April 2011 - Security-announce

APPLE-SA-2011-04-18-1 iTunes 10.2.2
by Apple Product Security 18 Apr '11

18 Apr '11

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2011-04-18-1 iTunes 10.2.2 iTunes 10.2.2 is now available and addresses the following: WebKit Available for: Windows 7, Vista, XP SP2 or later Impact: A man-in-the-middle attack may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues exist in WebKit. A man-in-the-middle attack while browsing the iTunes Store via iTunes may lead to an unexpected application termination or arbitrary code execution. CVE-ID CVE-2011-1290 : Vincenzo Iozzo, Willem Pinckaers, Ralf-Philipp Weinmann, and an anonymous researcher working with TippingPoint's Zero Day Initiative CVE-2011-1344 : Vupen Security working with TippingPoint's Zero Day Initiative, and Martin Barbella iTunes 10.2.2 may be obtained from: http://www.apple.com/itunes/download/ For Mac OS X: The download file is named: "iTunes10.2.2.dmg" Its SHA-1 digest is: 7b94065174927dbce71182c89a00b3966021ceb8 For Windows XP / Vista / Windows 7: The download file is named: "iTunesSetup.exe" Its SHA-1 digest is: 30c97f21cb7ec9921b80c7dfd3a9f460b6746045 For 64-bit Windows XP / Vista / Windows 7: The download file is named: "iTunes64Setup.exe" Its SHA-1 digest is: 10d04b03e9733827e69a20bcf46f5e7ea97e0cd3 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJNrGo/AAoJEGnF2JsdZQeeKf0H/2PRqBD4DJdyLvpcTu6x8QD1 TY+SkHSJFK8H3G48fBL45QSM0eFg9FoqQ0DX0Y89X3HPYeWnRxPOQsCyeYV9BaS0 6dYL16OmW0f1kvals0NHGFvFLNd7AFVgxE7Ujr0xsSl8HwrUpwLpF8Qf4lDzbOWo CL9O6nnvR5BipT4fCnh8KWq4RvGbd/VaGqkGuYXE898SYEbcp8LJr1McYh2S3P1l EZzj2p2Z+CJTaka/fyfsl6NgG7g6wpqCcwnqHAxPqixIc5V9ZqSIM7ZI5GkdrZF0 qYY+9tSXdgJqA1oIPE/odOkdh7+qoEqmAJ2eaWRmUvaBBYS0rxKghO3ovU2LEDs= =Hy4U -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2011-04-14-4 Security Update 2011-002
by Apple Product Security 14 Apr '11

14 Apr '11

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2011-04-14-4 Security Update 2011-002 Security Update 2011-002 is now available and addresses the following: Certificate Trust Policy Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.7, Mac OS X Server v10.6.7 Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information Description: Several fraudulent SSL certificates were issued by a Comodo affiliate registration authority. This may allow a man-in-the- middle attacker to redirect connections and intercept user credentials or other sensitive information. This issue is addressed by blacklisting the fraudulent certificates. Note: For iOS, this issue is addressed with iOS 4.3.2 and iOS 4.2.7. For Windows systems, Safari relies on the certificate store of the host operating system to determine if an SSL server certificate is trustworthy. Applying the update described in Microsoft Knowledge Base Article 2524375 will cause Safari to regard these certificates as untrusted. The article is available at http://support.microsoft.com/kb/2524375 For Mac OS X v10.6.7 and Mac OS X Server v10.6.7 The download file is named: SecUpd2011-002Snow.dmg Its SHA-1 digest is: 175c1adf0af15d817c272354dd75300ca6416792 For Mac OS X v10.5.8 The download file is named: SecUpd2011-002.dmg Its SHA-1 digest is: d9ff801e7d7dd5ed76bfdd3adf8d2bf9c7336c44 For Mac OS X Server v10.5.8 The download file is named: SecUpdSrvr2011-002.dmg Its SHA-1 digest is: 7f7282006484a8c9ef8dd30d28759b72641f5c44 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJNpjYXAAoJEGnF2JsdZQeeCZAIAJL/+YRTDbncf9ZqikRKvqFx Y9wfmeUlvEkzf91FWoBVxU9m1gPQ79LLKSpmNl9z12fSHJvL+qXpMNfAqBxhRDgV XQXWSIoD74I2tYWpyoKZNylAis2X3wydxIQknpgfJyQF2skcVNHvDK7yMH3BR3lt iUlg2od5SiTl+tuXTJzzrL9MnCK00D8bdaQv4Q2OH/D12PYX4U0AWH8v9r6xCA9/ V1yfgX7Zu5XjqjKJnSDF4FmPW0shd4aosP2JZcFAow0ITqAu44C0UsqR0Yn6HszK w8NLGE9fLizRvNj4HRNiXdRbnZkpR2qXnu+5WOwQrg0TAAsHR7UHP28gDpXvloQ= =n4ty -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2011-04-14-3 Safari 5.0.5
by Apple Product Security 14 Apr '11

14 Apr '11

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2011-04-14-3 Safari 5.0.5 Safari 5.0.5 is now available and addresses the following: WebKit Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.5 or later, Mac OS X Server v10.6.5 or later, Windows 7, Vista, XP SP2 or later Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow issue existed in the handling of nodesets. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. CVE-ID CVE-2011-1290 : Vincenzo Iozzo, Willem Pinckaers, Ralf-Philipp Weinmann, and an anonymous researcher working with TippingPoint's Zero Day Initiative WebKit Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6.5 or later, Mac OS X Server v10.6.5 or later, Windows 7, Vista, XP SP2 or later Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A use after free issue existed in the handling of text nodes. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. CVE-ID CVE-2011-1344 : Vupen Security working with TippingPoint's Zero Day Initiative, and Martin Barbella Note: Certificate Trust Policy Several fraudulent SSL certificates were issued by a Comodo affiliate registration authority. This may allow a man-in-the-middle attacker to redirect connections and intercept user credentials or other sensitive information. Safari relies on the certificate store of the host operating system to determine if an SSL server certificate is trustworthy. For Mac OS X systems, this issue is addressed with Security Update 2011-002. For iOS, this issue is addressed with iOS 4.3.2 and iOS 4.2.7. For Windows systems, applying the update described in Microsoft Knowledge Base Article 2524375 will cause Safari to regard these certificates as untrusted. The article is available at http://support.microsoft.com/kb/2524375 Safari 5.0.5 is available via the Apple Software Update application, or Apple's Safari download site at: http://www.apple.com/safari/download/ Safari for Mac OS X v10.6.5 and later The download file is named: Safari5.0.5SnowLeopard.dmg Its SHA-1 digest is: 631cd280171938491c45a905e24904e7739eaefe Safari for Mac OS X v10.5.8 The download file is named: Safari5.0.5Leopard.dmg Its SHA-1 digest is: 661cdb68ca33b8eb41f20be837eb6a1c12289876 Safari for Windows 7, Vista or XP The download file is named: SafariSetup.exe Its SHA-1 digest is: c2c6b1f5c04af7f24d2474e4b2597d40dddaeca2 Safari for Windows 7, Vista or XP from the Microsoft Choice Screen The download file is named: Safari_Setup.exe Its SHA-1 digest is: e245b935fc0aaec31a512fa0ab9dce2dcec0b2f8 Safari+QuickTime for Windows 7, Vista or XP The file is named: SafariQuickTimeSetup.exe Its SHA-1 digest is: 5f1455cd2290e9ced03dfbb6ea57b4c2931446a5 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJNphlUAAoJEGnF2JsdZQee1GkH/iuQ6LP4y5nBIDA9aEdIxf0W Ck8983LqH5dQJOWa3kdvA2//DRdW0mhaZrOWkECa2NvWiz+FoDkbAm531shpuKvc 8AgVBjDs/bZzJRmOmmbbGaJBzFLc7lzrf5RxKoKzvfgPsNqT/wBqssv74C2b2vjf LqJuZg0zZ6tvGCzg+J9q/h8w1nUk8Gc52TLaL0Nw+Y+Uu7eEgk2Gt1iiEKh4v6Nv hEEcPrepF8zYljS/UPX8LKG7TREHazyXB7iIxo14tx02ZZQzvOcp6TuVkr28CxF+ n3VyD/FFyOgwvtQiep7i551PFbGlboOgZ2jFyv0Ad7tgT5BJJQqOrF5pPM/zn9A= =4V8l -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2011-04-14-2 iOS 4.2.7 Software Update for iPhone
by Apple Product Security 14 Apr '11

14 Apr '11

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2011-04-14-2 iOS 4.2.7 Software Update for iPhone iOS 4.2.7 Software Update for iPhone is now available and addresses the following: Certificate Trust Policy Available for: iOS 4.2.5 through 4.2.6 for iPhone 4 (CDMA) Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information Description: Several fraudulent SSL certificates were issued by a Comodo affiliate registration authority. This may allow a man-in-the- middle attacker to redirect connections and intercept user credentials or other sensitive information. This issue is addressed by blacklisting the fraudulent certificates. Note: For Mac OS X systems, this issue is addressed with Security Update 2011-002. For Windows systems, Safari relies on the certificate store of the host operating system to determine if an SSL server certificate is trustworthy. Applying the update described in Microsoft Knowledge Base Article 2524375 will cause Safari to regard these certificates as untrusted. The article is available at http://support.microsoft.com/kb/2524375 QuickLook Available for: iOS 4.2.5 through 4.2.6 for iPhone 4 (CDMA) Impact: Viewing a maliciously crafted Microsoft Office file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issues existed in QuickLook's handling of Microsoft Office files. Viewing a maliciously crafted Microsoft Office file may lead to an unexpected application termination or arbitrary code execution. CVE-ID CVE-2011-1417 : Charlie Miller and Dion Blazakis working with TippingPoint's Zero Day Initiative WebKit Available for: iOS 4.2.5 through 4.2.6 for iPhone 4 (CDMA) Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow issue existed in the handling of nodesets. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. CVE-ID CVE-2011-1290 : Vincenzo Iozzo, Willem Pinckaers, Ralf-Philipp Weinmann, and an anonymous researcher working with TippingPoint's Zero Day Initiative WebKit Available for: iOS 4.2.5 through 4.2.6 for iPhone 4 (CDMA) Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A use after free issue existed in the handling of text nodes. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. CVE-ID CVE-2011-1344 : Vupen Security working with TippingPoint's Zero Day Initiative, and Martin Barbella Installation note: These updates are only available through iTunes, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes will automatically check Apple's update server on its weekly schedule. When an update is detected, it will download it. When the iPhone is docked, iTunes will present the user with the option to install the update. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iPhone. The automatic update process may take up to a week depending on the day that iTunes checks for updates. You may manually obtain the update via the Check for Updates button within iTunes. After doing this, the update can be applied when your iPhone is docked to your computer. To check that the iPhone has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "4.2.7 (8E303)" or later. Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJNpz4lAAoJEGnF2JsdZQeeMzwIAL/MAl/Pjtqh7qQniU8ePb5v +ep2We4zQ9iz8CQItw64K9+AudhVRmKYRtDoeEmZLIdu+yE0h7bo48gz5TDbEQmj 34vOSbOCCW5s58fBa2TOrdtaAIYxfO1OjLsXNQCWN48rQnXalRgX6RGbaONWEuro jo3mothKdSv4GFppgwPwEO62iAUQtrJ9+lsI8AmxdLHtkI1Yt6VapjziKPusHSJL 8o3YT0VA/3leu64AyI/oSzYbMhFdOC72IEP7eb9On+76kTufTrGpvDmwy2uyz9OK XhzzXSA7B7oITUt2F9IeWCWuSPMy6E9o5l88OPGsqN5X0tcz907xpucfWY+L9Oo= =M5HE -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2011-04-14-1 iOS 4.3.2 Software Update
by Apple Product Security 14 Apr '11

14 Apr '11

site_archiver(a)lists.apple.com Delivered-To: security-announce(a)lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2011-04-14-1 iOS 4.3.2 Software Update iOS 4.3.2 Software Update is now available and addresses the following: Certificate Trust Policy Available for: iOS 3.0 through 4.3.1 for iPhone 3GS and later, iOS 3.1 through 4.3.1 for iPod touch (3rd generation) and later, iOS 3.2 through 4.3.1 for iPad Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information Description: Several fraudulent SSL certificates were issued by a Comodo affiliate registration authority. This may allow a man-in-the- middle attacker to redirect connections and intercept user credentials or other sensitive information. This issue is addressed by blacklisting the fraudulent certificates. Note: For Mac OS X systems, this issue is addressed with Security Update 2011-002. For Windows systems, Safari relies on the certificate store of the host operating system to determine if an SSL server certificate is trustworthy. Applying the update described in Microsoft Knowledge Base Article 2524375 will cause Safari to regard these certificates as untrusted. The article is available at http://support.microsoft.com/kb/2524375 libxslt Available for: iOS 3.0 through 4.3.1 for iPhone 3GS and later, iOS 3.1 through 4.3.1 for iPod touch (3rd generation) and later, iOS 3.2 through 4.3.1 for iPad Impact: Visiting a maliciously crafted website may lead to the disclosure of addresses on the heap Description: libxslt's implementation of the generate-id() XPath function disclosed the address of a heap buffer. Visiting a maliciously crafted website may lead to the disclosure of addresses on the heap, which may aid in bypassing address space layout randomization protection. This issue is addressed by generating an ID based on the difference between the addresses of two heap buffers. CVE-ID CVE-2011-0195 : Chris Evans of Google Chrome Security Team QuickLook Available for: iOS 3.0 through 4.3.1 for iPhone 3GS and later, iOS 3.1 through 4.3.1 for iPod touch (3rd generation) and later, iOS 3.2 through 4.3.1 for iPad Impact: Viewing a maliciously crafted Microsoft Office file may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in QuickLook's handling of Microsoft Office files. Viewing a maliciously crafted Microsoft Office file may lead to an unexpected application termination or arbitrary code execution. CVE-ID CVE-2011-1417 : Charlie Miller and Dion Blazakis working with TippingPoint's Zero Day Initiative WebKit Available for: iOS 3.0 through 4.3.1 for iPhone 3GS and later, iOS 3.1 through 4.3.1 for iPod touch (3rd generation) and later, iOS 3.2 through 4.3.1 for iPad Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow issue existed in the handling of nodesets. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. CVE-ID CVE-2011-1290 : Vincenzo Iozzo, Willem Pinckaers, Ralf-Philipp Weinmann, and an anonymous researcher working with TippingPoint's Zero Day Initiative WebKit Available for: iOS 3.0 through 4.3.1 for iPhone 3GS and later, iOS 3.1 through 4.3.1 for iPod touch (3rd generation) and later, iOS 3.2 through 4.3.1 for iPad Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A use after free issue existed in the handling of text nodes. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. CVE-ID CVE-2011-1344 : Vupen Security working with TippingPoint's Zero Day Initiative, and Martin Barbella Installation note: These updates are only available through iTunes, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes will automatically check Apple's update server on its weekly schedule. When an update is detected, it will download it. When the iPhone, iPod touch or iPad is docked, iTunes will present the user with the option to install the update. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iPhone, iPod touch, or iPad. The automatic update process may take up to a week depending on the day that iTunes checks for updates. You may manually obtain the update via the Check for Updates button within iTunes. After doing this, the update can be applied when your iPhone, iPod touch, or iPad is docked to your computer. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "4.3.2 (8H8)" or later for iPad 2 for Verizon, and "4.3.2 (8H7)" or later for everything else. Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJNphkoAAoJEGnF2JsdZQeeNUUH/R/gm+Yj9JeB63lwtcnOBLD4 PMkNjIOItDLb/cjPaof6kiSDTgHxA3ZYyrxFLQ7Z1bYLqOhk8OLGAPspzXW1koE3 Hr8vG1NUVJS8NsQH5jdcADl4YBtHkh94Xyq+151I8N8cwHMmJAZcO04aQ1/EjZqf X9NgaasaYL2gpt0wNuzupPEkxnyim8cBs/9JEmT3cehSGBl3bcusVLbZYKit3woZ oYz3XHAwvd0+FN6jvlnWwmZp1PVi8AO8KoWnymRzS7LqFJfRfrnRlZxYCiI/76S8 Hfku1fZ9uJqOZ4wiENil6PjPSEiwpXIX6oCNf8lUuWugvlo0rXB0wVunAJWsOqE= =FB1s -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40li… This email sent to site_archiver(a)lists.apple.com

1 0