TITLE:
Mac OS X Security Update Fixes Multiple Vulnerabilities
SECUNIA ADVISORY ID:
SA14655
VERIFY ADVISORY:
http://secunia.com/advisories/14655/
CRITICAL:
Highly critical
IMPACT:
Security Bypass, Spoofing, Exposure of sensitive information,
Privilege escalation, DoS, System access
WHERE:
From remote
OPERATING SYSTEM:
Apple Macintosh OS X
http://secunia.com/product/96/
DESCRIPTION:
Apple has issued a security update for Mac OS X, which fixes various
vulnerabilities.
1) A signedness error in AFP Server can be exploited to crash the
application via a specially crafted FPLoginExt packet.
2) An access control error in AFP Server can be exploited to gain
knowledge of the contents of a Drop Box.
3) An error in Bluetooth Setup Assistant can be exploited to bypass
security restrictions when using a Bluetooth input device.
4) A boundary error in the Core Foundation library when handling the
CF_CHARSET_PATH environment variables can be exploited to cause a
buffer overflow.
Successful exploitation allows malicious, local users to execute
arbitrary code with escalated privileges.
5) Multiple vulnerabilities in Cyrus IMAP Server can be exploited by
malicious people to compromise a vulnerable system.
For more information:
SA13274
6) Some vulnerabilities in Cyrus SASL can be exploited to crash or
potentially compromise applications linked against the library.
For more information:
SA12760
7) Insecure permissions on various directories may result in race
conditions and allow local privilege escalation.
8) A vulnerability in Mailman can be exploited by malicious people to
disclose sensitive information.
For more information:
SA14211
9) A security issue in Safari can be exploited by a malicious web
site to spoof the URL displayed in the address bar, SSL certificate,
and status bar.
For more information:
SA14164
SOLUTION:
Apply Security Update 2005-003.
Security Update 2005-003 (Client) 1.0:
http://www.apple.com/support/downloads/securityupdate2005003client.html
Security Update 2005-003 (Server) 1.0:
http://www.apple.com/support/downloads/securityupdate2005003server.html
PROVIDED AND/OR DISCOVERED BY:
1) nemo
2) John M. Glenn
4) iDEFENSE and Adriano Lima
7) Eric Hall, Michael Haller, and root[at]addcom.de.
ORIGINAL ADVISORY:
Apple:
http://docs.info.apple.com/article.html?artnum=301061