September 2009 - Security-announce

APPLE-SA-2009-09-22-1 iTunes 9.0.1
by Apple Product Security 22 Sep '09

22 Sep '09

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2009-09-22-1 iTunes 9.0.1 iTunes 9.0.1 is now available and addresses the following: iTunes CVE-ID: CVE-2009-2817 Available for: Mac OS X v10.4.11 or later, Mac OS X Server v10.4.11 or later, Windows XP, Vista, Windows 7 Impact: Opening a maliciously crafted .pls file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow exists in the handling of .pls files. Opening a maliciously crafted .pls file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Roger Hart of IP3, and Steven Woolley at Oogli LLC for reporting this issue. iTunes 9.0.1 may be obtained from: http://www.apple.com/itunes/download/ For Mac OS X: The download file is named: "iTunes9.0.1.dmg" Its SHA-1 digest is: eea9dbc34e395a44bfa821501827ea3c5b4c24a9 For Windows XP / Vista / Windows 7: The download file is named: "iTunesSetup.exe" Its SHA-1 digest is: 25d04ff5a63a808ca56875cdf9a9474b9b845f1d For 64-bit Windows XP / Vista / Windows 7: The download file is named: "iTunes64Setup.exe" Its SHA-1 digest is: 85f8c516cb45024292cde1f48e88fd392e25626f Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJKuTw7AAoJEHkodeiKZIkBDj8H/RLVXG4pWYrQE71D4+lGmTLq oCN/uxIaH2b+xG6FkuTa21DYg6UocPY7umJLXzp9GnN1LPsxjLFwRcjkoB8mGf8S 5ggY8GeJZYuP8+4vjcho/+spnUsdvFNPn6NDDsBg+dUCSlGSSUm/cOrkhBO7n5xx t+3vVMRlw16qtbr4uNh7jg27Onkogxyf2LBcMIMTJztwtWfXi3gM9StkK3JnwSrN 9+ClSrJifjcfPTo1y3ag0kD85ujmgR1K8MpUjSbSIED8Lhsjm/Q6YDvL4SErLxhq e8jRVgW0rKta5MPPWgnlfN3i/UM7dP/F0vbf5P5BrHZoyUKWMu4zkxlGz0RalHs= =HlzW -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2009-09-14-1 Xsan 2.2
by Apple Product Security 14 Sep '09

14 Sep '09

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2009-09-14-1 Xsan 2.2 Xsan 2.2 is now available and addresses the following: Xsan CVE-ID: CVE-2009-2201 Available for: Mac OS X v10.5.8, Mac OS X v10.6 or later Mac OS X Server v10.5.8 or later Impact: When screensharing via the Xsan Admin application, another person viewing the display may see the user's name and password Description: Screensharing via the Xsan Admin application could present an error dialog containing the user's name and password. A person who can view the user's display could see the user's credentials in cleartext. The issue is addressed by not embedding credentials in the connection URL. This issue affects only Xsan Admin, and not Xsan Filesystem. Credit to Ben Greisler of Kadimac Corp Macintosh Integrators for reporting this issue. Xsan 2.2 may be obtained from: http://www.apple.com/support/downloads/ For Mac OS X v10.5.8 The download file is named: XsanAdminUpdateLeopard.dmg Its SHA-1 digest is: 1338995f77de6f6223a58c685b8e998c2bca8cb3 For Mac OS X v10.6 or later The download file is named: XsanAdminUpdateSnowLeo.dmg Its SHA-1 digest is: 65bb78ea875af4cdecdab1a029b3209018fa7e46 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJKrop7AAoJEHkodeiKZIkBURoIAIiO5xWiggHQHiBHQHZB/hMH ItoM813UkEBuKo7lY6VGWH3FGR+09XZ7DedcS5NH/DBShuvJUTCpY/T1MPqg7oxF CRVtAXc+rOAKJFIUb7HzCwVQjs0fAjld7byTYYJyk5GPvYuuCKfWTHZn3vVfeb0L GdHRpHH3Y9uqR5zXVvaR/FnKqsCLy6vaRIOWxEWvan4Jj1I9eLlYwqEoqLsv6Nb5 4Ftp6HawGbpTbR8SKzmE/NgVCr204oBD9v3BGNCaSZl//t8N3EKDP5YhhwulS+DY CjwY/bGij8MrlbVWTVL5ESrrdMce+NCfkWHJr+YjwY+hUf1WYT+TpI7hDFCracQ= =cQQa -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2009-09-10-2 Security Update 2009-005
by Apple Product Security 10 Sep '09

10 Sep '09

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2009-09-10-2 Security Update 2009-005 Security Update 2009-005 is now available and addresses the following: Alias Manager CVE-ID: CVE-2009-2800 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Opening a maliciously crafted alias file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow exists in the handling of alias files. Opening a maliciously crafted alias file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. This issue does not affect Mac OS X v10.6 systems. Credit: Apple. CarbonCore CVE-ID: CVE-2009-2803 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Opening a file with a maliciously crafted resource fork may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in the Resource Manager's handling of resource forks. Opening a file with a maliciously crafted resource fork may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved validation of resource forks. This issue does not affect Mac OS X v10.6 systems. Credit: Apple. ClamAV CVE-ID: CVE-2009-1241, CVE-2009-1270, CVE-2008-6680, CVE-2009-1371, CVE-2009-1372 Available for: Mac OS X Server v10.5.8 Impact: Multiple vulnerabilities in ClamAV 0.94.2 Description: Multiple vulnerabilities exist in ClamAV 0.94.2, the most serious of which may lead to arbitrary code execution. This update addresses the issues by updating ClamAV to version 0.95.2. ClamAV is distributed only with Mac OS X Server systems. Further information is available via the ClamAV website at http://www.clamav.net/ These issues do not affect Mac OS X v10.6 systems. ColorSync CVE-ID: CVE-2009-2804 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Viewing a maliciously crafted image with an embedded ColorSync profile may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow exists in the handling of images with an embedded ColorSync profile, which may lead to a heap buffer overflow. Opening a maliciously crafted image with an embedded ColorSync profile may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of ColorSync profiles. This issue does not affect Mac OS X v10.6 systems. Credit: Apple. CoreGraphics CVE-ID: CVE-2009-2805 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow in CoreGraphics' handling of PDF files may result in a heap buffer overflow. Opening a PDF file containing a maliciously crafted JBIG2 stream may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Will Dormann of CERT/CC for reporting this issue. This issue does not affect Mac OS X v10.6 systems. CoreGraphics CVE-ID: CVE-2009-2468 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow exists in the drawing of long text strings. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. This issue does not affect Mac OS X v10.6 systems. Credit to Will Drewry of Google Inc. for reporting this issue. CUPS CVE-ID: CVE-2009-0949 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: A remote attacker may be able to deny access to the Printer Sharing service Description: A null pointer dereference exists in CUPS. By repeatedly sending maliciously crafted scheduler requests, a remote attacker may be able to deny access to the Printer Sharing service. This update addresses the issue through improved validation of scheduler requests. This issue does not affect Mac OS X v10.6 systems. Credit to Anibal Sacco of the CORE IMPACT Exploit Writing Team (EWT) at Core Security Technologies for reporting this issue. CUPS CVE-ID: CVE-2009-2807 Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: An uprivileged local user may be able to obtain system privileges Description: A heap buffer overflow exists in the CUPS USB backend. This may allow a local user to obtain system privileges. This update addresses the issue through improved bounds checking. This issue does not affect systems prior to Mac OS X v10.5, or Mac OS X v10.6 systems. Flash Player plug-in CVE-ID: CVE-2009-1862, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869, CVE-2009-1870 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Multiple vulnerabilities in Adobe Flash Player plug-in Description: Multiple issues exist in the Adobe Flash Player plug- in, the most serious of which may lead to arbitrary code execution when viewing a maliciously crafted web site. The issues are addressed by updating the Flash Player plug-in on Mac OS v10.5.8 to version 10.0.32.18, and to version 9.0.246.0 on Mac OS X v10.4.11 systems. For Mac OS X v10.6 systems, these issues are addressed in Mac OS X v10.6.1. Further information is available via the Adobe web site at http://www.adobe.com/support/security/bulletins/apsb09-10.html ImageIO CVE-ID: CVE-2009-2809 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Viewing a maliciously crafted PixarFilm encoded TIFF image may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues exist in ImageIO's handling of PixarFilm encoded TIFF images. Viewing a maliciously crafted PixarFilm encoded TIFF image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through additional validation of PixarFilm encoded TIFF images. This issue does not affect Mac OS X v10.6 systems. Credit: Apple. Launch Services CVE-ID: CVE-2009-2811 Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Attempting to open unsafe downloaded content may not lead to a warning Description: This update adds '.fileloc' to the system's list of content types that will be flagged as potentially unsafe under certain circumstances, such as when they are downloaded from an e-mail. While these content types are not automatically opened, if manually opened they could lead to the execution of a malicious payload. This update improves the system's ability to notify users before handling '.fileloc' files. This issue does not affect Mac OS X v10.6 systems. Credit: Apple. Launch Services CVE-ID: CVE-2009-2812 Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Visiting a malicious website may lead to arbitrary code execution Description: When an application is downloaded, Launch Services analyzes its exported document types. A design issue in the handling of the exported document types may cause Launch Services to associate a safe file extension with an unsafe Uniform Type Identifier (UTI). Visiting a malicious website may cause an unsafe file type to be opened automatically. This update addresses the issue through improved handling of exported document types from untrusted applications. This issue does not affect systems prior to Mac OS X v10.5, or Mac OS X v10.6 systems. Credit: Apple. MySQL CVE-ID: CVE-2008-2079 Available for: Mac OS X Server v10.5.8 Impact: MySQL is updated to version 5.0.82 Description: MySQL is updated to version 5.0.82 to address an implementation issue that allows a local user to obtain elevated privileges. This issue only affects Mac OS X Server systems. This issue does not affect Mac OS X v10.6 systems. Further information is available via the MySQL web site at http://dev.mysql.com/doc/refman/5.0/en/news-5-0-82.html PHP CVE-ID: CVE-2009-1271, CVE-2009-1272, CVE-2009-0590, CVE-2009-0591, CVE-2009-0789, CVE-2008-5498 Available for: Mac OS X v10.5, Mac OS X Server v10.5.8 Impact: Multiple vulnerabilities in PHP 5.2.8 Description: PHP is updated to version 5.2.10 to address multiple vulnerabilities, the most serious of which may lead to arbitrary code execution. Further information is available via the PHP website at http://www.php.net/ These issues do not affect Mac OS X v10.6 systems. SMB CVE-ID: CVE-2009-2813 Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Enabling Windows File Sharing may share folders unexpectedly Description: An unchecked error condition exists in Samba. A user who does not have a configured home directory, and connects to the Windows File Sharing service, will be able to access the contents of the file system, subject to local file system permissions. This update addresses the issue by improving the handling of path resolution errors. This issue does not affect systems prior to Mac OS X v10.5, or Mac OS X v10.6 systems. Credit to J. David Hester of LCG Systems National Institutes of Health for reporting this issue. Wiki Server CVE-ID: CVE-2009-2814 Available for: Mac OS X Server v10.5.8 Impact: A remote attacker may gain access to Wiki Server user accounts Description: A cross site scripting issue exists in the Wiki Server's handling of search requests containing non-UTF-8 encoded data. This may allow a remote attacker to access a Wiki server with the credentials of the Wiki Server user performing the search. This update addresses the issue by setting UTF-8 as the default character set in HTTP responses. This issue does not affect systems prior to Mac OS X v10.5, or Mac OS X v10.6 systems. Credit: Apple. Security Update 2009-005 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.5.8 The download file is named: SecUpd2009-005.dmg Its SHA-1 digest is: d43cff3c40a0917757f6b1ec59286146ee62dfde For Mac OS X Server v10.5.8 The download file is named: SecUpdSrvr2009-005.dmg Its SHA-1 digest is: 3490619467bda4c925ac7cb7843d3d1395984d71 For Mac OS X v10.4.11 (Intel) The download file is named: SecUpd2009-005Intel.dmg Its SHA-1 digest is: 39abe0dec8fbb8f08e0bff5f77b7dcf3b2ae908b For Mac OS X v10.4.11 (PPC) The download file is named: SecUpd2009-005PPC.dmg Its SHA-1 digest is: 77ca15c58ad4d8ddd84e570860e664d3425a2144 For Mac OS X Server v10.4.11 (Universal) The download file is named: SecUpdSrvr2009-005Univ.dmg Its SHA-1 digest is: 1e1c64af2df0023d4b49d544ba3a639fa3e070b6 For Mac OS X Server v10.4.11 (PPC) The download file is named: SecUpdSrvr2009-005PPC.dmg Its SHA-1 digest is: e467f309e59206e140e0d48c76b3ec2f83e56919 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJKqVrZAAoJEHkodeiKZIkBGNoH/3a6WCcxV2Ro3sQe9/zRt0AZ AxxFM1Xi9nfm6KvNtCdt2XVgpFtpSWboJOd1qP6uyNgY5kPt2Njcfwe7f/tz6fi+ KOT0DPTh4tuWCCTUQq+8j4bUQ+TS+c+3lGrTjrMbBhtlp3nzS7TEhNAUBFM62bN1 jSb2Tw0AQ2vM/m6z167zoyKosGdIFys4ACFaHKEjBCNMgb30079ZMA0JPzyFaGE0 JFGKBxdjPOI/EVqD8Jl1VpqHfX5PtgCQ6dfbZvgTdbqlCiN/mzteRgaWjvUdMgDy Q7TBmSdUWH5JSymr8WmiOf66qXAIl3dV/IaeQmIX0kb3zt8xAQseO1MQxo7vEtg= =DWqn -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2009-09-10-1 Mac OS X v10.6.1
by Apple Product Security 10 Sep '09

10 Sep '09

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2009-09-10-1 Mac OS X v10.6.1 Mac OS X v10.6.1 is now available and addresses the following: Flash Player plug-in CVE-ID: CVE-2009-1862, CVE-2009-1863, CVE-2009-1864, CVE-2009-1865, CVE-2009-1866, CVE-2009-1867, CVE-2009-1868, CVE-2009-1869, CVE-2009-1870 Available for: Mac OS X v10.6, Mac OS X Server v10.6 Impact: Multiple vulnerabilities in Adobe Flash Player plug-in Description: Multiple issues exist in the Adobe Flash Player plug- in, the most serious of which may lead to arbitrary code execution when viewing a maliciously crafted web site. The issues are addressed by updating the Flash Player plug-in to version 10.0.32.18. Further information is available via the Adobe web site at http://www.adobe.com/support/security/bulletins/apsb09-10.html Mac OS X v10.6.1 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.6 The download file is named: MacOSXUpd10.6.1.dmg Its SHA-1 digest is: 2e20c303e0078a488702172d782cb1b882eef543 For Mac OS X Server v10.6 The download file is named: MacOSXServerUpd10.6.1.dmg Its SHA-1 digest is: 736474bbfc70244c1ff951621fa484ccdfcaf3c7 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (Darwin) iQEcBAEBAgAGBQJKqYtIAAoJEHkodeiKZIkB4xoH/RxaJXvbfCd54s3X6ABxLf4X ElF//coZOuSIITSk/J7Fulgdkcza8XGefTVQP5DHMJDzwvKP51QE9W2GRfgKjas7 gkXAI689H1Wev9ik6T4AdVZpuixz3pGYhRyNfSHY10AkUtAckTaksizGVM26hNHr PKDEfvsrjTTF5wE8k8339q1hyfdFxkGH5dtuhrbBzPtnCrMnQNUMURWK/XHfznl1 kpU76YFjvWR/d4YoHFtX515gdvYmm3yoLjEzxgTAnkwZutCWeuZABIvVXsQr0Nzf R8nGR/7cSoEdAsMFtS3VRjEy3JfDSO2L8ceH6v8dl4hEaUtl0hwCXR0untpF9as= =pTN3 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2009-09-09-2 QuickTime 7.6.4
by Apple Product Security 09 Sep '09

09 Sep '09

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2009-09-09-2 QuickTime 7.6.4 QuickTime 7.6.4 is now available and addresses the following: QuickTime CVE-ID: CVE-2009-2202 Available for: Mac OS X v10.4.11, Mac OS X v10.5.8, Windows 7, Vista and XP SP3 Impact: Viewing a maliciously crafted H.264 movie may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in QuickTime's handling of H.264 movie files. Viewing a maliciously crafted H.264 movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Tom Ferris of the Adobe Secure Software Engineering Team for reporting this issue. QuickTime CVE-ID: CVE-2009-2203 Available for: Mac OS X v10.4.11, Mac OS X v10.5.8, Windows 7, Vista and XP SP3 Impact: Opening a maliciously crafted MPEG-4 video file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow exists in QuickTime's handling of MPEG-4 video files. Opening a maliciously crafted MPEG-4 video file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Alex Selivanov for reporting this issue. QuickTime CVE-ID: CVE-2009-2798 Available for: Mac OS X v10.4.11, Mac OS X v10.5.8, Windows 7, Vista and XP SP3 Impact: Viewing a maliciously crafted FlashPix file may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow exists in QuickTime's handling of FlashPix files. Viewing a maliciously crafted FlashPix file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Damian Put working with TippingPoint and the Zero Day Initiative for reporting this issue. QuickTime CVE-ID: CVE-2009-2799 Available for: Mac OS X v10.4.11, Mac OS X v10.5.8, Windows 7, Vista and XP SP3 Impact: Viewing a maliciously crafted H.264 movie may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow exists in QuickTime's handling of H.264 movie files. Viewing a maliciously crafted H.264 movie file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to an anonymous researcher working with TippingPoint and the Zero Day Initiative for reporting this issue. QuickTime 7.6.4 may be obtained from the Software Update application, or from the QuickTime Downloads site: http://www.apple.com/quicktime/download/ For Mac OS X v10.5.8 The download file is named: "QuickTime764_Leopard.dmg" Its SHA-1 digest is: f35a8f6f09ee884405ae10b1eca4b7c059f274f0 For Mac OS X v10.4.11 The download file is named: "QuickTime764_Tiger.dmg" Its SHA-1 digest is: 8e4cdc8b5b98a314f7a67485184b64cecfb218f2 For Windows 7 / Vista / XP SP3 The download file is named: "QuickTimeInstaller.exe" Its SHA-1 digest is: 0377256124a74db82b6a75ab9b296aa6e6306e0a QuickTime with iTunes for Windows 32-bit XP or Vista The download file is named: "iTunesSetup.exe" Its SHA-1 digest is: 68c84dd8d910ce6cc1508f41cb86d20de839f2e3 QuickTime with iTunes for Windows 64-bit Vista or 7 The download file is named: "iTunes64Setup.exe" Its SHA-1 digest is: 9a492dadc7f396bd92bdfc7cb0ff4de15db1b2c2 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJKp9FUAAoJEHkodeiKZIkBLYAIAJge+7rXmG+rMf+XhPIRNB5d 8QigTIzf4eNlhWUzvTltJ8blEyXBEfk1Tmkb6i3LB4ySkEksWH049b3Ef2v/MwDP 2x6Ra3LZBBKPLdv+RT8c3tuBQn433auyfSNqnJUlw8tJUEuCZ4INwOMYcp5I6FJk 49fQLX8l1sbXbI47/2Mbe4zh3KxNIbEBInV4/r3YwEvaovOXDmkGfWpDdr5kLK2G ej6jz/6qPgKzud3loQQHAtKW3iy0jl2tHCUWSQPuDAEM7iMDsDqqpk6buNAyz1TS +qf9b1RPLuFkb2xL+KRfLOhOik4irJvhh562OWBu9wIXuIiHnFg8PGCHmYCk9iw= =55zo -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2009-09-09-1 iPhone OS 3.1 and iPhone OS 3.1.1 for iPod touch
by Apple Product Security 09 Sep '09

09 Sep '09

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2009-09-09-1 iPhone OS 3.1 and iPhone OS 3.1.1 for iPod touch iPhone OS 3.1 and iPhone OS 3.1.1 for iPod touch are now available and address the following: CoreAudio CVE-ID: CVE-2009-2206 Available for: iPhone OS 1.0 through 3.0.1, iPhone OS for iPod touch 1.1 through 3.0 Impact: Opening a maliciously crafted AAC or MP3 file may lead to an unexpected application termination or arbitrary code execution Description: A heap buffer overflow exists in the handling of AAC and MP3 files. Opening a maliciously crafted AAC or MP3 file may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Tobias Klein of trapkit.de for reporting this issue. Exchange Support CVE-ID: CVE-2009-2794 Available for: iPhone OS 1.0 through 3.0.1, iPhone OS for iPod touch 1.1 through 3.0 Impact: A person with physical access to a device may be able to use it after the timeout period specified by an Exchange administrator Description: iPhone OS provides the ability to communicate via services provided by a Microsoft Exchange server. An administrator of an Exchange server has the ability to specify a "Maximum inactivity time lock" setting. This requires the user to reenter their passcode after the expiration of the inactivity time in order to use the Exchange services. iPhone OS allows a user to specify a "Require Passcode" setting that may extend up to 4 hours. The "Require Passcode" setting is not affected by the "Maximum inactivity time lock" setting. If the user has "Require Passcode" set to a value higher than the "Maximum inactivity time lock" setting, this would allow a window of time for a person with physical access to use the device, including Exchange services. This update addresses the issue by disabling user choices for "Require Passcode" values greater than the "Maximum inactivity time lock" setting. This issue only affects iPhone OS 2.0 and later, and iPhone OS for iPod touch 2.0 and later. Credit to Allan Steven, Robert Duran, Jeff Beckham of PepsiCo, Joshua Levitsky, Michael Breton of Intel Corporation, Mike Karban of Edward Jones, and Steve Moriarty of Agilent Technologies for reporting this issue. MobileMail CVE-ID: CVE-2009-2207 Available for: iPhone OS 1.0 through 3.0.1, iPhone OS for iPod touch 1.1 through 3.0 Impact: Deleted email messages may still be visible through a Spotlight search Description: Spotlight finds and allows access to deleted messages in Mail folders on the device. This would allow a person with access to the device to view the deleted messages. This update addresses the issue by not including the deleted email in the Spotlight search result. This issue only affects iPhone OS 3.0, iPhone OS 3.0.1, and iPhone OS for iPod touch 3.0. Credit to Clickwise Software and Tony Kavadias for reporting this issue. Recovery Mode CVE-ID: CVE-2009-2795 Available for: iPhone OS 1.0 through 3.0.1, iPhone OS for iPod touch 1.1 through 3.0 Impact: A person with physical access to a locked device may be able to access the user's data Description: A heap buffer overflow exists in Recovery Mode command parsing. This may allow another person with physical access to the device to bypass the passcode, and access the user's data. This update addresses the issue through improved bounds checking. Telephony CVE-ID: CVE-2009-2815 Available for: iPhone OS 1.0 through 3.0.1 Impact: Receiving a maliciously crafted SMS message may lead to an unexpected service interruption Description: A null pointer dereference issue exists in the handling of SMS arrival notifications. Receiving a maliciously crafted SMS message may lead to an unexpected service interruption. This update addresses the issue through improved handling of incoming SMS messages. Credit to Charlie Miller of Independent Security Evaluators, and Collin Mulliner of Technical University Berlin for reporting this issue. UIKit CVE-ID: CVE-2009-2796 Available for: iPhone OS 1.0 through 3.0.1, iPhone OS for iPod touch 1.1 through 3.0 Impact: Passwords may be made visible Description: When a character in a password is deleted, and the deletion is undone, the character is briefly made visible. This may allow a person with physical access to the device to read a password, one character at a time. This update addresses the issue by preventing the character from being made visible. This issue only affects iPhone OS 3.0 and iPhone OS 3.0.1. Credit to Abraham Vegh for reporting this issue. WebKit CVE-ID: CVE-2009-2797 Available for: iPhone OS 1.0 through 3.0.1, iPhone OS for iPod touch 1.1 through 3.0 Impact: User names and passwords in URLs may be disclosed to linked sites Description: Safari includes the user name and password from the original URL in the referer header. This may lead to the disclosure of sensitive information. This update addresses the issue by not including user names and passwords in referer headers. Credit to James A. T. Rice of Jump Networks Ltd for reporting this issue. WebKit CVE-ID: CVE-2009-1725 Available for: iPhone OS 1.0 through 3.0.1, iPhone OS for iPod touch 1.1 through 3.0 Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in WebKit's handling of numeric character references. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved handling of numeric character references. Credit to Chris Evans for reporting this issue. WebKit CVE-ID: CVE-2009-1724 Available for: iPhone OS 1.0 through 3.0.1, iPhone OS for iPod touch 1.1 through 3.0 Impact: Visiting a maliciously crafted website may lead to a cross- site scripting attack Description: An issue in WebKit's handling of the parent and top objects may result in a cross-site scripting attack when visiting a maliciously crafted website. This update addresses the issue through improved handling of parent and top objects. WebKit CVE-ID: CVE-2009-2199 Available for: iPhone OS 1.0 through 3.0.1, iPhone OS for iPod touch 1.1 through 3.0 Impact: Look-alike characters in a URL could be used to masquerade a website Description: The International Domain Name (IDN) support and Unicode fonts embedded in Safari could be used to create a URL which contains look-alike characters. These could be used in a malicious website to direct the user to a spoofed site that visually appears to be a legitimate domain. This update addresses the issue by supplementing WebKit's list of known look-alike characters. Look-alike characters are rendered in Punycode in the address bar. Credit to Chris Weber of Casaba Security, LLC for reporting this issue. Installation note: These updates are only available through iTunes, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes will automatically check Apple's update server on its weekly schedule. When an update is detected, it will download it. When the iPhone or iPod touch is docked, iTunes will present the user with the option to install the update. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iPhone or iPod touch. The automatic update process may take up to a week depending on the day that iTunes checks for updates. You may manually obtain the update via the Check for Updates button within iTunes. After doing this, the update can be applied when your iPhone or iPod touch is docked to your computer. To check that the iPhone or iPod touch has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "3.1 (7C144)" or later for iPhone, and "3.1.1 (7C145)" or later for iPod touch. Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJKp9MgAAoJEHkodeiKZIkBCl8IALy4IOBBuJq75CMrn5ACqGY1 QDsBeH648cg2+NVzcQSVQWAADg6THhwBZmDGi0JgWvjYDwvlPNh/4Ehu9plK4sn8 iJLizBNWBQc3n5Frtzk2YpjbfCcCpWSzi406EvIFP20YOnuNJfdbTNp0468P6Lrs nA8PRc2ARZx34kot9IL3mLQvaMzO1rBHnUCievKYaWJbJvZ6l2R9wyoTSbEsyWjr Xdfycv0iORzDVm7EKAzOcEpa+oWz7iRbu51nDQ0qa8C4hL0K/j3tDb+l4hx8uxJf e+1u73D288JUkGMq66yM6RT51D6U8sri09THhap/Pa/6gk5FZ5IVeYaRWznnYmc= =OmDz -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2009-09-03-1 Java for Mac OS X 10.5 Update 5
by Apple Product Security 03 Sep '09

03 Sep '09

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2009-09-03-1 Java for Mac OS X 10.5 Update 5 Java for Mac OS X 10.5 Update 5 is now available and addresses the following: Java CVE-ID: 2009-2475, 2009-2476, 2009-2670, 2009-2690, 2009-0217, 2009-2671, 2009-2672, 2009-2673, 2009-2674, 2009-2689, 2009-2675, 2009-2625 Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Multiple vulnerabilities in Java 1.6.0_13 Description: Multiple vulnerabilities exist in Java 1.6.0_13, the most serious of which may allow an untrusted Java applet to obtain elevated privileges. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues are addressed by updating to Java version 1.6.0_15. Further information is available via the Sun Java website at http://java.sun.com/javase/6/webnotes/ReleaseNotes.html Java CVE-ID: 2009-2722, 2009-2723, 2009-2475, 2009-2670, 2009-2690, 2009-2671, 2009-2672, 2009-2673, 2009-2689, 2009-2675, 2009-2625 Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Multiple vulnerabilities in Java 1.5.0_19 Description: Multiple vulnerabilities exist in Java 1.5.0_19, the most serious of which may allow an untrusted Java applet to obtain elevated privileges. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues are addressed by updating to Java version 1.5.0_20. Further information is available via the Sun Java website at http://java.sun.com/j2se/1.5.0/ReleaseNotes.html Java CVE-ID: 2009-2475, 2009-2689 Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Multiple vulnerabilities in Java 1.4.2_21 Description: Multiple vulnerabilities exist in Java 1.4.2_21, the most serious of which may allow an untrusted Java applet to obtain elevated privileges. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues are addressed by updating to Java version 1.4.2_22. Further information is available via the Sun Java website at http://java.sun.com/j2se/1.4.2/ReleaseNotes.html Java CVE-ID: CVE-2009-2205 Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8 Impact: Launching a maliciously crafted Java Web Start application may lead to an unexpected application termination or arbitrary code execution Description: A stack buffer overflow exists in Java Web Start command launcher. Launching a maliciously crafted Java Web Start application may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Credit to Chris Ries of Carnegie Mellon University Computing Services for reporting this issue. Java for Mac OS X 10.5 Update 5 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ The download file is named: JavaForMacOSX10.5Update5.dmg Its SHA-1 digest is: 20dd590192fb81a8f164b73727295ed2ac4f1693 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJKn/HOAAoJEHkodeiKZIkBXIQIAK7MoTqyqXjCNJv8GgYRP6xY yEMXIS7kUkk372gAuovnc+t8KfpXVRLO0gsvLzi5GeYLKthjywCNfon8uTNg+Ba0 I+s5PxmyHw9H/B9IzLdA2X+qDhdS5UdYniMIgC69KO2XanBXZK/z5k4YkOJSyGNn FWZ2iQf+sMhQvwHnFPof1kUdzKteqy8Jb1vFzpZiItFyxGJICco+kKqtNcJXHrqd eBZuCko/6VDMNluJHLHbT7gsJBv1j8tBlDqoio7rD0p5+9vWYTzh48DiMz8ON/x/ UJd4FE3LjQuxLDqP0UW8ufm6zx62XnTd1m3YkTwPIfh6Iag8HBbvXSN5xCaT24E= =WDaC -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0