site_archiver@lists.apple.com Delivered-To: security-announce@lists.apple.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 This is a re-posting to correct the SHA-1 digest of the SecUpd2008-006PPC.dmg package. No other changes are made. APPLE-SA-2008-09-15 Mac OS X v10.5.5 and Security Update 2008-006 Mac OS X v10.5.5 and Security Update 2008-006 are now available and address the following issues: ATS CVE-ID: CVE-2008-2305 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: Viewing a document containing a maliciously crafted font may lead to arbitrary code execution Description: A heap buffer overflow exists in Apple Type Services' handling of PostScript font names. Viewing a document containing a maliciously crafted font may lead to arbitrary code execution. This update addresses the issue by performing additional validation of font names. Credit to Chris Ries of Carnegie Mellon University Computing Services for reporting this issue. BIND Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: BIND is updated to address performance issues Description: BIND is updated to version 9.4.2-P2 to address performance issues. For Mac OS X v10.4.11 systems, BIND is updated to version 9.3.5-P2. For Mac OS X v10.5.4 systems, BIND is updated to version 9.4.2-P2. Further information is available via the ISC web site at http://www.isc.org/index.pl?/sw/bind/ ClamAV CVE-ID: CVE-2008-1100, CVE-2008-1387, CVE-2008-0314, CVE-2008-1833, CVE-2008-1835, CVE-2008-1836, CVE-2008-1837, CVE-2008-2713, CVE-2008-3215 Available for: Mac OS X Server v10.4.11, Mac OS X Server v10.5 through v10.5.4 Impact: Multiple vulnerabilities in ClamAV 0.92.1 Description: Multiple vulnerabilities exist in ClamAV 0.92.1, the most serious of which may lead to arbitrary code execution. This update addresses the issues by updating to ClamAV 0.93.3. Further information is available via the ClamAV website at http://www.clamav.net/ Directory Services CVE-ID: CVE-2008-2329 Available for: Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: A person with access to the login screen may be able to list user names Description: An information disclosure issue exists in Login Window when it is configured to authenticate users with Active Directory. By supplying wildcard characters in the user name field, a list of user names from Active Directory may be displayed. This update addresses the issue through improved processing of user names in Directory Services. Credit to IT Department of the West Seneca Central School District for reporting this issue. Directory Services CVE-ID: CVE-2008-2330 Available for: Mac OS X Server v10.4.11, Mac OS X Server v10.5 through v10.5.4 Impact: A local user may obtain the server password if an OpenLDAP system administrator runs slapconfig Description: An insecure file operation issue exists in the slapconfig tool used for configuring OpenLDAP. A local user can cause the password entered by a system administrator running slapconfig to be written to a file controlled by the user. This update addresses the issue by checking the return value of the mkfifo function. Finder CVE-ID: CVE-2008-2331 Available for: Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: The Get Info window may not display the actual privileges for a file Description: Finder does not update the displayed permissions under some circumstances in a Get Info window. After clicking the lock button, changes to the filesystem Sharing & Permissions will take effect, but will not be displayed. This update addresses the issue by properly updating the displayed permissions when access privileges on a file are changed. This issue does not affect systems prior to Mac OS X v10.5. Credit to Michel Colman for reporting this issue. Finder CVE-ID: CVE-2008-3613 Available for: Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: An attacker with access to the local network may cause a denial of service Description: A null pointer dereference issue exists in the Finder when it searches for a remote disc. An attacker with access to the local network can cause Finder to exit immediately after it starts, making the system unusable. This update addresses the issue by adding a check for a null pointer. This issue only affects these configurations: any product running Mac OS X v10.5.2, MacBook Air running Mac OS X v10.5.3, and MacBook Air running Mac OS X v10.5.4. Credit to Yuxuan Wang of Sogou for reporting this issue. ImageIO CVE-ID: CVE-2008-2327 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution Description: Multiple uninitialized memory access issues exist in libTIFF's handling of LZW-encoded TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through proper memory initialization and additional validation of TIFF images. ImageIO CVE-ID: CVE-2008-2332 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exits in ImageIO's handling of TIFF images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved processing of TIFF images. Credit to Robert Swiecki of Google Security Team for reporting this issue. ImageIO CVE-ID: CVE-2008-3608 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: Viewing a large maliciously crafted JPEG image may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in ImageIO's handling of embedded ICC profiles in JPEG images. Viewing a large maliciously crafted JPEG image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved processing of JPEG images. ImageIO CVE-ID: CVE-2008-1382 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: libpng in ImageIO is updated to version 1.2.29 Description: libpng in ImageIO is updated to version 1.2.29. CVE-2008-1382 is not known to affect the use of libpng in ImageIO, and this update is applied as a precautionary measure. Kernel CVE-ID: CVE-2008-3609 Available for: Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: Files may be accessed by a local user who does not have the proper permissions Description: Cached credentials are not always flushed when a vnode is recycled. This may allow a local user to read or write to a file where the permissions would not allow it. This update addresses the issue through improved handling of purged vnodes. Credit to Nevin ":-)" Liber, Thomas Pelaia of Oak Ridge National Lab, Thomas Tempelmann, and Ram Kolli for reporting this issue. libresolv CVE-ID: CVE-2008-1447 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: libresolv is susceptible to DNS cache poisoning and may return forged information Description: libresolv provides translation between host names and IP addresses for applications that use its unicast DNS resolution API. A weakness in the DNS protocol may allow remote attackers to perform DNS cache poisoning attacks. As a result, applications that rely on libresolv for DNS may receive forged information. This update addresses the issue by implementing source port randomization to improve resilience against cache poisoning attacks. Note that the BIND tools, dig, host, and nslookup use their own resolver library and are not addressed by this update. Credit to Dan Kaminsky of IOActive for reporting this issue. Login Window CVE-ID: CVE-2008-3610 Available for: Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: A user may log in without providing a password Description: A race condition exists in Login Window. To trigger this issue, the system must have the Guest account enabled or another account with no password. In a small proportion of attempts, an attempt to log in to such an account will not complete. The user list would then be presented again, and the person would be able to log in as any user without providing a password. If the original account were the Guest account, the contents of the new account will be deleted on logout. This update addresses the issue by properly clearing Login Window state when the login does not complete. This issue does not affect systems prior to Mac OS X v10.5. Login Window CVE-ID: CVE-2008-3611 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: A person with access to the login screen may be able to change a user's password Description: When a system has been configured to enforce policies on login passwords, users may be required to change their password in the login screen. If a password change fails, an error message is displayed, but the current password is not cleared. This may not be obvious to the user. If the user leaves the system unattended with this error message displayed, a person with access to the login screen may be able to reset that user's password. This update addresses the issue by clearing the current password when returning to the login screen. This issue does not affect systems running Mac OS X v10.5 or later. Credit to Christopher A. Grande of Middlesex Community College for reporting this issue. mDNSResponder CVE-ID: CVE-2008-1447 Available for: Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: mDNSResponder is susceptible to DNS cache poisoning and may return forged information Description: mDNSResponder provides translation between host names and IP addresses for applications that use its unicast DNS resolution API. A weakness in the DNS protocol may allow a remote attacker to perform DNS cache poisoning attacks. As a result, applications that rely on mDNSResponder for DNS may receive forged information. This update addresses the issue by implementing source port and transaction ID randomization to improve resilience against cache poisoning attacks. Credit to Dan Kaminsky of IOActive for reporting this issue. OpenSSH CVE-ID: CVE-2008-1483, CVE-2008-1657 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: Multiple vulnerabilities in OpenSSH, the most serious of which is local X11 session control Description: Multiple vulnerabilities exist in OpenSSH versions provided with Mac OS X v10.4.11 and Mac OS X v10.5.4, the most serious of which allows a local user to control another user's X11 session. This update addresses the issues by updating to OpenSSH 5.1p1. Further information is available via the OpenSSH web site at http://www.openssh.com/security.html QuickDraw Manager CVE-ID: CVE-2008-3614 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: Opening a maliciously crafted PICT image may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow exists in QuickDraw's handling of PICT images. Opening a maliciously crafted PICT image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of PICT images. Credit to an anonymous researcher working with the iDefense VCP for reporting this issue. Ruby CVE-ID: CVE-2008-2376 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: Running a Ruby script that uses untrusted input as the arguments to the Array#fill method may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow exists in rb_ary_fill(), which implements the Ruby Array#fill method. Running a Ruby script that uses untrusted input as the arguments to the Array#fill method may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of the arguments to rb_ary_fill(). SearchKit CVE-ID: CVE-2008-3616 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: Applications passing untrusted input to the SearchKit API may lead to an unexpected application termination or arbitrary code execution Description: Integer overflow issues exist in functions within the SearchKit framework. Passing untrusted input to SearchKit via an application may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. System Configuration CVE-ID: CVE-2008-2312 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11 Impact: A local user may obtain the PPP password Description: Network Preferences stores PPP passwords unencrypted in a world readable file, accessible to any local user. This update addresses the issue by storing PPP passwords in the system keychain when the password is changed. This issue does not affect systems running Mac OS X v10.5 or later. Credit to Hernan Ochoa of Core Security Technologies, Tore Halset of pvv.org, and Matt Johnston of the University Computer Club for reporting this issue. System Preferences CVE-ID: CVE-2008-3617 Available for: Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: Users may be misled into believing their passwords are stronger than they are Description: Remote Management and Screen Sharing can be configured to require a password for VNC viewers. The maximum length for VNC viewer passwords is eight characters. The password field can display more than eight characters, implying that the additional characters are used in the password. This update addresses the issue by limiting VNC viewer passwords to eight characters in the user interface. Credit to Michal Fresel of hi competence e.U. for reporting this issue. System Preferences CVE-ID: CVE-2008-3618 Available for: Mac OS X v10.5 through v10.5.4 Impact: Authenticated users may have unexpected remote access to files and directories Description: The File Sharing pane in the Sharing preference pane does not fully convey the actual access privileges. A user may infer that only the folders listed under 'Shared Folders' are accessible. However, authenticated users may also access their home directories, and administrators may access all disks on the system. This update provides additional text to help explain the actual access permissions. Systems prior to Mac OS X v10.5 did not display a list of shared folders in the File Sharing pane. This issue does not affect Mac OS X Server systems. Time Machine CVE-ID: CVE-2008-3619 Available for: Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: Backing up a system with Time Machine may lead to the disclosure of sensitive information Description: During the Time Machine Backup, several log files are saved to the backup drive with read permission allowed to other users. This may lead to the disclosure of sensitive information. This update addresses the issue by applying more restrictive permissions to saved log files. This issue does not affect systems prior to Mac OS X v10.5. Credit to Edwin McKenzie for reporting this issue. VideoConference CVE-ID: CVE-2008-3621 Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: Videoconferencing with a malicious user may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue exists in the VideoConference framework's handling of H.264 encoded media. Videoconferencing with a malicious user may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking. Wiki Server CVE-ID: CVE-2008-3622 Available for: Mac OS X v10.5 through v10.5.4, Mac OS X Server v10.5 through v10.5.4 Impact: A remote attacker may cause persistent JavaScript injection on a Wiki server Description: The Wiki Server mailing list archive will execute JavaScript code embedded in messages. A remote person may send an email containing JavaScript code to a mailing list hosted on a Wiki server. Viewing the message from the Wiki Server mailing list archive will trigger the execution of the embedded JavaScript code on the system of the person viewing the message. This update addresses the issue by performing additional validation of emails. This issue does not affect systems prior to Mac OS X v10.5. Credit to Leon von Tippelskirch, and Matthias Wieczorek of the Chair for Applied Software Engineering, TU Munich for reporting this issue. Mac OS X v10.5.5 and Security Update 2008-006 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/ The Software Update utility will present the update that applies to your system configuration. Only one is needed, either Mac OS X v10.5.5 or Security Update 2008-006. For Mac OS X v10.5.4 The download file is named: "MacOSXUpd10.5.5.dmg" Its SHA-1 digest is: bd9bf9304a5b3162f391233fe74fc64f6dbc2bf5 For Mac OS X v10.5 - v10.5.3 The download file is named: "MacOSXUpdCombo10.5.5.dmg" Its SHA-1 digest is: 91ac9b720ba3b4166e5dc1dd518b1651d77c0f46 For Mac OS X Server v10.5.4 The download file is named: "MacOSXServerUpd10.5.5.dmg" Its SHA-1 digest is: 00264fd6990b568b5017f1244820d1eeebda8ab2 For Mac OS X Server v10.5 - v10.5.3 The download file is named: "MacOSXServerUpdCombo10.5.5.dmg" Its SHA-1 digest is: cc463a4f2b2d2079fca56704057f407f86b96661 For Mac OS X v10.4.11 (Intel) The download file is named: "SecUpd2008-006Intel.dmg" Its SHA-1 digest is: c64a7aa8b13377b2066110fa86b4f879e0ca746b For Mac OS X v10.4.11 (PowerPC) The download file is named: "SecUpd2008-006PPC.dmg" Its SHA-1 digest is: 7b3aed47dbad3d55d90d093a6fb7a81c34c22a2c For Mac OS X Server v10.4.11 (Universal) The download file is named: "SecUpdSrvr2008-006Univ.dmg" Its SHA-1 digest is: 0309967cb7e6ae990bd3726e8af4abfeca776b63 For Mac OS X Server v10.4.11 (PowerPC) The download file is named: "SecUpdSrvr2008-006PPC.dmg" Its SHA-1 digest is: 61898bf315d04958aaf487bb92ba257d059a33ce Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: PGP Desktop 9.0.3 (Build 2932) iQEVAwUBSNUpS3kodeiKZIkBAQggJgf/azF8k3vtq0mKswE4GWy9nlQBpeehicr1 yrVvV9RWJBghftpUTnokCbJbAX1jeCL4Ow0BhK1fofdDcL0AOMKAbvIgkZ3bTfr6 wYhQfA0mvv/oRrDl36ltGJCBP+nu20H0gVzjlO54qMFpl8i8oJeTAXMJ2YaK2B28 b+J5tVCc9/ZciJI3rrlZxyscgr4skYOgXeyV1vNLh5Y1kC4QIbpRknSdPtREYQGa lu812XmK63m989Uujhwx3OwfYOcEUnIWpwULZdcv0JT/mZOk91ypUXgLwrfFANp/ qIaZ/MAaf8XgPVbooKWnknQeAsDl/sPglSfzfscrhVBeSUaE1kxw7g== =glen -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/security-announce/site_archiver%40lis... This email sent to site_archiver@lists.apple.com