April 2012 - Security-announce

APPLE-SA-2012-04-13-1 Flashback malware removal tool
by Apple Product Security 14 Apr '12

14 Apr '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2012-04-13-1 Flashback malware removal tool Flashback malware removal tool is now available and addresses the following: Malware removal Available for: OS X Lion v10.7 or later without Java installed Impact: A Flashback malware removal tool will be run Description: This update runs a malware removal tool that will remove the most common variants of the Flashback malware. If the Flashback malware is found, it presents a dialog notifying the user that malware was removed. There is no indication to the user if malware is not found. This update is available for OS X Lion systems that do not have Java installed. Flashback malware removal tool may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ The download file is named: FlashbackMalwareRemover.dmg Its SHA-1 digest is d4372b9bb14387a20567817ab7e03ea103fdffc2 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJPiNSvAAoJEGnF2JsdZQeezi4H/2c4gxvqdsuyfEMNIeQX3cGD F4iOK4cHvawM41AEnszOC/Bizmf+8xTI4US1FJ24Kzj4mQeAqQCAj3Oap0yDnW4U 9zXfC/L4EW8o9IdrxinKeewOJ0Ns62Qt3+Is1ex87sqNl+oJFmL8sh5CAeLQ58sT myt6AGQRJS65Gut9xOfHPPvQYt4GxDnxGkxTux8PkR7Wwg0ojlDjPHDCPc7kqrxz pP7xCI7LrLvISWXhnrkH9sUEm4QnwXz93o6wGEyFVVPHCoUtH+QFL3dSpppPJ9q5 K3wGK4iTPcv2sfzWknCUIF/L0huRIj7h60Eulay2d4ZvbxRcM8PZq2uSzkKzzJE= =JF7p -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2012-04-12-1 Java for OS X 2012-003 and Java for Mac OS X 10.6 Update 8
by Apple Product Security 12 Apr '12

12 Apr '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2012-04-12-1 Java for OS X 2012-003 and Java for Mac OS X 10.6 Update 8 Java for OS X 2012-003 and Java for Mac OS X 10.6 Update 8 is now available and addresses the following: Java Available for: OS X Lion v10.7.3, OS X Lion Server v10.7.3 Impact: The Java browser plugin and Java Web Start are deactivated if they remain unused for 35 days Description: As a security hardening measure, the Java browser plugin and Java Web Start are deactivated if they are unused for 35 days. Installing this update will automatically deactivate the Java browser plugin and Java Web Start. Users may re-enable Java if they encounter Java applets on a web page or Java Web Start applications. Further information is available at http://support.apple.com/kb/HT5242 Java Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.3, OS X Lion Server v10.7.3 Impact: A Flashback malware removal tool will be run Description: This update runs a malware removal tool that will remove the most common variants of the Flashback malware. If the Flashback malware is found, it presents a dialog notifying the user that malware was removed. There is no indication to the user if malware is not found. Note: These updates include the security content from Java for OS X 2012-002 and Java for Mac OS X 10.6 Update 7. Java for OS X 2012-003 and Java for Mac OS X 10.6 Update 8 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.6 systems The download file is named: JavaForMacOSX10.6.dmg Its SHA-1 digest is: e1da5dc40607eef88bff66a43ba5cdf6ac570225 For OS X Lion systems The download file is named: JavaForOSX.dmg Its SHA-1 digest is: 4e6fce49e9a3e07533398af8d8b0327136feead5 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.16 (Darwin) iQEcBAEBAgAGBQJPhwt0AAoJEGnF2JsdZQeeX0YIAJaHtT3P9U42kxSZmOmoPc7c 7lHPEJTZCUthZqVThC6IA26USosTUnU0gCuVACS6cVzA9qx8aHamwqRtZxCUe2Of qvioELGS2/YImnMB5cnfazg7PxWxkETWn0HCKMZMvxOGdDeJqGqideb1cf98h5ci HLAdkZilgxQMSMIfx7YZUEOT2Wo+LSQPM2vRe3aexqbDyShXrj6aieHNowZQMdaF rxVLHWxE4wP6+wsxVue7/yOK6L88L+r+PFtk2e91gVLFV6ZKZW8M9X9k5IoejkdN dik49/HCTrlPQURJ36TxeA9QZF1TTuuH3GepjhyUB5vPSBZF3rR8Sja7mD0jtx0= =UBlv -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0

APPLE-SA-2012-04-03-1 Java for OS X 2012-001 and Java for Mac OS X 10.6 Update 7
by Apple Product Security 03 Apr '12

03 Apr '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2012-04-03-1 Java for OS X 2012-001 and Java for Mac OS X 10.6 Update 7 Java for OS X 2012-001 and Java for Mac OS X 10.6 Update 7 is now available and addresses the following: Java Available for: Mac OS X v10.6.8, Mac OS X Server v10.6.8, OS X Lion v10.7.3, OS X Lion Server v10.7.3 Impact: Multiple vulnerabilities in Java 1.6.0_29 Description: Multiple vulnerabilities exist in Java 1.6.0_29, the most serious of which may allow an untrusted Java applet to execute arbitrary code outside the Java sandbox. Visiting a web page containing a maliciously crafted untrusted Java applet may lead to arbitrary code execution with the privileges of the current user. These issues are addressed by updating to Java version 1.6.0_31. Further information is available via the Java website at http://www.o racle.com/technetwork/java/javase/releasenotes-136954.html CVE-ID CVE-2011-3563 CVE-2011-5035 CVE-2012-0497 CVE-2012-0498 CVE-2012-0499 CVE-2012-0500 CVE-2012-0501 CVE-2012-0502 CVE-2012-0503 CVE-2012-0505 CVE-2012-0506 CVE-2012-0507 Java for OS X 2012-001 and Java for Mac OS X 10.6 Update 7 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ For Mac OS X v10.6 systems The download file is named: JavaForMacOSX10.6.dmg Its SHA-1 digest is: f76807153bc0ca253e4a466a2a8c0abf1e180667 For OS X Lion systems The download file is named: JavaForOSX.dmg Its SHA-1 digest is: 176ac1f8e79b4245301e84b616de5105ccd13e16 Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJPezVqAAoJEGnF2JsdZQee7gIIALa7b5hVTKL7kOXF7EYT6wjx VnAmxoQbjEwpBkdzPzqqhCQ303/iBdLdHr2O/yxdaX0tFuB+5+4iInPU2t6O+PNh 7iJ3rhQszzIj5q/qGDXyzIQEjurNfvrEKAxQ3T7uj1At+n/9YVBaw8p6i+HopbRc Fo6Jrxy0Qf/MyeGO4lqxht2Aq8omh+pEBNP68EglqrJp/CjZTYGaFAHVGvnm8/gA wjcpIRQBacXcBCJ3K8pZhuQvXhm+GVLWYgc2KGsZ/l7jbQX5Bi67b7CFf7lBHlyd V7ss6N/0T/O3nspdhg+jhnvcaia1Ow3GikC/707NNkM8Dm3lm0DFVMBBgpNvPcU= =Pf96 -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40l… This email sent to site_archiver(a)lists.apple.com

1 0