Apple Mac OS X Security Update Fixes Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence

Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
Secunia Advisory:	SA31326	Advisory Toolbox: Issue ticket Save in to-do list Mark as handled Exploit information Download as PDF Review actions Add comment
Release Date:	2008-08-01
Last Update:	2008-08-04
Popularity:	6,993 views

Critical:	Highly critical
Impact:	Security Bypass Spoofing Privilege escalation DoS System access
Where:	From remote
Solution Status:	Vendor Patch

OS:	Apple Macintosh OS X

Subscribe:	Instant alerts on relevant vulnerabilities

CVE reference:	CVE-2007-4850 CVE-2007-5135 CVE-2007-6199 CVE-2007-6200 CVE-2008-0599 CVE-2008-0674 CVE-2008-1447 CVE-2008-2050 CVE-2008-2051 CVE-2008-2320 CVE-2008-2321 CVE-2008-2322 CVE-2008-2323 CVE-2008-2324 CVE-2008-2325 CVE-2008-2952

Description: Apple has issued a security update for Mac OS X, which fixes multiple vulnerabilities. 1) A vulnerability in BIND can be exploited to poison the DNS cache. For more information: SA30973 2) A boundary error exists in CarbonCore when handling filenames. This can be exploited to cause a stack-based buffer overflow via overly long filenames passed to the CarbonCore framework file management API. Successful exploitation of the vulnerability may allow execution of arbitrary code. 3) Multiple errors exist in CoreGraphics when processing received arguments. These can be exploited to trigger a memory corruption by e.g. tricking a user into visiting a specially crafted website. Successful exploitation of the vulnerability may allow execution of arbitrary code. 4) An integer overflow error exists in CoreGraphics when handling PDF files containing Type 1 fonts. This can be exploited to cause a heap-based buffer overflow via a font with an overly large length in a specially crafted PDF file. Successful exploitation of the vulnerability may allow execution of arbitrary code. 5) Multiple errors in QuickLook when downloading Microsoft Office files can be exploited to cause a memory corruption. Successful exploitation of the vulnerability may allow execution of arbitrary code. 6) An error exists in the Data Detectors engine when viewing a specially crafted message. This can be exploited to consume overly large resources and trigger an application using the engine to terminate. 7) The problem is that the "Repair Permissions" tool included in Disk Utility sets the "setuid" bit on "/usr/bin/emacs". This can be exploited to execute arbitrary commands with system privileges. 8) An error in OpenLDAP when parsing ASN.1 BER encoded packets can be exploited to cause a DoS. For more information: SA30853 9) A boundary error exists in the OpenSSL "SSL_get_shared_ciphers()" function. For more information see vulnerability #4 in: SA22130 10) Some vulnerabilities in PHP can be exploited malicious users to bypass certain security restrictions, and potentially by malicious people to cause a DoS (Denial of Service) or to compromise a vulnerable system. For more information: SA30048 11) Two vulnerabilities in rsync can be exploited by malicious users to bypass certain security restrictions. For more information: SA27863 Solution: Apply Security Update 2008-005. Security Update 2008-005 Server (PPC): http://www.apple.com/support/downloads/securityupdate2008005serverppc.html Security Update 2008-005 Server (Intel): http://www.apple.com/support/downloads/securityupdate2008005serverintel.html Security Update 2008-005 (PPC): http://www.apple.com/support/downloads/securityupdate2008005ppc.html Security Update 2008-005 (Intel): http://www.apple.com/support/downloads/securityupdate2008005intel.html Security Update 2008-005 (Leopard): http://www.apple.com/support/downloads/securityupdate2008005leopard.html Provided and/or discovered by: The vendor credits: 1) Dan Kaminsky of IOActive 2) Thomas Raffetseder of the International Secure Systems Lab and Sergio 'shadown' Alvarez of n.runs AG. 3) Michal Zalewski, Google 4) Pariente Kobi, reported via iDefense 7) Anton Rang and Brian Timares Changelog: 2008-08-04: Updated vulnerability #2 and #4. Added links to "Original Advisory" section. Original Advisory: Apple: http://support.apple.com/kb/HT2647 iDefense: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=730 n.runs: http://www.nruns.com/security_advisor...rboncore_framework_code_execution.php Other References: SA22130: http://secunia.com/advisories/22130/ SA27863: http://secunia.com/advisories/27863/ SA30048: http://secunia.com/advisories/30048/ SA30973: http://secunia.com/advisories/30973/ SA30853: http://secunia.com/advisories/30853/

Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released. Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

Latest Advisories

1st Dec, 2008

New advisories:	33
New vulnerabilities:	55
Updated advisories:	56

Moderately // 288 views

RakhiSoftware Shopping Cart Multiple Vulnerabilities

Moderately // 283 views

Lito Lite CMS "cid" SQL Injection Vulnerability

Moderately // 311 views

Basic PHP CMS "id" SQL Injection Vulnerability

Less // 547 views

Microsoft Office Communications Server SIP INVITE Denial of Service

Moderately // 288 views

Bluo CMS "id" SQL Injection Vulnerability

Moderately // 309 views

Active eWebquiz "useremail" and "password" SQL Injection Vulnerabilities

Highly // 304 views

Minimal Ablog Multiple Vulnerabilities

Moderately // 311 views

Active Newsletter "email" and "password" SQL Injection Vulnerabilities

Moderately // 297 views

Ocean12 FAQ Manager Pro "ID" SQL Injection Vulnerability

Moderately // 326 views

Active Photo Gallery "username" and "password" SQL Injection

Solutions | More...

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.