July 2008 - Security-announce

APPLE-SA-2008-07-11 Xcode tools 3.1
by Apple Product Security 12 Jul '08

12 Jul '08

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2008-07-11 Xcode tools 3.1 Xcode tools 3.1 is now available and addresses the following issues: CoreImage Examples CVE-ID: CVE-2008-2304 Available for: Mac OS X v10.5.x Impact: Opening a Fun House document may lead to an unexpected application termination or arbitrary code execution Description: Xcode tools contain an example application called Core Image Fun House that handles content with the ".funhouse" extension. A buffer overflow may occur in this application when processing ".funhouse" files. Opening a maliciously-crafted ".funhouse" file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Kevin Finisterre of Netragard for reporting this issue. WebObjects CVE-ID: CVE-2008-2318 Available for: Mac OS X v10.5.x Impact: WebObjects session IDs may be disclosed to other web sites Description: WebObjects contains an API to generate URLs in HTML documents via the WOHyperlink dynamic element. When WOHyperlink is used, it always appends a session ID to the generated URL, even for absolute URLs. Using WOHyperlink to create URLs that point at other web sites may result in the disclosure of the current user's session ID to those sites. This update addresses the issue by appending session IDs to absolute URLs only when explicitly requested. Xcode tools 3.1 may be obtained from the Downloads section of the Apple Developer Connection Member site: http://developer.apple.com/ Login is required, and membership is free. The download file is named: "xcode31_2199_developerdvd.dmg" Its SHA-1 digest is: e90f21f262dec5f1dae983e8fb53a613f2cc72b0 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: 9.7.2.1608 wsBVAwUBSHgEAnkodeiKZIkBAQi+nAgAqVMExB6v6jae4vuxKL1VI/ZnZlh0+p84 gJYvgP7noHwEinVyX0xP/ntABviuHpwSCb31Ba66DiR5hHZcaOk7MLwKM/zKEfdN CMUSMXiIb3WIe8adNZUAmybPET2DvlaMbsuB5IWoKdd0k2F7ko4YPT+HQ3Fe6OKd Qn6F9RV9qjJgaEwVq8QxzPJ+vx2Ryr5kD/rbF7Za60ZsvJL0pbvS4dLiGXyDO5Wu fJOmd4Nh+FtZdY8z8t3uaFpdy23hspiTQnYigjih3J8ASj3fWQJFKmR28elbT07v foQwRKJE6oETOci8xtJUcOEQLdRvhVJ9bMD1CRBnzmSvbPEZaeWq3Q== =98T5 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2008-07-11 iPhone 2.0 and iPod touch 2.0
by Apple Product Security 11 Jul '08

11 Jul '08

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2008-07-11 iPhone 2.0 and iPod touch 2.0 iPhone 2.0 and iPod touch 2.0 are now available and address the following issues: CFNetwork CVE-ID: CVE-2008-0050 Available for: iPhone v1.0 through v1.1.4, iPod touch v1.1 through v1.1.4 Impact: A malicious proxy server may spoof secure websites Description: A malicious HTTPS proxy server may return arbitrary data to CFNetwork in a 502 Bad Gateway error, which could allow a secure website to be spoofed. This update addresses the issue by not returning the proxy-supplied data on an error condition. Kernel CVE-ID: CVE-2008-0177 Available for: iPhone v1.0 through v1.1.4, iPod touch v1.1 through v1.1.4 Impact: A remote attacker may be able to cause an unexpected device reset Description: An undetected failure condition exists in the handling of packets with an IPComp header. Sending a maliciously crafted packet to a system configured to use IPSec or IPv6 may cause an unexpected device reset. This update addresses the issue by properly detecting the failure condition. Safari CVE-ID: CVE-2008-1588 Available for: iPhone v1.0 through v1.1.4, iPod touch v1.1 through v1.1.4 Impact: Unicode ideographic spaces may be used to spoof a website Description: When Safari displays the current URL in the address bar, Unicode ideographic spaces are rendered. This allows a maliciously crafted website to direct the user to a spoofed site that visually appears to be a legitimate domain. This update addresses the issue by not rendering Unicode ideographic spaces in the address bar. Safari CVE-ID: CVE-2008-1589 Available for: iPhone v1.0 through v1.1.4, iPod touch v1.1 through v1.1.4 Impact: Visiting a maliciously crafted website may lead to the disclosure of sensitive information Description: When Safari accesses a website that uses a self-signed or invalid certificate, it prompts the user to accept or reject the certificate. If the user presses the menu button while at the prompt, then on the next visit to the site, the certificate is accepted with no prompt. This may lead to the disclosure of sensitive information. This update addresses the issue through improved handling of certificates. Credit to Hiromitsu Takagi for reporting this issue. Safari CVE-ID: CVE-2008-2303 Available for: iPhone v1.0 through v1.1.4, iPod touch v1.1 through v1.1.4 Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A signedness issue in Safari's handling of JavaScript array indices may result in an out-of-bounds memory access. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of JavaScript array indices. Credit to SkyLined of Google for reporting this issue. Safari CVE-ID: CVE-2006-2783 Available for: iPhone v1.0 through v1.1.4, iPod touch v1.1 through v1.1.4 Impact: Visiting a maliciously crafted website may lead to cross- site scripting Description: Safari ignores Unicode byte order mark sequences when parsing web pages. Certain websites and web content filters attempt to sanitize input by blocking specific HTML tags. This approach to filtering may be bypassed and lead to cross-site scripting when encountering maliciously-crafted HTML tags containing byte order mark sequences. This update addresses the issue through improved handling of byte order mark sequences. Credit to Chris Weber of Casaba Security, LLC for reporting this issue. Safari CVE-ID: CVE-2008-2307 Available for: iPhone v1.0 through v1.1.4, iPod touch v1.1 through v1.1.4 Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in WebKit's handling of JavaScript arrays. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to James Urquhart for reporting this issue. Safari CVE-ID: CVE-2008-2317 Available for: iPhone v1.0 through v1.1.4, iPod touch v1.1 through v1.1.4 Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in WebCore's handling of style sheet elements. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved garbage collection. Credit to Peter Vreudegnhil working with the TippingPoint Zero Day Initiative for reporting this issue. Safari CVE-ID: CVE-2007-6284 Available for: iPhone v1.0 through v1.1.4, iPod touch v1.1 through v1.1.4 Impact: Processing an XML document may lead to a denial of service Description: A memory consumption issue exists in the handling of XML documents containing invalid UTF-8 sequences, which may lead to a denial of service. This update addresses the issue by updating the libxml2 system library to version 2.6.16. Safari CVE-ID: CVE-2008-1767 Available for: iPhone v1.0 through v1.1.4, iPod touch v1.1 through v1.1.4 Impact: Processing an XML document may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in the libxslt library. Viewing a maliciously crafted HTML page may lead to an unexpected application termination or arbitrary code execution. Further information on the patch applied is available via the xmlsoft.org website http://xmlsoft.org/XSLT/ Credit to Anthony de Almeida Lopes of Outpost24 AB, and Chris Evans of Google Security Team for reporting this issue. WebKit CVE-ID: CVE-2008-1590 Available for: iPhone v1.0 through v1.1.4, iPod touch v1.1 through v1.1.4 Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in JavaScriptCore's handling of runtime garbage collection. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved garbage collection. Credit to Itzik Kotler and Jonathan Rom of Radware for reporting this issue. WebKit CVE-ID: CVE-2008-1025 Available for: iPhone v1.0 through v1.1.4, iPod touch v1.1 through v1.1.4 Impact: Accessing a maliciously crafted URL may result in cross-site scripting Description: An issue exists in WebKit's handling of URLs containing a colon character in the host name. Accessing a maliciously crafted URL may lead to a cross-site scripting attack. This update addresses the issue through improved handling of URLs. Credit to Robert Swiecki of the Google Security Team, and David Bloom for reporting this issue. WebKit CVE-ID: CVE-2008-1026 Available for: iPhone v1.0 through v1.1.4, iPod touch v1.1 through v1.1.4 Impact: Viewing a maliciously crafted web page may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow exists in WebKit's handling of JavaScript regular expressions. The issue may be triggered via JavaScript when processing regular expressions with large, nested repetition counts. This may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of JavaScript regular expressions. Credit to Charlie Miller of Independent Security Evaluators for reporting this issue. Installation note: This update is only available through iTunes, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes will automatically check Apple's update server on its weekly schedule. When an update is detected, it will download it. When the iPhone or iPod touch is docked, iTunes will present the user with the option to install the update. We recommend applying the update immediately if possible. Selecting "don't install" will present the option the next time you connect your iPhone or iPod touch. The automatic update process may take up to a week depending on the day that iTunes checks for updates. You may manually obtain the update via the "Check for Update" button within iTunes. After doing this, the update can be applied when your iPhone or iPod touch is docked to your computer. To check that the iPhone or iPod touch has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "2.0 (5A345)" or later Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.3 (Build 2932) iQEVAwUBSHeR43kodeiKZIkBAQhfJwgAuYkrStQHS1TdKGau/y8Ap1f/mULUtwf/ fkKoVjtNk89k1gW8P/eWZsextVgotw8Jf2DvHHh5pjCAxOqCbX7+q0GHB8f7XJ7m KiPm3RlnjYggWVJJFQgAaifOhURQgKL1scFFVFimhbobyYYWMmvA3E/Ej+fgay5d 6JKTAsTNFTfTypKeTAPKGLTGuRhPIeEPg+lCMQDA3bLNYvke660bzpv4oISwldx6 gFpCoHd/NmFfXPFIQLICaeuCMhExo0sPFvq/6r5o0sDTsvS/Lm4Uf9zFMhKDOL5x uDiUOjVHQpzxdtfaJuwIHyoPLRXwKqJlb14okyj0JJHtqQe82mIPDw== =/Ju0 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2008-07-10 Apple TV 2.1
by Apple Product Security 10 Jul '08

10 Jul '08

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2008-07-10 Apple TV 2.1 Apple TV 2.1 is now available and addresses the following issues: Apple TV CVE-ID: CVE-2008-1015 Available for: Apple TV Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: An issue in the handling of data reference atoms may result in a buffer overflow. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of data reference atoms. Credit to Chris Ries of Carnegie Mellon University Computing Services for reporting this issue. Apple TV CVE-ID: CVE-2008-1017 Available for: Apple TV Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: An issue in the parsing of 'crgn' atoms may result in a heap buffer overflow. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Sanbin Li working with TippingPoint's Zero Day Initiative for reporting this issue. Apple TV CVE-ID: CVE-2008-1018 Available for: Apple TV Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: An issue in the parsing of 'chan' atoms may result in a heap buffer overflow. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to an anonymous researcher working with TippingPoint's Zero Day Initiative for reporting this issue. Apple TV CVE-ID: CVE-2008-1585 Available for: Apple TV Impact: Playing maliciously crafted QuickTime content may lead to arbitrary code execution Description: A URL handling issue exists in the handling of file: URLs. This may allow arbitrary applications and files to be launched when a user plays maliciously crafted QuickTime content. This update addresses the issue by not longer launching local applications and files. Credit to Vinoo Thomas and Rahul Mohandas of McAfee Avert Labs, and Petko D. (pdp) Petkov of GNUCITIZEN working with TippingPoint's Zero Day Initiative for reporting this issue. Apple TV CVE-ID: CVE-2008-0234 Available for: Apple TV Impact: Playing maliciously crafted QuickTime content may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow exists in the handling of HTTP responses when RTSP tunneling is enabled. Playing maliciously crafted QuickTime content may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Apple TV CVE-ID: CVE-2008-0036 Available for: Apple TV Impact: Opening a maliciously crafted PICT image may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow may occur while processing a compressed PICT image. Opening a maliciously crafted compressed PICT file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by terminating decoding when the result would extend beyond the end of the destination buffer. Credit to Chris Ries of Carnegie Mellon University Computing Services for reporting this issue. Installation note: The Apple TV device will automatically check Apple's update server on its weekly schedule. When an update is detected, it will download it, verify its signature, and install it. This process may take up to a week depending on the day that the Apple TV device checks for updates. Alternatively, you may manually update your Apple TV using the TV interface by selecting Settings > Update Software. This update is only available directly to the Apple TV, and will not appear in your computer's Software Update application, or in the Apple Downloads site. To check that the Apple TV has been updated, use the TV interface: * Navigate to Settings * Select About * The Software Version after applying this update will be "2.1" * To exit the About screen to the main menu, press Menu Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.3 (Build 2932) iQEVAwUBSHYhSHkodeiKZIkBAQizpggAz/nHtG/DF+1KWoq1LZdwkFiE3/ZkTTt6 Vx77MDj+3pzxPZ3l83t6LhGheN88nwl5KBGCiBgHGwu23Xi1AjjxFMnyjBdfrv6M U07GJ5cJondUS6ITr75zp2b8hrYlKbLzXRIbH2E+toVLlrPD8/3u8frAzM9uo50M qr5f2Ps5eqGcj2hTmSHfm0uKcmWIUWHtVWeaBxJyQjLSN+01ZDcyiYRX0wSG7gNW 63VcrKKrMGk4+JkeK7wI7YioF2whFgrj9SuKsCQlRSsGFQb51UDuHSHH8OGnCWF3 MioEA62tn7lgT9JW5aJ7QneTRMW/rQkxOb9FCLncUTbd7gExTvO+Yw== =SZ/B -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0