----------------------------------------------------------------------

2003: 2,700 advisories published
2004: 3,100 advisories published
2005: 4,600 advisories published
2006: 5,300 advisories published

How do you know which Secunia advisories are important to you?

The Secunia Vulnerability Intelligence Solutions allows you to filter
and structure all the information you need, so you can address issues
effectively.

Get a free trial of the Secunia Vulnerability Intelligence Solutions:
http://corporate.secunia.com/how_to_buy/38/vi/?ref=secadv

----------------------------------------------------------------------

TITLE:
Apple Mac OS X Security Update Fixes Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA28136

VERIFY ADVISORY:
http://secunia.com/advisories/28136/

CRITICAL:
Highly critical

IMPACT:
Hijacking, Security Bypass, Cross Site Scripting, Exposure of system
information, Exposure of sensitive information, Privilege escalation,
DoS, System access

WHERE:
>From remote

OPERATING SYSTEM:
Apple Macintosh OS X
http://secunia.com/product/96/

DESCRIPTION:
Apple has issued a security update for Mac OS X, which fixes multiple
vulnerabilities.

1) A format string error in the URL handler of Address Book can be
exploited to execute arbitrary code when a user views a specially
crafted web page.

2) An error in the handling of downloaded files in CFNetwork can be
exploited via directory traversal attacks to automatically download
files to arbitrary folders when a user is enticed to visit a
specially crafted web page.

3) An unspecified error exists in ColorSync when processing images
with an embedded ColorSync profile, which can be exploited to cause a
memory corruption.

Successful exploitation may allow execution of arbitrary code.

4) A race condition exists in the
"CFURLWriteDataAndPropertiesToResource" API, which can lead to files
being created with insecure permissions.

5) A boundary error exists in the printer driver for CUPS. This can
be exploited to cause a buffer overflow and allows an admin user to
execute arbitrary code with system privileges by passing a specially
crafted URI to the CUPS service.

6) A boundary error in CUPS can be exploited by malicious people to
compromise a vulnerable system.

For more information:
SA27233

7) An integer underflow error in the CUPS backend in the handling of
SNMP responses can be exploited to cause a stack-based buffer
overflow by sending a specially crafted SNMP response.

Successful exploitation allows execution of arbitrary code, but
requires that SNMP is enabled.

8) A boundary error in Desktop Services can be exploited to cause a
heap-based buffer overflow when a user opens a directory containing a
specially crafted .DS_Store file.

Successful exploitation may allow execution of arbitrary code.

9) An input validation error in tar can be exploited by malicious
people to compromise a user's system.

For more information:
SA26573

10) An unspecified error in iChat can be exploited by malicious
people on the local network to initiate a video connection without
the user's approval.

11) An unspecified error exists within IO Storage Family when
handling GUID partition maps within a disk image. This can be
exploited to execute arbitrary code when a user is enticed to open a
specially crafted disk image.

12) Launch Services does not handle HTML files as potentially unsafe
content. This can be exploited to disclose sensitive information or
conduct cross-site scripting attacks by enticing a user to open a
specially crafted HTML file.

13) A vulnerability in Mail in the handling of unsafe file types can
be exploited to compromise a user's system.

For more information:
SA27785

14) An error in Mail can cause the application to default to SMTP
plaintext authentication if the server supports only MD5
Challenge-Response authentication and plaintext authentication.

15) Some vulnerabilities in perl can be exploited by malicious people
to compromise a vulnerable system.

For more information:
SA27546

16) A security issue in python can be exploited by malicious people
to cause a DoS (Denial of Service) and potentially compromise a
vulnerable system.

For more information:
SA26837

17) Plug-ins in Quick Look are not restricted from making network
requests. This may lead to the disclosure of sensitive information
when previewing an HTML file.

18) URLs contained in movie files may be accessed when creating an
icon for a movie file or previewing a movie file using QuickLook.

19) Some security issues in ruby can be exploited by malicious people
to conduct spoofing attacks.

For more information:
SA26985

20) Some vulnerabilities and a security issue in Ruby on Rails can be
exploited by malicious people to disclose sensitive information or to
conduct session fixation attacks.

For more information:
SA25699
SA27781

21) An error in Safari allows a page to navigate the subframes of any
other page. This can be exploited to conduct cross-site scripting
attacks and to disclose sensitive information when a user visits a
specially crafted web page.

22) An unspecified error in Safari in the handling of RSS feeds can
be exploited to cause a memory corruption and may allow execution of
arbitrary code when a user accesses a specially crafted URL.

23) Some boundary errors in Samba can be exploited by malicious
people to compromise a vulnerable system.

For more information:
SA27450

24) Some boundary errors in the Shockwave Plug-in can be exploited by
malicious people to compromise a user's system.

For more information:
SA19218

25) A boundary error in the processing of command line arguments to
"mount_smbfs" and "smbutil" can be exploited to cause a stack-based
buffer overflow and execute arbitrary code with system privileges.

26) The distribution definition file used in Software Update is
received by using HTTP without any authentication and allows
execution of arbitrary commands.

Successful exploitation requires a MitM (Man-in-the-Middle) attack.

27) An error due to an insecure file operation exists in the handling
of output files in SpinTracer. This may allow a malicious, local user
to execute arbitrary code with system privileges.

28) An unspecified error exists in the Microsoft Office Spotlight
Importer, which can be exploited to cause a memory corruption when a
user downloads a specially crafted .xls file.

Successful exploitation may allow execution of arbitrary code.

29) Some vulnerabilities in tcpdump can be exploited by malicious
people to cause a DoS or to compromise a user's system.

For more information:
SA24318
SA26135

30) Some vulnerabilities exist the Perl Compatible Regular
Expressions (PCRE) library used by XQuery, which can potentially be
exploited to compromise a vulnerable system.

For more information:
SA27543

SOLUTION:
Apply Security Update 2007-009.

Security Update 2007-009 (10.4.11 Universal):
http://www.apple.com/support/downloads/securityupdate200700910411universal.html

Security Update 2007-009 (10.4.11 PPC):
http://www.apple.com/support/downloads/securityupdate200700910411ppc.html

Security Update 2007-009 (10.5.1):
http://www.apple.com/support/downloads/securityupdate20070091051.html

PROVIDED AND/OR DISCOVERED BY:
2) The vendor credits Sean Harding.
3) The vendor credits Tom Ferris, Adobe Secure Software Engineering
Team (ASSET).
5) The vendor credits Dave Camp, Critical Path Software.
7) The vendor credits Wei Wang, McAfee Avert Labs.
12) The vendor credits Michal Zalewski, Google Inc.
13) The vendor credits Xeno Kovah, originally reported in Mac OS X
10.5 by heise Security.
15) The vendor credits Tavis Ormandy and Will Drewry, Google Security
Team.
18) The vendor credits Lukhnos D. Liu, Lithoglyph Inc.
26) Moritz Jodeit.
27) The vendor credits Kevin Finisterre, DigitalMunition

ORIGINAL ADVISORY:
Apple:
http://docs.info.apple.com/article.html?artnum=307179

OTHER REFERENCES:
SA19218:
http://secunia.com/advisories/19218/

SA24318:
http://secunia.com/advisories/24318/

SA25699:
http://secunia.com/advisories/25699/

SA26135:
http://secunia.com/advisories/26135/

SA26573:
http://secunia.com/advisories/26573/

SA26837:
http://secunia.com/advisories/26837/

SA26985:
http://secunia.com/advisories/26985/

SA27233:
http://secunia.com/advisories/27233/

SA27450:
http://secunia.com/advisories/27450/

SA27543:
http://secunia.com/advisories/27543/

SA27546:
http://secunia.com/advisories/27546/

SA27781:
http://secunia.com/advisories/27781/

SA27785:
http://secunia.com/advisories/27785/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------