Apple Security Update Fixes Multiple Mac OS X Vulnerabilities
Via FrSIRT. * Technical Description *
FrSIRT Advisory : FrSIRT/ADV-2005-1823
CVE Reference : CAN-2005-1992 - CAN-2005-2524 - CAN-2005-2741 - CAN-2005-2742 - CAN-2005-2743 - CAN-2005-2744 - CAN-2005-2745 - CAN-2005-2746 - CAN-2005-2747 - CAN-2005-2748
Rated as : Critical 
Remotely Exploitable : Yes
Locally Exploitable : Yes
Release Date : 2005-09-22
Apple has released security patches to correct ten vulnerabilities affecting Mac OS X. These flaws could be exploited by remote or local attackers to execute arbitrary commands, cause a denial of service, obtain elevated privileges, or disclose sensitive information.
The first issue is due to a buffer overflow error in ImageIO when processing specially crafted GIF images, which could be exploited by malicious websites to execute arbitrary commands (e.g. via WebCore or Safari).
The second flaw is due to an error in Mail.app when processing auto-reply rules, which could be exploited by attackers to intercept contents of encrypted messages.
The third vulnerability is due to an unspecified error in Mail.app when using SMTP authentication with Kerberos5, which could cause the application to append un-initialized memory to a message and disclose sensitive information.
The fourth issue is due to an error where files with diagnostic information are created insecurely when certain environmental variables are set to enable debugging of application memory allocation, which could be exploited by local attackers to obtain elevated privileges.
The fifth flaw is due to a buffer overflow error in QuickDraw Manager when processing specially crafted PICT images, which could be exploited by malicious websites to execute arbitrary commands (e.g. via Safari or Mail).
The sixth vulnerability is due to an error in QuickTime for Java that allows untrusted applets to call arbitrary functions from system libraries, which could cause untrusted applets to gain elevated privileges.
The seventh flaw resides in the Ruby xmlrpc/utils module, which could be exploited by attackers to bypass certain security protections and execute arbitrary commands. For additional information, see : FrSIRT/ADV-2005-0833
The eighth problem is due to an error in Safari that does not properly filter specially crafted web archives, which could be exploited to conduct cross site scripting attacks.
The ninth vulnerability is due to an error where the "Switch User..." button may appear even though the "Enable fast user switching" setting is disabled, which could be exploited by a user (with physical access to the system) to bypass the "Require password to wake this computer from sleep or screen saver" setting and gain access to the currently logged-in user's desktop without authentication.
The last flaw is due to an error where Authorization Services may allow unprivileged users to grant certain rights that should be restricted to administrators, which may lead to privilege escalation.
Mac OS X 10.3.9
Mac OS X Server 10.3.9
Mac OS X 10.4.2
Mac OS X Server 10.4.2
Security Update 2005-008 for Mac OS X 10.3.9 :
http://www.apple.com/support/downloads/securityupdate2005008macosx1039.html
Security Update 2005-008 for Mac OS X 10.4.2 :
http://www.apple.com/support/downloads/securityupdate2005008macosx1042.html
http://www.frsirt.com/english/advisories/2005/1823
http://docs.info.apple.com/article.html?artnum=302413
posted by Fergie @ 9/22/2005 06:07:00 PM
0 Comments:
Post a Comment
<< Home