March 2008 - Security-announce

Apple-SA-2008-03-26 Security Update 2008-002 v1.1
by Apple Product Security 26 Mar '08

26 Mar '08

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Apple-SA-2008-03-26 Security Update 2008-002 v1.1 Security Update 2008-002 v1.1 addresses reliability issues with the "Printer Settings..." button in Aperture 2.0 on systems running Mac OS X v10.5.2. No applications other than Aperture 2.0 are affected. This update is only for systems with: - - Mac OS X v10.5.2 and Aperture 2.0 and Security Update 2008-002 - - Mac OS X v10.5.2, but Security Update 2008-002 has not been installed There is no change to the security content provided in Security Update 2008-002. The security content of Security Update 2008-002 and Security Update 2008-002 v1.1 is available from: http://support.apple.com/kb/HT1249 Security Update 2008-002 v1.1 is available from the Software Update pane in System Preferences for systems with: - - Mac OS X v10.5.2 and Aperture 2.0 and Security Update 2008-002 - - Mac OS X v10.5.2, but Security Update 2008-002 has not been installed Security Update 2008-002 v1.1 may also be obtained from Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.5.2 The download file is named: "SecUpd2008-002.v1.1.dmg" Its SHA-1 digest is: 9e50032326611245bb5382099a60cbcd4d1852c9 For Mac OS X Server v10.5.2 The download file is named: "SecUpdSrvr2008-002.v1.1.dmg" Its SHA-1 digest is: 73f6085ab0660018635fef28df0589754f50a69a Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: 9.7.0.1012 wsBVAwUBR+qtccgAoqu4Rp5tAQi0TwgAgSZXBYPEbkdREHjTCEkSejKMcYyrYVdV gWrqhPCD0Q7H0pwBpvX8QbA12WYSzbeuJdQQHxRIn9oyllUsZDeRjU/S1NNM8NGP 5PKB/HfupvhWDD878G1PztbQgkrHWtUKYs7AYmVB91gn9JEr0dCmp2MxfLC3WsIG KKncY3MpVPo3lPRw36zx6IPSYw53UznbhPYq3tmI2ZnhAH7LyGrHb7XomtvoSP2R MK4OEtYZ6JFvEoubE6gzsn50KRkueiyEjc4DmG/xb/lfQtSLRYd48HkJoPiTn4hC QXFSW/dRpYqqEpdZCyvJfMZ9Rj/wlXgVNWkuKNAKgjz1k9KE6Rzpww== =7AE2 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2008-03-20 Digital Camera RAW Compatibility Update 2.0
by Apple Product Security 20 Mar '08

20 Mar '08

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2008-03-20 Digital Camera RAW Compatibility Update 2.0 Digital Camera RAW Compatibility Update 2.0 is now available and addresses the following issue: Camera Support CVE-ID: CVE-2008-0987 Available for: Aperture 2 or iPhoto 7.1.2 with iLife Support 8.2 Impact: Viewing a maliciously crafted image may lead to an unexpected application termination or arbitrary code execution Description: A stack based buffer overflow exists in the handling of Adobe Digital Negative (DNG) image files. By enticing a user to open a maliciously crafted image file, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue through improved validation of DNG image files. Credit to Clint Ruoho of Laconic Security for reporting this issue. Digital Camera RAW Compatibility Update 2.0 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ The download file is named: "RAWCamera.dmg" Its SHA-1 digest is: 9a09365a32ab0387cd82362e8a2c42024d4cb1ea This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: 9.7.0.1012 wsBVAwUBR+Ka/8gAoqu4Rp5tAQgwKAgAhHcP+swytT3sbuGSSiAnZzCSS993GlT6 zGV/KvAB0ctWs43BJkjOZf+kQ976qIISthL3Mr8oAmxwEr+vHwry565imjdbIgo9 RWFdEKp1F+jhF6X4oVLMfo3eJR/QCvZQZi8JxymmVMvqrK/dO/xp5ttONjcuK9vd +XZS8PvQv92dbsaPLW/qAiV/fzLe6pw7PXmh/GU7FQ2aL3HUFtdu3HvzXiwETjaa lZtmHMOf+qS7ZXVv8F9aCUC7rV2NnUXg8tmkDuh/pIw2N40CNAmXTVO5MKis4aVT ly+yyBUwrIYLafShuYWXosy+fUcFjkyXWgVLbxVHIuiItTzmw3cq6g== =ns96 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2008-03-19 AirPort Extreme Base Station Firmware 7.3.1
by Apple Product Security 20 Mar '08

20 Mar '08

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2008-03-19 AirPort Extreme Base Station Firmware 7.3.1 Firmware version 7.3.1 is now available for AirPort Extreme 802.11n* base stations. (* Based on an IEEE 802.11n draft specification) Further information on the base station is available via: http://www.apple.com/airportextreme/ Firmware version 7.3.1 fixes the following security issue: AirPort Extreme Base Station with 802.11n* CVE-ID: CVE-2008-1012 Available for: AirPort Extreme Base Station with 802.11n* Impact: A maliciously crafted AFP request may lead to a denial of service Description: An input validation issue exists in the AirPort Extreme Base Station's handling of AFP requests, which may cause file sharing to become unresponsive. This update addresses the issue by performing additional validation of AFP requests. This issue does not affect Time Capsule or AirPort Express. The fix for this issue is available in the following separate updates: - - AirPort Extreme with 802.11n (Fast Ethernet) 7.3.1 - - AirPort Extreme with 802.11n (Gigabit Ethernet) 7.3.1 Credit to Alex deVries for reporting this issue. Installation note for Firmware version 7.3.1 Firmware version 7.3.1 is installed into an AirPort Extreme Base Station with 802.11n* by running the AirPort Utility which is provided with the Base Station. Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: 9.7.0.1012 wsBVAwUBR+GxNsgAoqu4Rp5tAQhT1gf+NuYABuNdXgJgDSVJmrZVbhT9xWUIgltH +ZnN0anYrwvbRjuRQS8ZC4zNhx7mAuunwpZO9KhoNDsf55f1g/TrCi7GkTVZghll a7+zVHOY48KpEYuMRs+L5p88mTKjSkuAdXMpla4jejQHK+lb68kg+zHQlmL9A93l LJg7ZC5lvzV+4depHpKkwmEQ3oxRs9l6N51+5SXX1j/eYtVZUKhxnd2yRP1lFITt SiFuBzjpquGqSaV3YdhydpGXZeEcP4rbm3x2pGXSeY2wqH4oXLd+BajnBUGy6ubw hn6oMbn+umxKksIJU5unqd0EtaLbXzODCCGmESsA/kOLPNECfOzXAw== =mnKc -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2008-03-18 Security Update 2008-002
by Apple Product Security 18 Mar '08

18 Mar '08

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2008-03-18 Security Update 2008-002 Security Update 2008-002 is now available and addresses the following issues: AFP Client CVE-ID: CVE-2008-0044 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Accessing a maliciously crafted afp:// URL may lead to an application termination or arbitrary code execution Description: Multiple stack buffer overflow issues exist in AFP Client's handling of afp:// URLs. By enticing a user to connect to a malicious AFP Server, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issues through improved bounds checking. AFP Server CVE-ID: CVE-2008-0045 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Cross-realm authentication with AFP Server may be bypassed Description: An implementation issue exists in AFP Server's check of Kerberos principal realm names. This may allow unauthorized connections to the server, when cross-realm authentication with AFP Server is used. This update addresses the issue by through improved checks of Kerberos principal realm names. This issue does not affect systems running Mac OS X v10.5 or later. Credit to Ragnar Sundblad of KTH - Royal Institute of Technology, Stockholm, Sweden for reporting this issue. Apache CVE-ID: CVE-2005-3352, CVE-2006-3747, CVE-2007-3847, CVE-2007-5000, CVE-2007-6388 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X Server v10.5.2 Impact: Multiple vulnerabilities in Apache 1.3.33 and 1.3.39 Description: Apache is updated to version 1.3.41 to address several vulnerabilities, the most serious of which may lead to arbitrary code execution. Further information is available via the Apache web site at http://httpd.apache.org For Mac OS X v10.5, Apache version 1.3.x is only shipped on Server configurations. mod_ssl is also updated from version 2.8.24 to 2.8.31 to match the upgraded Apache; no security fixes are included in the update. Apache CVE-ID: CVE-2007-5000, CVE-2007-6203, CVE-2007-6388, CVE-2007-6421, CVE-2008-0005 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Multiple vulnerabilities in Apache 2.2.6 Description: Apache is updated to version 2.2.8 to address several vulnerabilities, the most serious of which may lead to cross-site scripting. Further information is available via the Apache web site at http://httpd.apache.org AppKit CVE-ID: CVE-2008-0048 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Usage of the NSDocument API to may lead to arbitrary code execution Description: A stack buffer overflow exists in the NSDocument API's handling of file names. On most file systems, this issue is not exploitable. This update addresses the issue through improved bounds checking. This issue does not affect systems running Mac OS X v10.5 or later. AppKit CVE-ID: CVE-2008-0049 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: A local user may be able to execute arbitrary code with system privileges Description: A mach port in NSApplication intended for inter-thread synchronization is unintentionally available for inter-process communication. By sending maliciously crafted messages to privileged applications in the same bootstrap namespace, a local user may cause arbitrary code execution with the privileges of the target application. This update addresses the issue by removing the mach port in question and using another method to synchronize. This issue does not affect systems running Mac OS X v10.5 or later. AppKit CVE-ID: CVE-2008-0057 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Visiting a maliciously crafted website may lead to arbitrary code execution Description: Multiple integer overflow vulnerabilities exist in the parser for a legacy serialization format. By causing a maliciously formatted serialized property list to be parsed, an attacker could trigger a heap-based buffer overflow which may lead to arbitrary code execution. This update addresses the issue by performing additional validation of serialized input. This issue does not affect systems running Mac OS X v10.5 or later. AppKit CVE-ID: CVE-2008-0997 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Querying a network printer may cause an unexpected application termination or arbitrary code execution Description: A stack based buffer overflow exists in AppKit's handling of PPD files. By enticing a user to query a network printer, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue through improved handling of PPD files. This issue does not affect systems running Mac OS X v10.5 or later. Application Firewall CVE-ID: CVE-2008-0046 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: The German translation of the Application Firewall preference pane was misleading Description: The "Set access for specific services and applications" radio button of the Application Firewall preference pane was translated into German as "Zugriff auf bestimmte Dienste und Programme festlegen", which is "Set access to specific services and applications". This might lead a user to believe that the listed services were the only ones that would be permitted to accept incoming connections. This update addresses the issue by changing the German text to semantically match the English text. This issue does not affect systems prior to Mac OS X v10.5. CFNetwork CVE-ID: CVE-2008-0050 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: A malicious proxy server may spoof secure websites Description: A malicious HTTPS proxy server may return arbitrary data to CFNetwork in a 502 Bad Gateway error. A malicious proxy server could use this to spoof secure websites. This update addresses the issue by returning an error on any proxy error, instead of returning the proxy-supplied data. This issue is already addressed in systems running Mac OS X v10.5.2. ClamAV CVE-ID: CVE-2007-3725, CVE-2007-4510, CVE-2007-4560, CVE-2007-5759, CVE-2007-6335, CVE-2007-6336, CVE-2007-6337, CVE-2008-0318, CVE-2008-0728 Available for: Mac OS X Server v10.5.2 Impact: Multiple vulnerabilities in ClamAV 0.90.3 Description: Multiple vulnerabilities exist in ClamAV 0.90.3 provided with Mac OS X Server v10.5 systems, the most serious of which may lead to arbitrary code execution. This update addresses the issue by updating to ClamAV 0.92.1. Further information is available via the ClamAV website at www.clamav.net ClamAV CVE-ID: CVE-2006-6481, CVE-2007-1745, CVE-2007-1997, CVE-2007-3725, CVE-2007-4510, CVE-2007-4560, CVE-2007-0897, CVE-2007-0898, CVE-2008-0318, CVE-2008-0728 Available for: Mac OS X Server v10.4.11 Impact: Multiple vulnerabilities in ClamAV 0.88.5 Description: Multiple vulnerabilities exist in ClamAV 0.88.5 provided with Mac OS X Server v10.4.11, the most serious of which may lead to arbitrary code execution. This update addresses the issue by updating to ClamAV 0.92.1. Further information is available via the ClamAV website at www.clamav.net CoreFoundation CVE-ID: CVE-2008-0051 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: A local user may be able to execute arbitrary code with system privileges Description: An integer overflow exists in CoreFoundation's handling of time zone data. This may allow a local user to cause arbitrary code execution with system privileges. This update addresses the issue through improved bounds checking on time zone data files. This issue does not affect systems running Mac OS X v10.5 or later. CoreServices CVE-ID: CVE-2008-0052 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Visiting a website could cause files to be opened in AppleWorks Description: Files with names ending in ".ief" can be automatically opened in AppleWorks if Safari's "Open 'Safe' files" preference is enabled. This is not the intended behavior and could lead to security policy violations. This update addresses the issue by removing ".ief" from the list of safe file types. This issue only affects systems prior to Mac OS X v10.5 with AppleWorks installed. CUPS CVE-ID: CVE-2008-0596 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: A remote attacker may be able to cause an unexpected application termination if printer sharing is enabled Description: A memory leak exists in CUPS. By sending a large number of requests to add and remove shared printers, an attacker may be able to cause a denial of service. This issue can not result in arbitrary code execution. This update addresses the issue through improved memory management. This issue does not affect systems prior to Mac OS X v10.5. CUPS CVE-ID: CVE-2008-0047 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: A remote attacker may be able to cause an unexpected application termination or arbitrary code execution if printer sharing is enabled Description: A heap buffer overflow exists in the CUPS interface's processing of search expressions. If printer sharing is enabled, a remote attacker may be able to cause an unexpected application termination or arbitrary code execution with system privileges. If printer sharing is not enabled, a local user may be able to gain system privileges. This update addresses the issue by performing additional bounds checking. This issue does not affect systems prior to Mac OS X v10.5. Credit to regenrecht working with the VeriSign iDefense VCP for reporting this issue. CUPS CVE-ID: CVE-2008-0053, CVE-2008-0882 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Multiple vulnerabilities in CUPS may lead to an unexpected application termination or arbitrary code execution with system privileges Description: Multiple input validation issues exist in CUPS, the most serious of which may lead to arbitrary code execution with system privileges. This update addresses the issues by updating to CUPS 1.3.6. These issues do not affect systems prior to Mac OS X v10.5. curl CVE-ID: CVE-2005-4077 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Running curl with a maliciously crafted URL may lead to an unexpected application termination or arbitrary code execution Description: A one byte buffer overflow exists in curl 7.13.1. By enticing a user to run curl with a maliciously crafted URL, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue by updating curl to version 7.16.3. Crash Reporter was updated to match the curl changes. This issue does not affect systems running Mac OS X v10.5 or later. Emacs CVE-ID: CVE-2007-6109 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Format string vulnerability in Emacs Lisp may lead to an unexpected application termination or possibly arbitrary code execution Description: A stack buffer overflow exists in Emacs' format function. By exploiting vulnerable Emacs Lisp which allows an attacker to provide a format string containing a large precision value, an attacker may cause an unexpected application termination or possibly arbitrary code execution. Further information on the patch applied is available via the Savannah Emacs website at http://cvs.sav annah.gnu.org/viewvc/emacs/emacs/src/editfns.c?r1=1.439.2.3&r2=1.439. 2.9&view=patch Emacs CVE-ID: CVE-2007-5795 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Safe mode checks in Emacs may be bypassed Description: A logic error in Emacs' hack-local-variable function allows any local variable to be set, even if 'enable-local-variables' is set to :safe. By enticing a user to load a file containing a maliciously crafted local variables declaration, a local user may cause an unauthorized modification of Emacs Lisp variables leading to arbitrary code execution. This issue has been fixed through improved :safe mode checks. The patch applied is available via the Savannah Emacs website at http://cvs.savannah.gnu.org/viewvc/emacs/lisp/files. el?r1=1.937&r2=1.938&sortby=date&root=emacs&view=patch This issue does not affect systems prior to Mac OS X v10.5. file CVE-ID: CVE-2007-2799 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Running the file command on a maliciously crafted file may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow vulnerability exists in the file command line tool, which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. This issue does not affect systems running Mac OS X v10.5 or later. Credit to Colin Percival of the FreeBSD security team for reporting this issue. Foundation CVE-ID: CVE-2008-0054 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Usage of the NSSelectorFromString API may result in an unexpected method being called Description: An input validation issue exists in the NSSelectorFromString API. Passing it a malformed selector name may result in the return of an unexpected selector, which could lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation on the selector name. This issue does not affect systems running Mac OS X v10.5 or later. Foundation CVE-ID: CVE-2008-0055 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: A local user can interfere in other users' file operations and may be able to obtain elevated privileges Description: When performing a recursive file copying operation, NSFileManager creates directories as world-writable, and only later restricts the permissions. This creates a race condition during which a local user can manipulate the directory and interfere in subsequent operations. This may lead to a privilege escalation to that of the application using t he API. This update addresses the issue by creating directories with restrictive permissions. This issue does not affect systems running Mac OS X v10.5 or later. Foundation CVE-ID: CVE-2008-0056 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Programs using the NSFileManager API could be manipulated to execute arbitrary code Description: A long pathname with an unexpected structure can expose a stack buffer overflow vulnerability in NSFileManager. Presenting a specially crafted path to a program using NSFileManager could lead to the execution of arbitrary code. This update addresses the issue by ensuring a properly sized destination buffer. This issue does not affect systems running Mac OS X v10.5 or later. Foundation CVE-ID: CVE-2008-0058 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Visiting a maliciously crafted website may lead to a denial of service or arbitrary code execution Description: A thread race condition exists in NSURLConnection's cache management, which can cause a deallocated object to receive messages. Triggering this issue may lead to a denial of service, or arbitrary code execution with the privileges of Safari or another program using NSURLConnection. This update addresses the issue by removing an unsynchronized caching operation. This issue does not affect systems running Mac OS X v10.5 or later. Credit to Daniel Jalkut of Red Sweater Software for reporting this issue. Foundation CVE-ID: CVE-2008-0059 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Processing an XML document may lead to an unexpected application termination or arbitrary code execution Description: A race condition exists in NSXML. By enticing a user to process an XML file in an application which uses NSXML, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue through improvements to the error handling logic of NSXML. This issue does not affect systems running Mac OS X v10.5 or later. Help Viewer CVE-ID: CVE-2008-0060 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Accessing a maliciously crafted help: URL may lead to arbitrary Applescript execution Description: A malicious help:topic_list URL may insert arbitrary HTML or JavaScript into the generated topic list page, which may redirect to a Help Viewer help:runscript link that runs Applescript. This update addresses the issue by performing HTML escaping on the URL data used in help topic lists before building the generated page. Credit to Brian Mastenbrook for reporting this issue. Image Raw CVE-ID: CVE-2008-0987 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Viewing a maliciously crafted image may lead to an unexpected application termination or arbitrary code execution Description: A stack based buffer overflow exists in the handling of Adobe Digital Negative (DNG) image files. By enticing a user to open a maliciously crafted image file, an attacker may cause an unexpected application termination or arbitrary code execution. This update addresses the issue through improved validation of DNG image files. This issue does not affect systems prior to Mac OS X v10.5. Credit to Clint Ruoho of Laconic Security for reporting this issue. Kerberos CVE-ID: CVE-2007-5901, CVE-2007-5971, CVE-2008-0062, CVE-2008-0063 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Multiple vulnerabilities in MIT Kerberos 5 may lead to an unexpected application termination or arbitrary code execution with system privileges Description: Multiple memory corruption issues exist in MIT Kerberos 5, which may lead to an unexpected application termination or arbitrary code execution with system privileges. Further information on the issues and the patches applied is available via the MIT Kerberos website at http://web.mit.edu/Kerberos/ CVE-2008-0062 and CVE-2008-0063 do not affect systems running Mac OS X v10.5 or later. CVE-2007-5901 does not affect systems prior to Mac OS X v10.4. libc CVE-ID: CVE-2008-0988 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Applications that use the strnstr API could be vulnerable to a denial of service Description: An off by one issue exists in Libsystem's strnstr(3) implementation. Applications that use the strnstr API can read one byte beyond the limit specified by the user, which may lead to an unexpected application termination. This update addresses the issue through improved bounds checking. This issue does not affect systems running Mac OS X v10.5 or later. Credit to Mike Ash of Rogue Amoeba Software for reporting this issue. mDNSResponder CVE-ID: CVE-2008-0989 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: A local user may be able to execute arbitrary code with system privileges Description: A format string issue exists in mDNSResponderHelper. By setting the local hostname to a maliciously crafted string, a local user could cause a denial of service or arbitrary code execution with the privileges of mDNSResponderHelper. This update addresses the issue by using a static format string. This issue does not affect systems prior to Mac OS X v10.5. notifyd CVE-ID: CVE-2008-0990 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: A local user may be able to deny access to notifications Description: notifyd accepts Mach port death notifications without verifying that they come from the kernel. If a local user sends fake Mach port death notifications to notifyd, applications that use the notify(3) API to register for notifications may never receive the notifications. This update addresses the issue by only accepting Mach port death notifications from the kernel. This issue does not affect systems running Mac OS X v10.5 or later. OpenSSH CVE-ID: CVE-2007-4752 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: A remote attacker may be able to execute arbitrary code with elevated privileges Description: OpenSSH forwards a trusted X11 cookie when it cannot create an untrusted one. This may allow a remote attacker to gain elevated privileges. This update addresses the issue by updating OpenSSH to version 4.7. Further information is available via the OpenSSH website at http://www.openssh.org/txt/release-4.7 pax archive utility CVE-ID: CVE-2008-0992 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Running the pax command on a maliciously crafted archive may lead to arbitrary code execution Description: The pax command line tool does not check a length in its input before using it as an array index, which may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by checking the index. This issue does not affect systems prior to Mac OS X v10.5. PHP CVE-ID: CVE-2007-1659, CVE-2007-1660, CVE-2007-1661, CVE-2007-1662, CVE-2007-4766, CVE-2007-4767, CVE-2007-4768, CVE-2007-4887 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Multiple vulnerabilities in PHP 5.2.4 Description: PHP is updated to version 5.2.5 to address multiple vulnerabilities, the most serious of which may lead to arbitrary code execution. Further information is available via the PHP website at http://www.php.net/ PHP version 5.2.x is only provided with Mac OS X v10.5 systems. PHP CVE-ID: CVE-2007-3378, CVE-2007-3799 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X Server v10.5.2 Impact: Multiple vulnerabilities in PHP 4.4.7 Description: PHP is updated to version 4.4.8 to address multiple vulnerabilities, the most serious of which may lead to arbitrary code execution. Further information is available via the PHP website at http://www.php.net/ Podcast Producer CVE-ID: CVE-2008-0993 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Podcast Capture exposes passwords to other local users Description: The Podcast Capture application provides passwords to a subtask through the arguments, potentially exposing the passwords to other local users. This update corrects the issue by providing passwords to the subtask through a pipe. This issue does not affect systems prior to Mac OS X v10.5. Credit to Maximilian Reiss of Chair for Applied Software Engineering, TUM for reporting this issue. Preview CVE-ID: CVE-2008-0994 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Saving to encrypted PDF in Preview produces files that may be read without the password Description: When Preview saves a PDF file with encryption, it uses 40-bit RC4. This encryption algorithm may be broken with significant but readily available computing power. A person with access to the file may apply a brute-force technique to view it. This update enhances the encryption to 128-bit RC4. Printing CVE-ID: CVE-2008-0995 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Printing to encrypted PDF produces files that may be read without the 'open' password Description: Printing to a PDF file and setting an 'open' password uses 40-bit RC4. This encryption algorithm may be broken with significant but readily available computing power. A person with access to the file may apply a brute-force technique to view it. This update enhances the encryption to 128-bit RC4. This issue does not affect systems prior to Mac OS X v10.5. Printing CVE-ID: CVE-2008-0996 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Printing to an authenticated print queue may disclose login credentials Description: An information disclosure issue exists in the handling of authenticated print queues. When starting a job on an authenticated print queue, the credentials used for authentication may be saved to disk. This update addresses the issue by removing user credentials from printing presets before saving them to disk. This issue does not affect systems prior to Mac OS X v10.5. System Configuration CVE-ID: CVE-2008-0998 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: A local user may be able to execute arbitrary code with system privileges Description: The privileged tool NetCfgTool uses distributed objects to communicate with untrusted client programs on the local machine. By sending a maliciously crafted message, a local user can bypass the authorization step and may cause arbitrary code execution with the privileges of the privileged program. This update addresses the issue by performing additional validation of distributed objects. UDF CVE-ID: CVE-2008-0999 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Opening a maliciously crafted disk image may lead to an unexpected system shutdown Description: A null pointer dereference issue exists in the handling of Universal Disc Format (UDF) file systems. By enticing a user to open a maliciously crafted disk image, an attacker may cause an unexpected system shutdown. This update addresses the issue through improved validation of UDF file systems. This issue does not affect systems prior to Mac OS X v10.5. Credit to Paul Wagland of Redwood Software, and Wayne Linder of Iomega for reporting this issue. Wiki Server CVE-ID: CVE-2008-1000 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: A user with access to edit wiki content may be able to execute arbitrary commands as the wiki server Description: A path traversal issue exists in the Mac OS X v10.5 Server Wiki Server. Attackers with access to edit wiki content may upload files that leverage this issue to place content wherever the wiki server can write, which may lead to arbitrary code execution with the privileges of the wiki server. This update addresses the issue through improved file name handling. This issue does not affect systems prior to Mac OS X v10.5. Credit to Rodrigo Carvalho, from the Core Security Consulting Services (CSC) team of CORE Security Technologies. X11 CVE-ID: CVE-2007-4568, CVE-2007-4990 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: Multiple Vulnerabilities in X11 X Font Server (XFS) 1.0.4 Description: Multiple vulnerabilities exist in X11 X Font Server (XFS) 1.0.4, the most serious of which may lead to arbitrary code execution. This update addresses the issue by updating to version 1.0.5. Further information is available via the X.Org website at http://www.x.org/wiki/Development/Security These issues are already addressed in systems running Mac OS X v10.5.2. X11 CVE-ID: CVE-2006-3334, CVE-2006-5793, CVE-2007-2445, CVE-2007-5266, CVE-2007-5267, CVE-2007-5268, CVE-2007-5269 Available for: Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Multiple vulnerabilities in X11's libpng 1.2.8 Description: The PNG reference library (libpng) is updated to version 1.2.24 to address several vulnerabilities, the most serious of which may lead to a remote denial of service or arbitrary code execution. Further information is available via the libpng website at http://www.libpng.org/pub/png/libpng.html This issue affects libpng within X11. It does not affect systems prior to Mac OS X v10.5. X11 CVE-ID: CVE-2007-5958, CVE-2008-0006, CVE-2007-6427, CVE-2007-6428, CVE-2007-6429 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.2, Mac OS X Server v10.5.2 Impact: Multiple vulnerabilities in the X11 server Description: Numerous vulnerabilities in the X11 server allow execution of arbitrary code with the privileges of the user running the X11 server if the attacker can authenticate to the X11 server. This is a security vulnerability only if the X11 server is configured to not require authentication, which Apple does not recommend. This update fixes the issue by applying the updated X.Org patches. Further information is available via the X.Org website at http://www.x.org/wiki/Development/Security Security Update 2008-002 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.5.2 The download file is named: "SecUpd2008-002.dmg" Its SHA-1 digest is: 15083986b3ce6b73c3b894f1c2bcf5c22170236c For Mac OS X v10.4.11 (Universal) The download file is named: "SecUpd2008-002Univ.dmg" Its SHA-1 digest is: 49b1c6b1a919b33cbaada1c86eb501291e7145e8 For Mac OS X v10.4.11 (PPC) The download file is named: "SecUpd2008-002PPC.dmg" Its SHA-1 digest is: 8a838e33b6720184a4e4e13c17392892e5a06a56 For Mac OS X Server v10.5.2 The download file is named: "SecUpdSrvr2008-002.dmg" Its SHA-1 digest is: 2f5126096b872482315a25cd3d75bc1c0a082e84 For Mac OS X Server v10.4.11 (Universal) The download file is named: "SecUpdSrvr2008-002Univ.dmg" Its SHA-1 digest is: 77074bdd1d0574abe9631b12011f8ef1d15151b3 For Mac OS X Server v10.4.11 (PPC) The download file is named: "SecUpdSrvr2008-002PPC.dmg" Its SHA-1 digest is: 1b5f3c1464b1fce0d77f44e50a0b662b467e3fd0 Information will also be posted to the Apple Security Updates web site: http://docs.info.apple.com/article.html?artnum=61798 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: 9.7.0.1012 wsBVAwUBR+Ae7cgAoqu4Rp5tAQjZRQf+IGG7UCqswN49Nmrgw2paCky1Z9wjHlJw gDVCHHW0rssCjpi0Hg0W3YdNzvCCC/BvLn7ajOnBD2UVGxtfsg/DCBVCHGm7Z07S jaO01s18DQXS+nBdkUQ2xzhEkB6AtFD7U7r8VR1OEFYW/DtB9FuiQHeBCXeDJ4HY wqq+vv8qz471WbHzU4xuV+BTCFD9YCUEL4z1qEkBtPPPNh842gxF61ZhJvW1Ym9B 4uC+G4rCBDquwJ2V5zbqJrxeulDmGtvlVMgctwtsugcdsK9QI3G0WIDoeChoeHO/ nWCiql9dzc07lbrfbAtxbaF8ySnuzyL6VSShCd0OOnh1gJ2VRh8fCw== =7/yI -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2008-03-18 Safari 3.1
by Apple Product Security 18 Mar '08

18 Mar '08

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2008-03-18 Safari 3.1 Safari 3.1 is now available and addresses the following issues: Safari CVE-ID: CVE-2007-4680 Available for: Windows XP or Vista Impact: A remote attacker may be able to cause an untrusted certificate to appear trusted Description: An issue exists in the validation of certificates. A man-in-the-middle attacker may be able to direct the user to a legitimate site with a valid SSL certificate, then re-direct the user to a spoofed web site that incorrectly appears to be trusted. This could allow user credentials or other information to be collected. This update addresses the issue through improved validation of certificates. This issue is addressed for Mac OS X in Security Update 2007-008, and is incorporated into Mac OS X v10.4.11 and Mac OS X v10.5 or later. Credit to Marko Karppinen, Petteri Kamppuri, and Nikita Zhuk of MK&C for reporting this issue. Safari CVE-ID: CVE-2008-0050 Available for: Windows XP or Vista Impact: A malicious proxy server may spoof secure websites Description: A malicious HTTPS proxy server may return arbitrary data to CFNetwork in a 502 Bad Gateway error, which could allow a secure website to be spoofed. This update addresses the issue by returning an error on any proxy error, instead of returning the proxy-supplied data. This issue has already been addressed in Mac OS X 10.5.2, and in Security Update 2008-002 for Mac OS X 10.4.11 systems. Safari CVE-ID: CVE-2008-1001 Available for: Windows XP or Vista Impact: Visiting a maliciously crafted website may result in cross- site scripting Description: A cross-site scripting issue exists in Safari's error page. By enticing a user to open a maliciously crafted URL, an attacker may cause the disclosure of sensitive information. This update addresses the issue by performing additional validation of URLs. This issue does not affect Mac OS X systems. Credit to Robert Swiecki of Google Information Security Team for reporting this issue. Safari CVE-ID: CVE-2008-1002 Available for: Mac OS X v10.4.11, Mac OS X v10.5.2, Windows XP or Vista Impact: Visiting a maliciously crafted website may result in cross- site scripting Description: A cross-site scripting issue exists in the processing of javascript: URLs. Enticing a user to visit a maliciously crafted web page could allow the execution of JavaScript in the context of another site. This update addresses the issue by performing additional validation of javascript: URLs. Credit to Robert Swiecki of Google Information Security Team for reporting this issue. WebCore CVE-ID: CVE-2008-1003 Available for: Mac OS X v10.4.11, Mac OS X v10.5.2, Windows XP or Vista Impact: Visiting a maliciously crafted website may result in cross- site scripting Description: An issue exists with the handling of web pages that have explicitly set the document.domain property. This could lead to a cross-site scripting attack in sites that set the document.domain property, or between HTTP and HTTPS sites with the same document.domain. This update addresses the issue by improving same- origin checks. Credit to Adam Barth and Collin Jackson of Stanford University for reporting this issue. WebCore CVE-ID: CVE-2008-1004 Available for: Mac OS X v10.4.11, Mac OS X v10.5.2, Windows XP or Vista Impact: Using Web Inspector on a maliciously crafted website may result in cross-site scripting Description: An issue in Web Inspector allows a page being inspected to escalate its privileges by injecting script that will run in other domains and read the user's file system. This update addresses the issue by preventing Javascript code on remote pages from being run. Credit to Collin Jackson and Adam Barth of Stanford University for reporting this issue. WebCore CVE-ID: CVE-2008-1005 Available for: Mac OS X v10.4.11, Mac OS X v10.5.2, Windows XP or Vista Impact: Using Kotoeri reverse conversion on a password field displays the password Description: The content of password fields on web pages is normally hidden to guard against disclosing it to others with the ability to see the display. An issue exists with the use of the Kotoeri input method, which could result in exposing the password field content on the display when reverse conversion is requested. This update addresses the issue by no longer exposing the content of password fields when using Kotoeri reverse conversion. WebCore CVE-ID: CVE-2008-1006 Available for: Mac OS X v10.4.11, Mac OS X v10.5.2, Windows XP or Vista Impact: Visiting a maliciously crafted website may result in cross- site scripting Description: The window.open() function may be used to change the security context of a webpage to the caller's context. Enticing a user to open a maliciously crafted page could allow an arbitrary script to be executed in the user's security context. This update addresses the issue by not allowing the security context to be changed. Credit to Adam Barth and Collin Jackson of Stanford University for reporting this issue. WebCore CVE-ID: CVE-2008-1007 Available for: Mac OS X v10.4.11, Mac OS X v10.5.2, Windows XP or Vista Impact: Visiting a maliciously crafted website may result in cross- site scripting using Java Description: The frame navigation policy is not enforced for Java applets. By enticing a user to open a maliciously crafted web page, an attacker may obtain elevated privileges through a cross-site scripting attack using Java. This update addresses the issue by enforcing the frame navigation policy for Java applets. Credit to Adam Barth and Collin Jackson of Stanford University for reporting this issue. WebCore CVE-ID: CVE-2008-1008 Available for: Mac OS X v10.4.11, Mac OS X v10.5.2, Windows XP or Vista Impact: Visiting a maliciously crafted website may result in cross- site scripting Description: A cross-site scripting issue exists in Safari's handling of the document.domain property. Enticing a user to visit a maliciously crafted web page may lead to the disclosure of sensitive information. This update addresses the issue through additional validation of the document.domain property. WebCore CVE-ID: CVE-2008-1009 Available for: Mac OS X v10.4.11, Mac OS X v10.5.2, Windows XP or Vista Impact: Visiting a maliciously crafted website may result in cross- site scripting Description: A JavaScript injection issue exists in the handling of the history object. This may allow frames to set history object properties in all other frames loaded from the same web page. An attacker may leverage this issue to inject JavaScript that will run in the context of other frames, resulting in cross-site scripting. This update addresses the issue by no longer allowing webpages to alter the history object. WebKit CVE-ID: CVE-2008-1010 Available for: Mac OS X v10.4.11, Mac OS X v10.5.2, Windows XP or Vista Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow issue exists in WebKit's handling of JavaScript regular expressions. Enticing a user to visit a maliciously crafted webpage may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Eric Seidel of the WebKit Open Source Project, and Tavis Ormandy and Will Drewry of Google Security Team for reporting this issue. WebKit CVE-ID: CVE-2008-1011 Available for: Mac OS X v10.4.11, Mac OS X v10.5.2, Windows XP or Vista Impact: Visiting a maliciously crafted website may result in cross- site scripting Description: A cross-site scripting issue in WebKit allows method instances from one frame to be called in the context of another frame. Enticing a user to visit a maliciously crafted web page may lead to the disclosure of sensitive information. This update addresses the issue through improved handling of cross-domain method calls. Credit to David Bloom for reporting this issue. Safari 3.1 is available via the Apple Software Update application, or Apple's Safari download site at: http://www.apple.com/safari/download/ Safari for Mac OS X v10.5.2 The download file is named: "Safari31UpdLeo.dmg" Its SHA-1 digest is: db76743014600581d59c1be3b60f2d8edd3defcd Safari for Mac OS X v10.4.11 The download file is named: "Safari31UpdTiger.dmg" Its SHA-1 digest is: 567ef2be9bdba51c2cf86613958599123e5f45f1 Safari for Windows XP or Vista The download file is named: "SafariSetup.exe" Its SHA-1 digest is: 48f9bfd5145be9f8a9307ab3e83674df4799c763 Safari+QuickTime for Windows XP or Vista The file is named: "SafariQuickTimeSetup.exe" Its SHA-1 digest is: 2c35c091ba306ee59a3101f86899a310f55c385f This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: 9.7.0.1012 wsBVAwUBR9//t8gAoqu4Rp5tAQiPGAgAqRnKv37i68VRJ4Bzm2Jy42zoRRLl/4oD FxvrkNpAfZ0mAOdJxRCG65V6xFxgvOVlhyAWKFtI/F2dSQi7szdY+3tSlhsXoSE7 h9IXTkW5tal6TNTwG+GPD+C+cP8HEhVpgKLYq0vyBcj/8P8Ohc1XvFdglquZd2yZ o+nqtWQdxhYgaP+uG2c2N5OD3g1d9qYqFIGgAwbvRs1x9LaE4iO2EuysDtHFjIkC SMcUxXorOeXt/aNRQvl16aVEonXgZCQrLBlVa/uCtkOF5H9r3psNb9TiZnBpkdy0 NPkauIK6PLAcr74WSGzA4YjyeafTnKL/fpauGU/zs8LViAgPCP5Y1Q== =BSPj -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0