June 2007 - Security-announce

APPLE-SA-2007-06-22 Safari 3 Beta Update 3.0.2
by Apple Product Security 22 Jun '07

22 Jun '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2007-06-22 Safari 3 Beta Update 3.0.2 Safari CVE-ID: CVE-2007-2398 Available for: Windows XP or Vista Impact: A maliciously crafted website may control the contents of the address bar Description: In Safari Beta 3.0.1 for Windows, a timing issue allows a web page to change the contents of the address bar without loading the contents of the corresponding page. This could be used to spoof the contents of a legitimate site, allowing user credentials or other information to be gathered. This update addresses the issue by restoring the address bar contents if a request for a new web page is terminated. This issue does not affect Mac OS X systems. Safari CVE-ID: CVE-2007-2400 Available for: Mac OS X v10.4.9 or later, Windows XP or Vista Impact: Visiting a malicious website may allow cross-site scripting Description: Safari's security model prevents JavaScript in remote web pages from modifying pages outside of their domain. A race condition in page updating combined with HTTP redirection may allow JavaScript from one page to modify a redirected page. This could allow cookies and pages to be read or arbitrarily modified. This update addresses the issue by correcting access control to window properties. Credit to Lawrence Lai, Stan Switzer, Ed Rowe of Adobe Systems, Inc for reporting this issue. WebCore CVE-ID: CVE-2007-2401 Available for: Mac OS X v10.4.9 or later, Windows XP or Vista Impact: Visiting a malicious website may allow cross-site requests Description: An HTTP injection issue exists in XMLHttpRequest when serializing headers into an HTTP request. By enticing a user to visit a maliciously crafted web page, an attacker could conduct cross-site scripting attacks. This update addresses the issue by performing additional validation of header parameters. Credit to Richard Moore of Westpoint Ltd for reporting this issue. WebKit CVE-ID: CVE-2007-2399 Available for: Mac OS X v10.4.9 or later, Windows XP or Vista Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: An invalid type conversion when rendering frame sets could lead to memory corruption. Visiting a maliciously crafted web page may lead to an unexpected application termination or arbitrary code execution. Credit to Rhys Kidd of Westnet for reporting this issue. Note: This update will appear for systems running Safari 3 Beta. It includes the entire contents of Security Update 2007-006. Security Update 2007-006 itself will not appear via Software Update for systems that have installed Safari 3 Beta. Safari 3 Beta Update 3.0.2 is available via the Apple Software Update application, or Apple's Safari download site at: http://www.apple.com/safari/download/ For Mac OS X The download file is named: "Safari302Beta.dmg" Its SHA-1 digest is: b8ee8d7c1ac3237de2ab0524077a20bae7f55001 Safari for Windows XP or Vista The download file is named: "SafariSetup.exe" Its SHA-1 digest is: 3cbbf5a09ece4cac7f35b79f67b6990d5c0565f3 Safari+QuickTime for Windows XP or Vista The download file is named: "SafariQuickTimeSetup.exe" Its SHA-1 digest is: 7f0ea984bbdcbba4a3a85d785f2fdb810ed3954a This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQEVAwUBRnw3ccgAoqu4Rp5tAQgYvwf/VJn4IiZRU7UDu+bDn5b9QFfZ+HqvukiY 6lqba2GXPO7WS6wqkFafUVDBB/PDsQ75BbzPwi1Mr/UDBxUj6d5OvnyUDJ0D9bG8 uDQujhZazEUuhDYom+IqC6OgVr1jMF70RI/nPNr14GGFXLF+IuIlTtLu9UHi5nME OzQ+W6THIBxhfckgP0CGkh5wi7BdSSfo0UviY+tg8+F1GQieNysk1FNtj3JspQOD NB/3v6bmPlFwJayNqVjYlduIa6ycCvJhpeupWFzNqOjeEIwlhlv3BSsrnWPZVd4f YiibgfkYXMO0f0UPx3iwzimux88mlD2wvgqBn7lEfobVsCTJD5dCPA== =vzAk -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2007-06-22 Security Update 2007-006
by Apple Product Security 22 Jun '07

22 Jun '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2007-06-22 Security Update 2007-006 Security Update 2007-006 is now available and addresses the following issues: WebCore CVE-ID: CVE-2007-2401 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9 or later, Mac OS X Server v10.4.9 or later Impact: Visiting a malicious website may allow cross-site requests Description: An HTTP injection issue exists in XMLHttpRequest when serializing headers into an HTTP request. By enticing a user to visit a maliciously crafted web page, an attacker could conduct cross-site scripting attacks. This update addresses the issue by performing additional validation of header parameters. Credit to Richard Moore of Westpoint Ltd. for reporting this issue. WebKit CVE-ID: CVE-2007-2399 Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.9 or later, Mac OS X Server v10.4.9 or later Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: An invalid type conversion when rendering frame sets could lead to memory corruption. Visiting a maliciously crafted web page may lead to an unexpected application termination or arbitrary code execution. Credit to Rhys Kidd of Westnet for reporting this issue. Security Update 2007-006 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.4.9 (PowerPC) or later and Mac OS X Server v10.4.9 (PowerPC) or later The download file is named: "SecUpd2007-006Ti.dmg" Its SHA-1 digest is: 14ba95e8d6e795b9d0f99b614fe426d643edf15e For Mac OS X v10.4.9 (Universal) or later and Mac OS X Server v10.4.9 (Universal) or later The download file is named: "SecUpd2007-006Univ.dmg" Its SHA-1 digest is: 68fe035d8653de6e4d27da92d4dbf77c53c1f214 For Mac OS X v10.3.9 and Mac OS X Server v10.3.9 The download file is named: "SecUpd2007-006Pan.dmg" Its SHA-1 digest is: 8c085ef167f1bfa92ec9e34834181bb034686e8a Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQEVAwUBRnwMjsgAoqu4Rp5tAQjnVgf+PyJLQ1pYYv6QrdoLiRaR3IhuhDF2wgkd m3UB661sexst2aI417mbqRqdH1W1XUl5EpJlKNzXg9k2BiWxVwD21CxqhLUXJlku zxXdmAqEIqy2GXtmAquuAX8c0oQF3k+uip8ovzddc9q+B0WV0/vbQODN+O3EkVs9 TNRVjowN0Pmp1Tb8O0hLsBqh57FtH9lzT0d9sGh6/C7zke7lxVOWYd9Y0Vov72rd 9oYv/q+Knj9qh4Zylp3Kg7Um0wotCX2JQ+U+XTNgr00sifaw6WUjpcpq9hQdAgv8 4CrFJGId7g+SYvbqy4pzfLQSFboeYD3HOZsVPSCze57tQSmBfJ6CJw== =mli5 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2007-06-20 Mac OS X v10.4.10
by Apple Product Security 20 Jun '07

20 Jun '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2007-06-20 Mac OS X v10.4.10 Mac OS X v10.4.10 is now available and addresses the following security issue. Mac OS X v10.4.10 also provides additional functionality changes, and information is available in its release note. Networking CVE-ID: CVE-2007-2242 Available for: Mac OS X v10.4 through Mac OS X v10.4.9, Mac OS X Server v10.4 through Mac OS X Server v10.4.9 Impact: Remote attackers may be able to adversely affect network performance Description: A design issue exists in the IPv6 protocol's handling of type 0 routing headers. Depending on network topology and capacity, the reception of specially crafted IPv6 packets may lead to a reduction in network bandwidth. This update addresses the issue by disabling the support for type 0 routing headers. This issue does not affect systems prior to Mac OS X v10.4. Mac OS X v10.4.10 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.4.9 (PowerPC) The download file is named: "MacOSXUpd10.4.10PPC.dmg" Its SHA-1 digest is: 9894afbafcc1deb9c331bba2e847a0884059e6aa For Mac OS X v10.4 (PowerPC) through v10.4.8 (PowerPC) The download file is named: "MacOSXUpdCombo10.4.10PPC.dmg" Its SHA-1 digest is: 7c40b6296b9a8a8845a776597a89a8795c391a19 For Mac OS X v10.4.9 (Intel) The download file is named: "MacOSXUpd10.4.10Intel.dmg" Its SHA-1 digest is: 0d3abab73af3370699bbe5389513511a1ba8b8fd For Mac OS X v10.4.4 (Intel) through v10.4.8 (Intel) The download file is named: "MacOSXUpdCombo10.4.10Intel.dmg" Its SHA-1 digest is: d3e72724dccda1c10a3ed393a262145fba105f55 For Mac OS X Server v10.4.9 (PowerPC) The download file is named: "MacOSXServerUpd10.4.10PPC.dmg" Its SHA-1 digest is: 9901cfdb6f3dd3a01bdde43b8a3fbc2d1ebfc8b9 For Mac OS X Server v10.4 through v10.4.8 (PowerPC) The download file is named: "MacOSXSrvrCombo10.4.10PPC.dmg" Its SHA-1 digest is: 434334396f2cfd4b9e23124d7f00d5ca3a64fd03 For Mac OS X Server v10.4.7 through v10.4.9 (Universal) The download file is named: "MacOSXSrvrCombo10.4.10Univ.dmg" Its SHA-1 digest is: f46d19a88f0439f4dc91bc9c1217b60e681c5470 Information will also be posted to the Apple Security Updates web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQEVAwUBRnmNkcgAoqu4Rp5tAQhmTQgAk40wWT2RcRgqQ3DfD6IcabBO3VLExX3z Y78ofoMTwj/XCg1SAwrJNktlkG2Hd9FIIWPEDwuvYkqRJOc2trtttgFeLQ3AUqr2 YI2KOa+PQVOr6mhByXYHNaDSrhaZRrgWDAWVK7y7TY0pGHdhUzKqeqJ+gdyiV+JR ayLOJ2KIVJqvMUaYgHa5DzxfvmqHdcYCsuLxVSeCFU8/u+XY351KlkvB3Edq1CYF FUo+jaSjob/VqHLuXwla67rfPYNgqBto20kmJ4ixjbZ0uZUq7xlRSmHV1ybyRX3v bt7iqrLlhXdWH6IdASUxMXagK4DQM2nKYvSkGJkNT5EidNFTok/UjA== =pWPj -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2007-06-20 Apple TV 1.1
by Apple Product Security 20 Jun '07

20 Jun '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2007-06-20 Apple TV 1.1 Apple TV 1.1 is now available and, along with its other content, addresses the following security issue: CVE-ID: CVE-2007-2386 Available for: Apple TV Impact: A remote attacker may be able to cause a denial of service or arbitrary code execution Description: A buffer overflow vulnerability exists in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) code used to create Port Mappings on home NAT gateways in the Apple TV implementation. By sending a maliciously crafted packet, a remote attacker can trigger the overflow which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation when processing UPnP protocol packets. Credit to Michael Lynn of Juniper Networks for reporting this issue. Installation note: The Apple TV device will automatically check Apple's update server on its weekly schedule. When an update is detected, it will download it, verify its signature, and install it. This process may take up to a week depending on the day that the Apple TV device checks for updates. Alternatively, you may manually update your Apple TV using the TV interface by selecting Settings > Update Software. This update is only available directly to the Apple TV, and will not appear in your computer's Software Update application, or in the Apple Downloads site. To check that the Apple TV has been updated, use the TV interface: * Navigate to Settings * Select About * The Software Version after applying this update will be "1.1" * To exit the About screen to the main menu, press Menu Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.6 (Build 6060) iQEVAwUBRnlb9MgAoqu4Rp5tAQgJcAgAhJwFHmNsRnQV4BALk1G3rIRkUvqjAYsl IU8ipCwp5ZKYA1eIzK1c6jxQ5QqKUMgiSeGZw8Cszk8A6jDodQr1ZBrxwjZyUn57 zaD62mrEogTEQei4Uio6jxu/wZMC+jWMzSQBEkcLFdnEzRWx//vBJJlRXec8KdyP MG+27UVt+pl2v2oD+DjZOhx7t6141GEfgCKWOKIPQcaw6ViyFNmxOY/uGjrTZR6r 2APD/C+JXS3GdMp+SPXMu9/0+OWVINIGUqzWITnXiVhhOw3+FIjy+CJqBm18u36T J0rBDsdDSshjyKWXI5FmyNiQswBuQAlWzpGT9TumEEL7oEvBDp1WNQ== =+CBt -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2007-06-14 Safari Beta 3.0.1 for Windows
by Apple Product Security 14 Jun '07

14 Jun '07

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2007-06-14 Safari Beta 3.0.1 for Windows The Safari 3 Public Beta was released on June 11 for Mac OS X and Windows XP/Vista. This beta software is for trial purposes and intended to gather feedback prior to a full release. As with all our products, we encourage security researchers to report issues to product-security(a)apple.com. Safari 3.0.1 Public Beta for Windows is now available and addresses the following issues in Safari 3 Public Beta: CVE-ID: CVE-2007-3186 Available for: Windows XP or Vista Impact: Visiting a malicious website may lead to arbitrary code execution Description: A command injection vulnerability exists in the Windows version of Safari 3 Public Beta. By enticing a user to visit a maliciously crafted web page, an attacker can trigger the issue which may lead to arbitrary code execution. This update addresses the issue by performing additional processing and validation of URLs. This does not pose a security issue on Mac OS X systems, but could lead to an unexpected termination of the Safari browser. CVE-ID: CVE-2007-3185 Available for: Windows XP or Vista Impact: Visiting a malicious website may lead to an unexpected application termination or arbitrary code execution Description: An out-of-bounds memory read issue in Safari 3 Public Beta for Windows may lead to an unexpected application termination or arbitrary code execution when visiting a malicious website. This issue does not affect Mac OS X systems. CVE-ID: CVE-2007-2391 Available for: Windows XP or Vista Impact: Visiting a malicious website may allow cross-site scripting Description: A race condition in Safari 3 Public Beta for Windows may allow cross site scripting. Visiting a maliciously crafted web page may allow access to JavaScript objects or the execution of arbitrary JavaScript in the context of another web page. This issue does not affect Mac OS X systems. The update is available via the "Apple Software Update" application, which is installed with the most recent version of QuickTime or iTunes on Windows. Safari 3.0.1 Public Beta for Windows is also available via Apple's Safari download site at: http://www.apple.com/safari/download/ Safari for Windows XP or Vista The download file is named: "SafariSetup.exe" Its SHA-1 digest is: e468f56613abaa3afd692ded78c35eaf109ca0b6 Safari+QuickTime for Windows XP or Vista The download file is named: "SafariQuickTimeSetup.exe" Its SHA-1 digest is: af73dd81793b2802200da5d7d5c8077a67ca57ec This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.3 (Build 2932) iQEVAwUBRnDqtMgAoqu4Rp5tAQjBbgf8DJt1O2JgOUp9VHAhTqjpNuNq8hl7NYmf fKScyb6EvBOHmGvDz6+sV2vc3KBqr1RlbgnJBuKE9bAfyhdGNbMSHK/drGWRkU5F 6ADORRpijQ68OSe1VIr9mgyhB7WIubrZ7DR9T9Uus/w1rZboV3Awf0Eyi4pY8pHr Ve4y6LZGzsAA7Ew8GcJWEuEEnz/QzcyiuCK3GOhHzm30b5c00YkE1GYhLJ7/ZbEL s5K4L+I1sUVROr6tpg01YCfMUPnMIgOduAtMiVRJWOwsH+oFsjm1eNBLP2K4HAy/ Sbmf2eW5wjuVW2IvkdLk8TqHZi4f+rBmVLepeQsk8Fi/Vx7dpOfWIg== =8E9r -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0