August 2009

ID: 3879
Date: 13/08/2009

---

Title: 3879 - APPLE-SA-2009-08-12-1 Security Update 2009-004
Platform level affected:Operating System
Hardware components affected:Apple MAC
Specific operating systems components affected: Apple Mac OS
Net-enabled software: Other
Security software:Other
Other software: Other
Remediation Summary:Update your copy of the software with the download available from the supplier.
Vendors affected:Apple
Applications affected:Mac OS X
Adversity source: Unknown
Attack Vector: Vulnerability exploitation
Virulence: Unknown
Warning Status: Active
Potential Damage: Remote execution/modification
Possible Duration: Open Ended
Availability of fix: Available
Type of fix: Patch
Source: www.apple.com
Reliability of source: Trusted
Source URL: http://www.apple.com/support/downloads/
CVE: CVE-2009-0696
Abstract: Apple Security Update 2009-004 is now available and addresses a BIND vulnerability.

APPLE-SA-2009-08-12-1 Security Update 2009-004

Security Update 2009-004 is now available and addresses the
following:

BIND
CVE-ID:  CVE-2009-0696
Available for:  Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5.8, Mac OS X Server v10.5.8
Impact:  A remote attacker may be able to cause the DNS server to unexpectedly terminate
Description:  A logic issue in the handling of dynamic DNS update messages may cause an assertion to be triggered. By sending a maliciously crafted update message to the BIND DNS server, a remote attacker may be able to interrupt the BIND service. The issue affects servers which are masters for one or more zones, regardless of whether they accept updates. BIND is included with Mac OS X and Mac OS X Server but it is not enabled by default. This update addresses the issue by properly rejecting messages with a record of type 'ANY'
where an assertion would previously have been raised.

Security Update 2009-004 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/

For Mac OS X v10.5.8 and Mac OS X Server 10.5.8 The download file is named: "SecUpd2009-004.dmg"
Its SHA-1 digest is: 9fefe6349e8fb9ed47d44b572a11e6c66daf4dac

For Mac OS X v10.4.11 (Intel)
The download file is named: "SecUpd2009-004Intel.dmg"
Its SHA-1 digest is: 28e1d0ad3a97f3b5e17ebe6367532e103b69d3a0

For Mac OS X v10.4.11 (PPC)
The download file is named: "SecUpd2009-004PPC.dmg"
Its SHA-1 digest is: e9ed8d53d6bc055e44768f1d1e894f505f1fd6fe

For Mac OS X Server v10.4.11 (Universal) The download file is named: "SecUpdSrvr2009-004Univ.dmg"
Its SHA-1 digest is: dfb57125139c058655b847135bff50216f3ea577

For Mac OS X Server v10.4.11 (PPC)
The download file is named: "SecUpdSrvr2009-004PPC.dmg"
Its SHA-1 digest is: c95b0c305d7d3f365b7ff768b995da38529ec393

Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222

This message is signed with Apple's Product Security PGP key, and details are available at:
https://www.apple.com/support/security/pgp/

This advisory contains information released by the original author. Some of the information may have changed since it was released. If the issue affects you, it may be prudent to retrieve the advisory from the site of the original source to ensure that you receive the most current information concerning that problem. Reference to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favouring by CPNI.

The views and opinions of authors expressed within this notice shall not be used for advertising or product endorsement purposes. CPNI shall not accept responsibility for any errors or omissions contained within this advisory. In particular, they shall not be liable for any loss or damage whatsoever, arising from or in connection with the usage of information contained within this advisory.

CSIRTUK is a member of the Forum of Incident Response and Security Teams (FIRST) and has contacts with other international Incident Response Teams (IRTs) in order to foster cooperation and coordination in incident prevention, to prompt rapid reaction to incidents, and to promote information sharing amongst its members and the community at large.