January 2005
Apple Security Update 2005-001
ID: 00076
Ref: 63/2005
Date: 27 January 2005:15:58:21
Version: 1
Title: Apple Security Update 2005-001
Abstract: Multiple Vulnerabilities in Mac OS X Software
Vendors affected: Apple
Operating systems affected: Apple
Applications affected: Apple
Title
=====
Apple Security Update 2005-001
Detail
======
Multiple Vulnerabilities in Mac OS X Software
ESB-2005.0091 -- APPLE-SA-2005-01-25 Security Update 2005-001 -
Multiple Vulnerabilities in Mac OS X Software
27 January 2005
Product: at
ColorSync
libxml2
Mail
PHP
Safari
SquirrelMail
Publisher: Apple
Operating System: Mac OS X
Impact: Increased Privileges
Execute Arbitrary Code/Commands
Denial of Service
Provide Misleading Information
Access: Remote/Unauthenticated
Existing Account
CVE Names: CAN-2005-0127 CAN-2005-0126 CAN-2005-0125
CAN-2004-1314 CAN-2004-1065 CAN-2004-1064
CAN-2004-1063 CAN-2004-1036 CAN-2004-1020
CAN-2004-1019 CAN-2004-1018 CAN-2004-0989
CAN-2004-0595 CAN-2004-0594 CAN-2003-0863
CAN-2003-0860
- - --------------------------BEGIN INCLUDED TEXT--------------------
- - -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2005-01-25 Security Update 2005-001
Security Update 2005-001 is now available and delivers the following security enhancements:
at commands
Available for: Mac OS X v10.3.7, Mac OS X Server v10.3.7
CVE-ID: CAN-2005-0125
Impact: Updates the "at" commands to address a local privilege escalation vulnerability
Description: The "at" family of commands did not properly drop privileges. This could allow a local user to remove files not owned by them, run programs with added privileges, or read the contents of normally unreadable files. This update patches the commands at, atrm, batch, atq, and atrun. Credit to kf_lists[at]digitalmunition[dot]com for reporting this issue.
ColorSync
Available for: Mac OS X v10.3.7, Mac OS X Server v10.3.7, Mac OS X v10.2.8, Mac OS X Server v10.2.8
CVE-ID: CAN-2005-0126
Impact: Malformed ICC color profiles could overwrite the program heap resulting in arbitrary code execution.
Description: An out-of-specification or improperly embedded ICC color profile could overwrite the program heap and allow arbitrary code execution. There are no known exploits for this issue. With this update, ColorSync will reject incorrectly-formed ICC color profiles.
libxml2
Available for: Mac OS X v10.3.7, Mac OS X Server v10.3.7
CVE-ID: CAN-2004-0989
Impact: The libxml2 library contains unsafe code that may be exploited in applications linked against it.
Description: This update fixes several functions in the libxml2 library that have been identified as unsafe due to potentially exploitable buffer overflows.
Mail
Available for: Mac OS X v10.3.7 Client, Mac OS X Server v10.3.7
CVE-ID: CAN-2005-0127
Impact: Email messages sent from a single machine can be identified
Description: A GUUID containing an identifier associated with the ethernet networking hardware was used in the construction an RFC-822 required Message-ID header. Mail now hides this information by computing the Message-ID using a cryptographic hash of the GUUID concatenated with data from /dev/random. Credit to Carl Purvis for reporting this issue.
PHP
Available for: Mac OS X v10.3.7, Mac OS X Server v10.3.7, Mac OS X v10.2.8, Mac OS X Server v10.2.8
CVE-ID: CAN-2003-0860, CAN-2003-0863, CAN-2004-0594, CAN-2004-0595, CAN-2004-1018, CAN-2004-1019, CAN-2004-1020, CAN-2004-1063, CAN-2004-1064, CAN-2004-1065
Impact: Multiple vulnerabilities in PHP including remote denial of service and execution of arbitrary code
Description: PHP is updated to version 4.3.10 to address several issues. The PHP release announcement for version 4.3.10 is located at http://www.php.net/release_4_3_10.php
Safari
Available for: Mac OS X v10.3.7, Mac OS X Server v10.3.7, Mac OS X v10.2.8, Mac OS X Server v10.2.8
CVE-ID: CAN-2004-1314
Impact: When Safari's "Block Pop-Up Windows" feature is not enabled, a malicious pop-up window could appear as being from a trusted site
Description: If the "Block Pop-Up Windows" feature is enabled, then this issue does not occur. If the "Block Pop-Up Windows" feature is not enabled, a user can be misled about the content of a Pop-up window if they used an untrusted link to navigate to a site they wanted to view. This update corrects the issue regardless of the "Block Pop-Up Windows" setting. Credit to Secunia Research for reporting this issue.
SquirrelMail
Available for: Mac OS X Server 10.3.7
CVE-ID: CAN-2004-1036
Impact: SquirrelMail is updated to address a cross-site scripting vulnerability
Description: A cross-site scripting vulnerability in SquirrelMail allowed email messages to contain content that would be rendered by a users web browser. SquirrelMail is updated to address this issue. Further details are available from the SquirrelMail website: http://www.squirrelmail.org/
Security Update 2005-001 may be obtained from the Software Update pane in System Preferences, or Apple's Software Downloads web site: http://www.apple.com/support/downloads/
For Mac OS X v10.3.7
The download file is named: "SecUpd2005-001Pan.dmg"
Its SHA-1 digest is: 89aedac4c3824bf7a35c3100894b22fc0db47dd0
For Mac OS X Server v10.3.7
The download file is named: "SecUpSrvr2005-001Pan.dmg"
Its SHA-1 digest is: 73d0cd53be0504c10173d7dd6bb9f5fc964e3390
For Mac OS X v10.2.8
The download file is named: "SecUpd2005-001Jag.dmg"
Its SHA-1 digest is: 5c364b5f548a7fdced54de2149e79dfb3d90371d
For Mac OS X Server v10.2.8
The download file is named: "SecupdSrvr2005-001Jag.dmg"
Its SHA-1 digest is: c999c6d2e58cea324dd91188fedf870741b296d4
Information will also be posted to the Apple Product Security web site: http://docs.info.apple.com/article.html?artnum=61798
This message is signed with Apple's Product Security PGP key, and details are available at: http://www.apple.com/support/security/security_pgp.html
- - -----BEGIN PGP SIGNATURE-----
Version: PGP 8.1
iQEVAwUBQfagQJyw5owIz4TQAQIragf/YOKFa4pX+9U82YMyRpvtNlEt+7fU9qeS
blj/bAj0+/bNLCxhrQIbZkhFafM1mM9Gj5NK6cKR8vWEFj77gQ+xBeBS8UWmfkt4
B6dj99XagcHfQuYbJXVVJNwFedFvkeHfurcCmzaYuWiB56/lQfAUCROVqXw/esiA
SXM0636E6ONuH4YPeZ2C7fI954bE3v3/3i0YDPGtXGAbnLBhskzYpcdAipTkwy3W
uDGanqFRvR1F4q38eWf48WmmJ+CXqdfCBZQE41LUJMwwBcXsXnsRm1erv6PwfCxU
gF3A/pORD0SZGMPqz7HZtOjdkXCpoYkX+mt1ejpW8ADJxWurtoKxhQ==
=Acv8
- - -----END PGP SIGNATURE-----
______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email
______________________________________________________________________
- ----------------------------------------------------------------------------------
For additional information or assistance, please contact the HELP Desk by
telephone or Not Protectively Marked information may be sent via
EMail to: uniras@niscc.gov.uk
Office Hours:
Mon - Fri: 08:30 - 17:00 Hrs
Tel: +44 (0) 870 487 0748 Ext 4511
Fax: +44 (0) 870 487 0749
Outside of Office Hours:
On Call Duty Officer:
Tel: +44 (0) 870 487 0748 and follow the prompts
- ----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of Apple for the information
contained in this Briefing.
- ----------------------------------------------------------------------------------