdrLZ gNg+AsMc274CJB6eUZBhp28MwwmKl9oQEr4shYaJ8t81jGG8yXm/UitYDfyakyOq ZJPhMW6SmN8RtN/vYatX0fKrNzVuPgh811ngbEoGuVgSulQZ3sifzvhJoN8iF1Yi 3Lszn1EdY5MnnMJVeyA0f3IfTN8AmXW3/17gjcFAv1l8UJwjo51U0g== =pJ+A -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2007-05-29 Security Update (QuickTime 7.1.6)
by Apple Product Security 29 May '07

29 May '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2007-05-29 Security Update (QuickTime 7.1.6) Security Update (QuickTime 7.1.6) is now available and provides the following security enhancements: QuickTime CVE-ID: CVE-2007-2388 Available for: QuickTime 7.1.6 on Mac OS X and Windows Impact: Visiting a malicious website may lead to arbitrary code execution Description: An implementation issue exists in QuickTime for Java, which may allow instantiation or manipulation of objects outside the bounds of the allocated heap. By enticing a user to visit a web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to arbitrary code execution. This update addresses the issue by performing additional validation of Java applets. Credit to John McDonald, Paul Griswold, and Tom Cross of IBM Internet Security Systems X-Force, and Dyon Balding of Secunia Research for reporting this issue. QuickTime CVE-ID: CVE-2007-2389 Available for: QuickTime 7.1.6 on Mac OS X and Windows Impact: Visiting a malicious website may lead to the disclosure of sensitive information Description: A design issue exists in QuickTime for Java, which may allow a web browser's memory to be read by a Java applet. By enticing a user to visit a web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to the disclosure of sensitive information. This update addresses the issue by clearing memory before allowing it to be used by untrusted Java applets. Security Update (QuickTime 7.1.6) may be obtained from the Software Update application, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For QuickTime 7.1.6 on Mac OS X The download file is named: "SecUpdQuickTime716.dmg" Its SHA-1 digest is: 960b3d043366f214c62e94fc176e5e367eb75992 For QuickTime 7.1.6 on Windows The download file is named: "SecUpdQuickTime716.msi" Its SHA-1 digest is: 1ab14df3c1ef6f15d082cb5c13e9898097816ea9 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQEVAwUBRlyGJ8gAoqu4Rp5tAQj2kQf/Tpr4eaxB4begtn5Abd1LhpcdfR997AVQ gPF4r7m7dqElMA0st1Dg5hCOE5qH/nDA+3f9UitutPKayOFP2lM0xRIPkLyKP08x MFZO9A8wKV4XRy0S0SVUx6oRWJDvotZ9k/Eino0ci6OFnjnCPbVhoc19mIjl/P0c MTi/pWtYPe9lypbroTTMj+Iu7kco2Q8D2p3mCdzirzXFcgYpqUOoKdjInisQyTOH wEzo5G+hS14AOpN5+T4+yrlx27BPYeJ9YSNk1Fh5F4JA7pbUUGWWcl5DlnAOpOZ9 lLnjZRoC6R9Jphy+Zn3DYcxNu5xU/vYWeF6kkOyLXBKr2AXUuSYsqg== =ycXf -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2007-05-24 Security Update 2007-005
by Apple Product Security 24 May '07

24 May '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2007-05-24 Security Update 2007-005 Security Update 2007-005 is now available and addresses the following issues: Alias Manager CVE-ID: CVE-2007-0740 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, Mac OS X Server v10.4.9 Impact: Users may be misled into opening a substituted file Description: In certain circumstances, an implementation issue in Alias Manager will not show identically-named files contained in identically-named mounted disk images. By enticing a user to mount two identically-named disk images, an attacker could mislead the user into opening a malicious program. This update addresses the issue by performing additional validation of mountpaths. Credit to Greg Bolsinga of Blurb, Inc. for reporting this issue. BIND CVE-ID: CVE-2007-0493, CVE-2007-0494, CVE-2006-4095,CVE-2006-4096 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, Mac OS X Server v10.4.9 Impact: Multiple vulnerabilities in BIND, the most serious of which is remote denial of service Description: BIND is updated to version 9.3.4. Further information is available via the ISC web site at http://www.isc.org/index.pl?/sw/bind/ CoreGraphics CVE-ID: CVE-2007-0750 Available for: Mac OS X v10.4.9, Mac OS X Server v10.4.9 Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow vulnerability exists in the handling of PDF files. By enticing a user to open a maliciously crafted PDF file, an attacker could trigger the overflow which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of PDF files. This issue does not affect systems prior to Mac OS X v10.4. crontabs CVE-ID: CVE-2007-0751 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, Mac OS X Server v10.4.9 Impact: The daily /tmp cleanup script may lead to a denial of service Description: Filesystems mounted in the /tmp directory may be deleted when the daily cleanup script is executed, which may lead to a denial of service. This update addresses the issues by updating the daily cleanup script to prevent find commands from descending into mounted filesystems. fetchmail CVE-ID: CVE-2007-1558 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, Mac OS X Server v10.4.9 Impact: fetchmail password disclosure may be possible Description: fetchmail is updated to version 6.3.8 to address a cryptographic weakness that could lead to the disclosure of fetchmail passwords. Further information is available via the fetchmail web site at http://fetchmail.berlios.de/fetchmail-SA-2007-01.txt file CVE-ID: CVE-2007-1536 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, Mac OS X Server v10.4.9 Impact: Running the file command on a maliciously crafted file may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow vulnerability exists in the file command line tool, which may lead to an unexpected application termination or arbitrary code execution. This update addresses by performing additional validation of files that are passed to the file command. iChat CVE-ID: CVE-2007-2390 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, Mac OS X Server v10.4.9 Impact: An attacker on the local network may be able to cause a denial of service or arbitrary code execution Description: A buffer overflow vulnerability exists in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) code used to create Port Mappings on home NAT gateways in iChat. By sending a maliciously crafted packet, an attacker on the local network can trigger the overflow which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation when processing UPnP protocol packets in iChat. mDNSResponder CVE-ID: CVE-2007-2386 Available for: Mac OS X v10.4.9, Mac OS X Server v10.4.9 Impact: An attacker on the local network may be able to cause a denial of service or arbitrary code execution Description: A buffer overflow vulnerability exists in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) code used to create Port Mappings on home NAT gateways in the OS X mDNSResponder implementation. By sending a maliciously crafted packet, an attacker on the local network can trigger the overflow which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation when processing UPnP protocol packets. This issue does not affect systems prior to Mac OS X v10.4. Credit to Michael Lynn of Juniper Networks for reporting this issue. PPP CVE-ID: CVE-2007-0752 Available for: Mac OS X v10.4.9, Mac OS X Server v10.4.9 Impact: A local user may obtain system privileges Description: An implementation issue exists in the PPP daemon when loading plugins via the command line, which allows a local user to obtain system privileges. This update addresses the issue by allowing only the superuser to load plugins. This issue does not affect systems prior to Mac OS X v10.4. Credit to an anonymous researcher working with the iDefense VCP for reporting this issue. ruby CVE-ID: CVE-2006-5467, CVE-2006-6303 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, Mac OS X Server v10.4.9 Impact: Denial of service vulnerabilities in the Ruby CGI library Description: Multiple denial of service issues exist in the Ruby CGI library. By sending maliciously crafted HTTP requests to a web application using cgi.rb, an attacker could trigger an issue which may lead to a denial of service. This update addresses the issues by applying the Ruby patches. screen CVE-ID: CVE-2006-4573 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, Mac OS X Server v10.4.9 Impact: Multiple denial of service vulnerabilities in GNU Screen Description: The screen command line tool is updated to address multiple denial of service vulnerabilities. Further information is available via the GNU web site at http://lists.gnu.org/archive/html/screen-users/2006-10/msg00028.html texinfo CVE-ID: CVE-2005-3011 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, Mac OS X Server v10.4.9 Impact: A local user may cause another user running texinfo to overwrite arbitrary files Description: A file handling issue exists in texinfo, which may allow a local user to create or overwrite files with the privileges of the user running texinfo. This update addresses the issue through improved handling of temporary files. VPN CVE-ID: CVE-2007-0753 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9, Mac OS X Server v10.4.9 Impact: A local user may obtain system privileges Description: A format string vulnerability exists in vpnd. By running the vpnd command with maliciously crafted arguments, a local user can trigger the vulnerability which may lead to arbitrary code execution with system privileges. This update addresses the issue by performing additional validation of the arguments passed to vpnd. Credit to Chris Anley of NGSSoftware for reporting this issue. Security Update 2007-005 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.4.9 (PowerPC) and Mac OS X Server v10.4.9 (PowerPC) The download file is named: "SecUpd2007-005Ti.dmg" Its SHA-1 digest is: 7cad5f9bd497af88342ace4f908679e186d11540 For Mac OS X v10.4.9 (Universal) and Mac OS X Server v10.4.9 (Universal) The download file is named: "SecUpd2007-005Univ.dmg" Its SHA-1 digest is: 539f872ac444dc707d73991a914c58ed32d51677 For Mac OS X v10.3.9 The download file is named: "SecUpd2007-005Pan.dmg" Its SHA-1 digest is: 2dfb56137a47a9e1b335efc7aa5bf405cc8e046e For Mac OS X Server v10.3.9 The download file is named: "SecUpdSrvr2007-005Pan.dmg" Its SHA-1 digest is: 5673f4e3b99cd2c27d46a80892453298f5ba43cb Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQEVAwUBRl3R98gAoqu4Rp5tAQjQWgf8D4RFX0EDEDWptthJwtclmQOu55ODBDNO ZZ5n1dT+YjIDUVrF1IyY09BfMbEh/CGggF0M6NS7P5gHuDVfQ2+XxJ/fnIpY3uUo rSEQ2PCrunzreIU3Fti9A7ihUwFUK8Fo06jb1/3BaWquiHkb6KDxG75H3xWjzFph 6l25qEzNi7Pg5z9MF3UbX1mepABf2F2NpmiKmyuraOzdLVbkUOrqHMwkErnERV19 T3skYrbISlLRSDtCmpGJ9jGJ33vmmQJ60uHarF6uw6KwQnb8vNJycuX3SHgHNCt+ lVpaXmDb6YzdhkDPu7Pwxi5Hh32Ll07aa5GNu6t/FU1ELhqkViwVNw== =tkfV -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

Apple Product Security - New PGP Key
by Apple Product Security 14 May '07

14 May '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 In accordance with established policy, we update the Apple Product Security PGP key once a year. Key information is available from our web site at: http://www.apple.com/support/security/pgp/ Here is our new PGP key which is effective immediately and valid until May 15, 2008. Key ID: 0xB8469E6D Key Type: RSA Expires: 5/15/08 Key Size: 2048/2048 Fingerprint: FD20 40DB F7BC 37B9 6E78 4C3B C800 A2AB B846 9E6D UserID: Apple Product Security - - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGP Desktop 9.0.6 (Build 6060) mQENBEZB/6QBCAC/U3woSXiu6dqr8fteNkr/07W9uBtzfXwcFBNXMC3JE9Dn5uAP qvqL9Dzwr9zgMFKtXGPMu6qc0f1Rq07ZInspcOq7jPgKfw7Jn0fAGUOOcTZSnTuA v8zEg6jmWnlrwt8aEQyHY5WcHkYYfGFnyqaYgPXM8Oknggq1rmmwRPKKnmp2gmyO KlaOBby7tD8qoWJ3LwSAdxSrlJZbo3qTHKBZInDfhp7wdXuKaaLmzvpzN+Lnev+W +h79dtRsKoy4Aiy7iknehrG9VOWkjR8oKPWAgZcxXNy7Dqk761+rGvrcpHvXqQtt X3LB3ve4x/6R1fqgo8YXaB4YfQqrnsIJbHqdABEBAAG0M0FwcGxlIFByb2R1Y3Qg U2VjdXJpdHkgPHByb2R1Y3Qtc2VjdXJpdHlAYXBwbGUuY29tPokBjgQQAQIAeAUC RkIAXAUJAepuADAUgAAAAAAgAAdwcmVmZXJyZWQtZW1haWwtZW5jb2RpbmdAcGdw LmNvbXBncG1pbWUHCwkIBwMCCgIZARkYbGRhcDovL2tleXNlcnZlci5wZ3AuY29t BRsDAAAABBYDAgEFHgEAAAAEFQgJCgAKCRDIAKKruEaebd3EB/956t2/qJKCPg43 MfX39Wms/wfmyB/V6MQuMvuYMa7qyPa4c7MWA/ORGPT51WyvIlfufBpyIM98+h2t Qovz+HPoHglSXMTAMjHeDgk/r3O75Iimpr0cvw58v8gvvJG253Tj2qPJW43fkMDW ZkWURYSgdLKhX+wZWsGMjqFRaQB/2Xgo9ZezhIBcDbfFZI3diAULc0hiPPHlUmny r8O5dY9lUHkCIPWtgWkVLVXsgZCBe6440ceDPsgqR+76J5KPXDqvDMYIfma0AyF7 M12ZnhVUuRniqC8DzkrrhIjs3jnZiliiOsHCQy8MKw0xEkBI2cqm8rEaEgEOTSd6 JGXohvyZtEBBcHBsZSBQcm9kdWN0IFNlY3VyaXR5PHByb2R1Y3Qtc2VjdXJpdHkt bm9yZXBseUBsaXN0cy5hcHBsZS5jb20+iQGLBBABAgB1BQJGQgBcBQkB6m4AMBSA AAAAACAAB3ByZWZlcnJlZC1lbWFpbC1lbmNvZGluZ0BwZ3AuY29tcGdwbWltZQcL CQgHAwIKGRhsZGFwOi8va2V5c2VydmVyLnBncC5jb20FGwMAAAAEFgMCAQUeAQAA AAQVCAkKAAoJEMgAoqu4Rp5tSQgH/1EVTjwJZO/YiTk8Blm/BTFYP190UUwwai9T NlPzS9iKo8gy2ud2oas6SlvTl88N8SvQYfdJ0pBy9eK5nI3r9l/YXy3zveh2oPUT wgYnOtPoASgPv85rzUsHpB/9OXNvjC1Y61HlBEGqrJRZk3byfFEgHBbSFYvT53Zd LesMETU36Yxp2Fx2qtOskCidaFm3BDQmicf8Lp7X06U6hgnSvCIuSoGfMMhLCL51 k+Kvxmla2Qy7FBkbzJPg/kGbckhxWVSkzm4QsDHYu6YKnpjlPX2/Jh6bZU3cDyiW Ds9m3j9QrZ8FZEosRKXhICJWScutiCfWkojpsIGQaPvPFhNI8Y+5AQ0ERkH/pAEI ALvp0NefkmbbJE1sYXiaY0Y8tuCatW5iFT9izQunVX2vpx/U943pqinqo4cEM3o4 u9Tm/My9PlDTPKc8q+vBrrCWu4szapC0nG/5qLW2J895TL4C5SuRJ7uDaDB7ESIQ Y3ttNYnn/rpLmRXd3RLnJ3Q3KH88OEd5G3HMNJOyhN617VdbaSplfCI8NY8R8ERb x5HjAi8l0p/kvK5LOPts6LvdpM/dnkORH0N0u6UBOSSFWgxM4zUZCYf02H3ZX1aF lHe6fKwmWG7HPdfATGDWxVbp/ANyzTFolzP+viBDmDRPOAVLEM/9xzHTC/j5AW49 5aR7xWdOcdStJUV/c9XXOb0AEQEAAYkBKAQYAQIAEgUCRkH/pAUJAepuAAUbDAAA AAAKCRDIAKKruEaebbVyB/0ewa7Y9RJV/i5xpk81UkaqwZVxOlgsJBnswlGFIDLw ZEqmWWGZk5hHiON+c1HBNtMSFafR0+fXbef6mytto2SrgRlwx4ym940Aq02lFtP3 bwje2DjkXfw9Ur6QVSS7cDlTn5naF4SBB35tTREDSj7cH8nq7Xn0d4CMZpZQsnF5 f05eZuOpP92RRLQggrYwvD5hfRMovt2PS/A/0bvQKP1G7r1jdepv7inBYLWgHMA3 GHjUng1AeaPEPGQbJE7HgYZDr8OAbReCXb30+PPu0yg6uyvvqYy9ZzsUWCKdfX0v Lpn1LrbXk9eXJau5zL0Wp00aKCOItGM36B5rVu+XfPns =HSS8 - - -----END PGP PUBLIC KEY BLOCK----- This message is signed with the current key, which can be obtained from: http://www.apple.com/support/security/pgp/archive/ Apple Product Security team http://www.apple.com/support/security/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQEVAwUBRkjELImzP5/bU5rtAQjVywf+IbsizcIqDcma4B5c1+18SY4NTBYXRoHU tZBFxxda7Bnuz0EgaBfx5aVwR19C8CsBpMtWmEPKvac/MfSrB3qpC9BRY+v6Ln8o TPrjo23BD3396FnIQMIEGU3uExeIUfK0bJ+U6fjVLHpcP4ntw0t4P6GpNDMor/0R DqcC76kqAQeA01XZZal+qW+E3t0KgJRGen81B/HCz9Np71+zGljNkDmbNNNvSjeK gEfILne5EFCVw17JAH3b5Quz6Ztuxw3dbPC89pORovP8U5gHSKxynAVNc0AD/7Th CClLL4as3ZVjOu6PiaIUbrZL09V8W6fuXOh+Whi9ID/UfJXt72mRmA== =j1hh -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2007-05-10 Darwin Streaming Server 5.5.5
by Apple Product Security 10 May '07

10 May '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2007-05-10 Darwin Streaming Server 5.5.5 Darwin Streaming Server is an open source project available via: http://developer.apple.com/opensource/server/streaming/index.html Darwin Streaming Server 5.5.5 is now available and addresses the following security issues: Darwin Streaming Server CVE-ID: CVE-2007-0749 Impact: A remote attacker may be able to cause an unexpected application termination or arbitrary code execution Description: A stack buffer overflow exists in the Darwin Streaming Proxy. By sending maliciously-crafted RTSP requests, a remote attacker can trigger the overflow, which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of RTSP requests. Credit to an anonymous researcher working with the iDefense VCP for reporting this issue. Darwin Streaming Server CVE-ID: CVE-2007-0748 Impact: A remote attacker may be able to cause an unexpected application termination or arbitrary code execution Description: A heap buffer overflow exists in the Darwin Streaming Proxy. By sending maliciously-crafted RTSP requests, a remote attacker can trigger the overflow, which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of RTSP requests. Credit to an anonymous researcher working with the iDefense VCP for reporting this issue. Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQEVAwUBRkOSMImzP5/bU5rtAQj+8QgA3oMujztZZkU6KQF9O5V7iuXMlF89lV8O faOh4RuImVJfJRLz4jBsUGXgAWi3ZPtulyN210lZFN/drNMOjtL/3Gk6OPIT7iBw dlIRcYMU3NUaGr0dNOx82TiNk9SVMbRAJUNM49744GAxYBsOrEYVj6ZWtoZ1y8aS l+p5bI9bub7uLIYS2UI7WQpr8ZNCL9hMLiDS+3XhGFcW0JmQeL5CRphCEGCXotSW nEHHcwICLv9seNpQ1udoyLgLJR2tfSHtRg/GlrzJynKnDk2yS82RQATbQf7s+ajd 0xngA1Qd6dawpy/6T2uPbtptqBHdOjzFNaV12MZ+ygIqYQNu7mgEdA== =iuwu -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2007-05-01 QuickTime 7.1.6
by Apple Product Security 01 May '07

01 May '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2007-05-01 QuickTime 7.1.6 QuickTime 7.1.6 is now available. Along with functionality improvements (see release notes), it also addresses the following security issue: QuickTime CVE-ID: CVE-2007-2175 Available for: Mac OS X v10.3.9, Mac OS X v10.4.9, Windows XP SP2, Windows 2000 SP4 Impact: Visiting a malicious website may lead to arbitrary code execution Description: An implementation issue exists in QuickTime for Java, which may allow reading or writing out of the bounds of the allocated heap. By enticing a user to visit a web page containing a maliciously-crafted Java applet, an attacker can trigger the issue which may lead to arbitrary code execution. This update addresses the issue by performing additional bounds checking when creating QTPointerRef objects. Credit to Dino Dai Zovi working with TippingPoint and the Zero Day Initiative for reporting this issue. QuickTime 7.1.6 may be obtained from the Software Update application, or from the Download area in the QuickTime site http://www.apple.com/quicktime/download/ For Mac OS X v10.4.9 and Mac OS X v10.3.9 The download file is named: "QuickTime716.dmg" Its SHA-1 digest is: 275327dadcb28b704eb2ed40db3ee300103cea6f QuickTime 7.1.6 for Windows XP/2000 The download file is named: "QuickTimeInstaller.exe" Its SHA-1 digest is: 2ebfbab44f7ee26ce15f88373d5f843ef2232ed4 QuickTime 7.1.6 with iTunes for Windows XP/2000 The download file is named: "iTunesSetup.exe" Its SHA-1 digest is: 528be70403b1675597e8563bafe2f9f728eda6dd Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQEVAwUBRjd8SImzP5/bU5rtAQjwcwf/cS2ooYOgvphfAPMnkoeFqELnKHg81bFd hRbWCAtIoKA8wK6r4ipCihYtwjJLB/5rmr8mwAicXh7zI5FcAWt1oO7WJo63FAbY e2DViNNwclBZZwS1l/ZBmDETJ9NDJopTIDOZzURjXJIFexXmFqYHIEaznKW93tCQ G8NhGZQfA87HU1swx2JQOftu+HkyLGbxrnkW76GGiM7E8A5gkk0a4zp/OIPhafGZ 633LfJ0Fkyo2sWVdAW+y0shB2Lj5hNEdz8II+r+dOQZ0pr03kwjhHD32Pe60HLb+ H7Y6p78goiFgXvcpaqjgzCPyNcWhiR2Blp2afo1hV7QLwMH1I/SxZQ== =9v9q -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2007-05-01 Security Update 2007-004 v1.1
by Apple Product Security 01 May '07

01 May '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2007-05-01 Security Update 2007-004 v1.1 Security Update 2007-004 v1.1 is now available. It includes the contents of Security Update 2007-004, plus the following fixes: AirPort Available for: Mac OS X v10.3.9 This update corrects an issue where the AirPort connection may be lost after waking from sleep. This issue only affects Mac OS X v10.3.9 (client) with Security Update 2007-004. FTPServer CVE-ID: CVE-2007-0745 Available for: Mac OS X Server v10.4.9 Impact: Users with ftp access may be able to navigate to directories outside the normal scope Description: Security Update 2007-004 applied an incorrect ftp configuration file for Mac OS X Server v10.4.9 systems. Users with ftp access, who would normally be restricted to certain directories, may be able to access directories outside the normal scope. This update addresses the issue by restoring the correct version of the ftp configuration file. This issue only affects Mac OS X Server v10.4.9 with Security Update 2007-004. Note: Mac OS X v10.4.9 (client) and Mac OS X Server v10.3.9 systems that have installed Security Update 2007-004 do not require Security Update 2007-004 v1.1. If the security update has not yet been installed on these systems, then they should be updated using Security Update 2007-004 v1.1. Since Mac OS X v10.4.9 (client) and Mac OS X Server v10.3.9 systems that have already installed Security Update 2007-004 are not affected, the Software Update utility will not display Security Update 2007-004 v1.1 for these systems. Security Update 2007-004 v1.1 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.4.9 (PowerPC) and Mac OS X Server v10.4.9 (PowerPC) The download file is named: "SecUpd2007-004Ti.dmg" Its SHA-1 digest is: 60319316b3eba0de37f7ea747e59decfafe1ea81 For Mac OS X v10.4.9 (Universal) and Mac OS X Server v10.4.9 (Universal) The download file is named: "SecUpd2007-004Univ.dmg" Its SHA-1 digest is: fb6ec6a7d8729bd21d1431192ecb7665e9fd2b80 For Mac OS X v10.3.9 The download file is named: "SecUpd2007-004Pan.dmg" Its SHA-1 digest is: 39b9be13a82ea546f18ff4958cfd69b0d37947e8 Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQEVAwUBRjd3OImzP5/bU5rtAQiNoQgAuOdAF0Mf1S0TsVH7d4Fg6fgKq34HMQ3w Unmd1dGx1PxXahSRcDoCfhxFlE+Eh5VLgC3lgrWhQ2WW5wXPA8xFbP6YjFelfwOo ZDuykcEtDoTEPPUcrVVfh/cyGoYP7x7uGDzzvjH9qwFie6PtKjKcAf640aFBchfn A7UXkQEGm6mZwvZ14lGbVxWHZ09vjbM5otZv60vy8u6p6l3XjntjSrKSK2d7aWqF gHH/H8bxLbXhNL9kveXBsZTCK3TG3uJFJ90i+v63odTS6THHnl3mjm31Sx5DUF7g im7OTXT94mCfWDVK8YEcNf/NH3GQmVnE7+oXlHbQ+f86PWOgvaEQ9g== =hOXJ -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0