Security-announce

Download

security-announce@lists.apple.com

March 2009

1 participants
2 discussions

APPLE-SA-2009-03-11 iTunes 8.1
by Apple Product Security 12 Mar '09

12 Mar '09

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2009-03-11 iTunes 8.1 iTunes 8.1 is now available and addresses the following: iTunes CVE-ID: CVE-2009-0016 Available for: Windows XP or Vista Impact: Sending a maliciously crafted DAAP message may lead to a denial of service Description: An infinite loop exists in the handling of iTunes Digital Audio Access Protocol (DAAP) messages. Sending a message containing a maliciously crafted Content-Length parameter in the DAAP header may lead to a denial of service. This update addresses the issue by performing additional validation of DAAP messages. This issue does not affect Mac OS X systems. Credit to Xiaopeng Zhang, Zhenhua Liu, and Junfeng Jia of Fortinet's FortiGuard Global Security Research Team for reporting this issue. iTunes CVE-ID: CVE-2009-0143 Available for: Mac OS X v10.4.10 or later, Mac OS X Server v10.4.10 or later, Windows XP or Vista Impact: Subscribing to a malicious podcast may lead to the disclosure of iTunes username and password Description: A design issue exists in the iTunes podcast feature. A subscription to a malicious podcast may cause an authentication dialog to be presented to the user. This dialog may entice the user to send iTunes credentials to the podcast server. This update addresses the issue by clarifying the origin of the authentication request in the dialog. Credit to Simon Bellwood for reporting this issue. iTunes 8.1 may be obtained from: http://www.apple.com/itunes/download/ For Mac OS X: The download file is named: "iTunes8.1.dmg" Its SHA-1 digest is: 6c9ee64741158c9f45417b965b38b01ea3b51af1 For Windows XP / Vista: The download file is named: "iTunesSetup.exe" Its SHA-1 digest is: 00bd8842cf0f2026cc4590ef434f6846eeca7fa4 For Windows XP / Vista 64 Bit: The download file is named: "iTunes64Setup.exe" Its SHA-1 digest is: cd61ef5e5a6fd350d2ac4366a31de5d110defdff Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJJurQhAAoJEHkodeiKZIkBk6MIAKdiDyWja2nSeUH6auYmmRUM F9Xt68l8yL8tNlZ/qn/gFO3rnaUa3UTj2TzUpKiu5dUmYjtpg8/W5oLIHOn6nJDy sHzZILZckJj5XRbKNuuF5/hXWgclCdiqLsjNgujUQFP1PhK/dJeV4uIrg+U8i67T 24x/enoqA5xPOSYumVjWs2cxFq+G4D33wSReU0cSg+B/tpkL5YO2IXtczM0VNkBO 3Py1OPUPI2rMa9htUoqQdajmaXgFEK0+7Eu6jDFkbi9Cgvh7W1NjMDEKa1UGS3sr 71HC0fbp5pi4r7SdtH4D963Cj9kMeLS9HchVTQV52aDsj8IObGmloprZ1bHeDOo= =kcsL -----END PGP SIGNATURE-----

1 0

APPLE-SA-2009-03-05 Time Capsule and AirPort Base Station (802.11n*) Firmware 7.4.1
by Apple Product Security 06 Mar '09

06 Mar '09

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2009-03-05 Time Capsule and AirPort Base Station (802.11n*) Firmware 7.4.1 Time Capsule and AirPort Base Station (802.11n*) Firmware 7.4.1 is now available and addresses the following: CVE-ID: CVE-2008-2476 Available for: AirPort Extreme Base Station with 802.11n*, AirPort Express Base Station with 802.11n*, Time Capsule Impact: A remote user may be able to cause a denial of service attack, observe private network traffic, or inject forged packets Description: The IPv6 Neighbor Discovery Protocol implementation does not validate the origin of Neighbor Discovery messages. By sending a maliciously crafted message, a remote user may cause a denial of service, observe private network traffic, or inject forged packets. This update addresses the issue by performing additional validation of Neighbor Discovery messages. CVE-ID: CVE-2008-0473 Available for: AirPort Extreme Base Station with 802.11n*, AirPort Express Base Station with 802.11n*, Time Capsule Impact: A user on the local network may be able to cause an unexpected device shutdown Description: An out-of-bounds memory access issue exists in the handling of PPPoE discovery packets. By sending a maliciously crafted PPPoE discovery packet, a remote user may be able to cause an unexpected device shutdown. This update addresses the issue through improved bounds checking. CVE-ID: CVE-2008-3530 Available for: AirPort Extreme Base Station with 802.11n*, AirPort Express Base Station with 802.11n*, Time Capsule Impact: A remote user may be able to cause an unexpected device shutdown Description: When IPv6 support is enabled, IPv6 nodes use ICMPv6 to report errors encountered while processing packets. An implementation issue in the handling of incoming ICMPv6 "Packet Too Big" messages may cause an unexpected device shutdown. This update addresses the issue through improved handling of ICMPv6 messages. Installation note for Firmware version 7.4.1 Firmware version 7.4.1 is installed into Time Capsule or AirPort Base Station with 802.11n* via AirPort Utility, provided with the device. It is recommended that AirPort Utility 5.4.1 be installed before upgrading to Firmware version 7.4.1. AirPort Utility 5.4.1 may be obtained through Apple's Software Download site: http://www.apple.com/support/downloads/ (*) Based on an IEEE 802.11n draft specification Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJJrzcMAAoJEHkodeiKZIkBs5UIALDK3nyGyd/9VKlhhbyxARTs 2Q2FW/nQTqst90gqJDXVmn6X3iqP7Za9wq2gUPSjOsyMz4hEQxJe3RTmwQDp21lI fDnW+qbHMgK+kJ4i7c5ZX1FfaRuETPX5nurqKvpRmEJDP2SshWgjaDcw8VE9JBty ypfyOsq+Xmp84IjhGaokw4Ug/EPj6aOF4yT8OPcsAE6GwPBlg9chZvLelAVkOcCE /+CUIb9o5OjLBXjyepL05clkUXGULzBcOGAcB6At6WlwzWr/QEIPWliWDbEYeo6X Y8FlrMXvW9+rWuv95qF6vEGfh0VtV1BveKAZPMVoLcW0jI5zHYh7GBkhjcS0F98= =chDp -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0