---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: Apple Mac OS X Security Update Fixes Multiple Vulnerabilities SECUNIA ADVISORY ID: SA37313 VERIFY ADVISORY: http://secunia.com/advisories/37313/ DESCRIPTION: Apple has issued a security update for Mac OS X, which fixes multiple vulnerabilities. 1) A boundary error in the AFP Client component can be exploited to corrupt memory and potentially execute arbitrary code when a user accesses a specially crafted AFP server. 2) A weakness in the Adaptive Firewall component can lead to brute force or dictionary attacks not being detected. 3) Some vulnerabilities in Apache can be exploited by malicious, local users to bypass certain security restrictions, and by malicious users and malicious people to disclose potentially sensitive information or cause a DoS (Denial of Service). For more information: SA34827 SA35261 SA35691 SA35781 SA35797 4) A weakness in Apache can be exploited to conduct cross-site scripting attacks via the HTTP TRACE method. 5) Some vulnerabilities in Apache Portable Runtime can be exploited by malicious users and malicious people to disclose potentially sensitive information, cause a DoS (Denial of Service), or compromise an application using the library. For more information: SA36138 6) Multiple boundary errors exist in Apple Type Services when handling embedded fonts. These can be exploited to cause buffer overflows and execute arbitrary code when a document containing a specially crafted embedded font is being viewed or downloaded. 7) A weakness in the Certificate Assistant component can mislead a user into accepting a specially crafted certificate, containing NUL characters in the Common Name field, as it visually appears to match the domain visited by the user. 8) Multiple integer overflow errors exist in the CoreGraphics component, which can be exploited to cause heap-based buffer overflows and execute arbitrary code when a specially crafted PDF file is opened. 9) Multiple errors in CoreMedia and QuickTime can be exploited by malicious people to compromise a vulnerable system. For more information: SA36627 10) A vulnerability in CUPS can be exploited by malicious people to conduct cross-site scripting attacks. For more information: SA37308 11) An unspecified design error in the Dictionary component can be exploited to write arbitrary data to arbitrary locations on the user's filesystem. Successful exploitation allows execution of arbitrary code, but requires access to the local network. 12) An error in the DirectoryService component can be exploited to corrupt memory and execute arbitrary code on systems that are configured as DirectoryService servers. 13) An error in the Disk Images component can be exploited to cause a heap-based buffer overflow and execute arbitrary code when a specially crafted image containing a FAT filesystem is downloaded. 14) Multiple vulnerabilities in Dovecot can be exploited by malicious users to potentially compromise a vulnerable system. For more information: SA36698 15) An input validation error exists in the Event Monitor component. This can be exploited to inject certain data to log files by passing specially crafted authentication information to the SSH server. NOTE: This can potentially lead to a DoS (Denial of Service) in services that process the affected log files. 16) A vulnerability in fetchmail can be exploited by malicious people to conduct spoofing attacks. For more information: SA36179 17) A boundary error in the "file" utility can be exploited to cause buffer overflows and execute arbitrary code when a user uses "file" on a specially crafted Common Document Format (CDF) file. 18) An error in the FTP Server component can be exploited to cause a buffer overflow and execute arbitrary code via the CWD command. 19) The Help Viewer component does not use HTTPS for viewing remote Apple Help content, which can be exploited to spoof HTTP responses containing malicious help:runscript links. Successful exploitation allows execution of arbitrary code. 20) A boundary error in the ImageIO component when handling TIFF images can be exploited to cause a buffer underflow and potentially execute arbitrary code. This is related to: SA35515 21) An unspecified error within the UCCompareTextDefault API in International Components for Unicode can be exploited to cause a buffer overflow and potentially execute arbitrary code. 22) A weakness in IOKit can be exploited by non-privileged users to update the firmware in an attached USB or Bluetooth Apple keyboard. 23) Multiple vulnerabilities in the IPSec component can be exploited by malicious people to cause a DoS (Denial of Service). For more information: SA31478 24) Multiple input validation errors exist in the Kernel when handling task state segments. These can be exploited to disclose sensitive information, cause a DoS, or gain escalated privileges. 25) An error in the Launch Services component when opening a quarantined folder can lead to a missing warning dialog. 26) Some vulnerabilities in libxml can be exploited by malicious people to cause a DoS (Denial of Service). For more information: SA36207 27) A race condition in the Login Window component can be exploited to log in to any account without providing a password. Successful exploitation requires that an account without a password (such as the Guest account) exists on the system. 28) An error in the handling of SSL certificates in OpenLDAP can be exploited to conduct MitM (Man-in-the-Middle) attacks via certificates containing NUL characters in the Common Name field. 29) Multiple vulnerabilities in OpenLDAP can be exploited by malicious users to cause a DoS (Denial of Service). For more information: SA27424 30) Multiple vulnerabilities in OpenSSH can be exploited by malicious people to disclose sensitive information. For more information: SA32760 31) Multiple vulnerabilities with an unspecified impact exist in PHP. For more information: SA36791 32) An unspecified error in the handling of PICT images can be exploited to cause a heap-based buffer overflow and execute arbitrary code. 33) An integer overflow error in QuickLook when handling Microsoft Office files can be exploited to cause a buffer overflow and execute arbitrary code. 34) A vulnerability in FreeRADIUS can be exploited by malicious people to cause a DoS. For more information: SA36676 35) Multiple unspecified errors in the Screen Sharing client can be exploited to cause a memory corruption and execute arbitrary code when a specially crafted VNC server is being accessed, e.g. by opening a "vnc://" URL. 36) An insecure file operation in the Spotlight component can be exploited to overwrite files with privileges of another user. 37) Multiple vulnerabilities in Subversion can be exploited by malicious users and malicious people to compromise a vulnerable system. For more information: SA36184 SOLUTION: Update to Mac OS X 10.6.2 or apply Security Update 2009-006. Mac OS X Server v10.6.2 Update: http://support.apple.com/downloads/DL960/en_US/MacOSXServerUpd10.6.2.dmg Mac OS X v10.6.2 Update (Combo): http://support.apple.com/downloads/DL959/en_US/MacOSXUpdCombo10.6.2.dmg Mac OS X Server v10.6.2 Update (Combo): http://support.apple.com/downloads/DL961/en_US/MacOSXServerUpdCombo10.6.2.dmg Security Update 2009-006 Server: http://support.apple.com/downloads/DL962/en_US/SecUpdSrvr2009-006.dmg Security Update 2009-006 Client: http://support.apple.com/downloads/DL963/en_US/SecUpd2009-006.dmg Mac OS X v10.6.2 Update: http://support.apple.com/downloads/DL958/en_US/MacOSXUpd10.6.2.dmg PROVIDED AND/OR DISCOVERED BY: 9) The vendor credits: * Tom Ferris of the Adobe Secure Software Engineering Team. * An anonymous researcher working with the ZDI. * Alex Selivanov * Damian Put working with the ZDI. 21) The vendor credits Nikita Zhuk and Petteri Kamppuri of MK&C. 22) The vendor credits K. Chen of Georgia Institute of Technology. 25) The vendor credits Regis Duchesne of VMware, Inc. 26) The vendor credits Rauli Kaksonen and Jukka Taimisto from the CROSS project at Codenomicon Ltd. 32) The vendor credits Nicolas Joly of VUPEN Vulnerability Research Team. ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3937 OTHER REFERENCES: SA27424: http://secunia.com/advisories/27424/ SA28926: http://secunia.com/advisories/28926/ SA31478: http://secunia.com/advisories/31478/ SA32760: http://secunia.com/advisories/32760/ SA34827: http://secunia.com/advisories/34827/ SA35261: http://secunia.com/advisories/35261/ SA35284: http://secunia.com/advisories/35284/ SA35515: http://secunia.com/advisories/35515/ SA35691: http://secunia.com/advisories/35691/ SA35781: http://secunia.com/advisories/35781/ SA35797: http://secunia.com/advisories/35797/ SA36138: http://secunia.com/advisories/36138/ SA36179: http://secunia.com/advisories/36179/ SA36184: http://secunia.com/advisories/36184/ SA36207: http://secunia.com/advisories/36207/ SA36627: http://secunia.com/advisories/36627/ SA36676: http://secunia.com/advisories/36676/ SA36698: http://secunia.com/advisories/36698/ SA36791: http://secunia.com/advisories/36791/ SA37308: http://secunia.com/advisories/37308/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------