[XCSSA] Fwd: US-CERT Technical Cyber Security Alert TA05-229A --
Apple Mac Products are Affected by Multiple Vulnerabilities
xcssa@xcssa.org
xcssa@xcssa.org
Mon, 22 Aug 2005 18:04:33 -0500
The built-in OS X "Software Update."
When an update is available from Apple, a dialog box appears asking if
you want to install it. Many of them are for stuff like "iSight" that i
don't use, so I click "ignore." You can also select the "Software
Update" menu item at any time and scan for the latest updates. Being
Mac, of course, everything is done automagically, only prompting if you
want to do it, and later (if reboot is required, which it usually isn't
for application updates) if you want to reboot. Of course, if anything
ever didn't work, your system would be toast. Though it's never
happened for me with OS X, I often feel nervous when the reboot seems
to hesitate a bit (of course, you have no idea what's actually going
on), and relieved when the system actually comes up.
Thanks for the advisory. Yesterday a friend was browsing on my mac and
clicked "ignore" with my permission when I was in the other room. There
aren't many security updates for mac.
Charles
xcssa-admin@xcssa.org wrote:
>FYI Mac Folks..
>
>Tweeks
>p.s. what do MOST of you use for patching?
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>
> National Cyber Alert System
>
> Technical Cyber Security Alert TA05-229A
>
>
>Apple Mac Products are Affected by Multiple Vulnerabilities
>
> Original release date: August 17, 2005
> Last revised: --
> Source: US-CERT
>
>
>Systems Affected
>
> * Apple Mac OS X version 10.3.9 (Panther) and version 10.4.2 (Tiger)
> * Apple Mac OS X Server version 10.3.9 and version 10.4.2
> * Apple Safari web browser
>
> Please see Apple Security Update 2005-007 for further information.
>
>
>Overview
>
> Apple has released Security Update 2005-007 to address multiple
> vulnerabilities affecting Mac OS X, Mac OS X Server, Safari web
> browser, and other products. The most serious of these vulnerabilities
> may allow a remote attacker to execute arbitrary code. Impacts of
> other vulnerabilities include bypassing security restrictions and
> denial of service.
>
>
>I. Description
>
> Apple Security Update 2005-007 resolves a number of vulnerabilities
> affecting Mac OS X, OS X Server, Safari web browser, and other
> products. Further details are available in the following Vulnerability
> Notes:
>
> VU#913820 - Apple Mac OS X Directory Services contains a buffer
> overflow
>
> A buffer overflow in Apple Mac OS X Directory Service's authentication
> process may allow a remote, unauthenticated attacker to execute
> arbitrary code on a vulnerable system.
> (CAN-2005-2507)
>
> VU#461412 - Apple Mac OS X Server servermgrd authentication vulnerable
> to buffer overflow
>
> Apple Mac OS X Server servermgrd contains an unspecified buffer
> overflow vulnerability in its authentication handling routines. This
> vulnerability may lead to remote execution of arbitrary code.
> (CAN-2005-2518)
>
> VU#435188 - Apple Mac OS X AppKit vulnerable to buffer overflow via
> the handling of maliciously crafted rich text files
>
> A buffer overflow vulnerability exists in a component of Apple's Mac
> OS X operating system that handles rich text files.
> (CAN-2005-2501)
>
> VU#172948 - Apple Mac OS X AppKit vulnerable to buffer overflow via
> maliciously crafted Microsoft Word files
>
> A buffer overflow vulnerability exists in a component of Apple's Mac
> OS X operating system that handles Microsoft Word files.
> (CAN-2005-2502)
>
> VU#420316 - Apple Mac OS X Safari vulnerable to arbitrary command
> execution via URLs in PDF files
>
> Apple Mac OS X WebKit and Safari security controls may be bypassed,
> possibly allowing remote command execution.
> (CAN-2005-2522)
>
> VU#709220 - Apple Safari fails to perform security checks on links in
> rich text content
>
> Apple Safari fails to perform security checks on hyperlinks in rich
> text content, which may allow an attacker to execute arbitrary
> commands on a vulnerable system.
> (CAN-2005-2516)
>
> Please note that Apple Security Update 2005-007 addresses
> additional vulnerabilities not described above. As further
> information becomes available, we will publish individual
> Vulnerability Notes.
>
>
>II. Impact
>
> The impacts of these vulnerabilities vary. For information about
> specific impacts please see the Vulnerability Notes. Potential
> consequences include remote execution of arbitrary code or commands,
> bypass of security restrictions, and denial of service.
>
>
>III. Solution
>
>Install an update
>
> Install the update as described in Apple Security Update 2005-007. In
> addition, this update is available via Apple Update.
>
>
>Appendix A. References
>
> * US-CERT Vulnerability Note VU#913820 -
> <http://www.kb.cert.org/vuls/id/913820>
>
> * US-CERT Vulnerability Note VU#461412 -
> <http://www.kb.cert.org/vuls/id/461412>
>
> * US-CERT Vulnerability Note VU#435188 -
> <http://www.kb.cert.org/vuls/id/435188>
>
> * US-CERT Vulnerability Note VU#172948 -
> <http://www.kb.cert.org/vuls/id/172948>
>
> * US-CERT Vulnerability Note VU#420316 -
> <http://www.kb.cert.org/vuls/id/420316>
>
> * US-CERT Vulnerability Note VU#709220 -
> <http://www.kb.cert.org/vuls/id/709220>
>
> * Apple Security Update 2005-007 -
> <http://docs.info.apple.com/article.html?artnum=302163>
>
> * Mac OS X: Updating your software -
> <http://docs.info.apple.com/article.html?artnum=106704>
>
>
> ____________________________________________________________________
>
> The most recent version of this document can be found at:
>
> <http://www.us-cert.gov/cas/techalerts/TA05-229A.html>
> ____________________________________________________________________
>
> Feedback can be directed to US-CERT. Please send email to
> <cert@cert.org> with "TA05-229A Feedback VU#913820" in the subject.
> ____________________________________________________________________
>
> Mailing list information:
>
> <http://www.us-cert.gov/cas/>
> ____________________________________________________________________
>
> Produced 2005 by US-CERT, a government organization.
>
> Terms of use:
>
> <http://www.us-cert.gov/legal.html>
> ____________________________________________________________________
>
>
>Revision History
>
> August 17, 2005: Initial release
>
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.2.1 (GNU/Linux)
>
>iQEVAwUBQwOKkRhoSezw4YfQAQLxywgAkWTcoA3KoWAiY5YYPGejCVbWw/yFzAqy
>4Fb0z9WXfwhwB3/L/IxLvJGhPdVF/b6buP/KZgIxalwsRu6GPjJp5Aj+Cbtf/8KI
>2ca0bRxS3vZJS52ZOEVpS2Z2M8JdcBA2CgfvIw6GEklXD9MTjXXwYUhB6tYK4Ar0
>+UAk6xxaaMRvKztOYbRZhy5/5Kz2Xd9a5UwO/hbojQmilv4elW3iZhGWP+nLEpSI
>D680yttkY++UzmYGYHO0Wm+SAK4fzXKxs/4PMfWvNgP8lKJsHXjjr7KLFtmgCiWU
>oxhOB8RdqVNTKE2kYEq1kiopusBtwK/x35VNr3uCjg23CxYuv8HAjw==
>=yJpi
>-----END PGP SIGNATURE-----
>
>
>