Title: Apple Mac OS X Security Update 2006-001 Multiple Vulnerabilities
Severity: CRITICAL
Description:
Apple has released Security Update 2006-001 to address multiple remote and local Mac OS X vulnerabilities.
- automount is prone to a denial-of-service vulnerability. A problem with the file servers could cause Mac OS X to mount filesystems with reserved names. This could result in the system becoming unresponsive, or possibly allow arbitrary code from the malicious file server to be executed on the target system.
- BOM is prone to a directory-traversal vulnerability. The BOM framework can permit archive files to be unpacked into arbitrary locations that are writeable by the current user.
- Directory Services is prone to an insecure temporary file-creation vulnerability. The 'passwd' program creates files in an insecure manner that could be exploited to elevate privileges.
- FileVault unauthorized-access vulnerability. A problem with FileVault when creating an image can lead to directories being mounted with insecure permissions.
- IPSec is prone to a remote denial-of-service vulnerability. This issue is due to an incorrect handling of error conditions for virtual private networks based on IPSec. Remote attackers may exploit this issue to cause service interruption.
- LibSystem is prone to a buffer-overflow vulnerability. An attacker may be able to cause an application using the vulnerable library to request large amounts of memory. This may also be exploited to trigger a heap-based buffer overflow. Arbitrary code execution may be possible depending on the application. Further information on this issue from Suresec is available.
- Mail is prone to a vulnerability related to download safety. The problem occurs in 'Download Validation' when it fails to warn users if a file type is not 'safe'. Certain file types can be used to bypass the validation routine. This results in a false sense of security.
- rsync is prone to a buffer-overflow vulnerability. Authenticated users may be able to cause the rsync server to crash or execute arbitrary code. This issue occurs when the flag for extended attributes to be transferred is enabled, and results in a buffer overflow.
- Safari is prone to multiple vulnerabilities. These issues include a heap-based buffer overflow when handling certain HTML that could result in a crash of the application or the execution of arbitrary code. Arbitrary code execution may be possible when viewing a malicious web page. An attacker may exploit this to execute arbitrary code in the context of the victim user. An HTTP redirection issue affects Safari when accessing a local file. Lastly, a problem with 'Syndication' could result in arbitrary JavaScript in RSS feeds being executed in the victim user's browser.
Affected Products:
- Apple Mac OS X 10.3.0
- Apple Mac OS X 10.3.1
- Apple Mac OS X 10.3.2
- Apple Mac OS X 10.3.3
- Apple Mac OS X 10.3.4
- Apple Mac OS X 10.3.5
- Apple Mac OS X 10.3.6
- Apple Mac OS X 10.3.7
- Apple Mac OS X 10.3.8
- Apple Mac OS X 10.3.9
- Apple Mac OS X 10.4.0
- Apple Mac OS X 10.4.1
- Apple Mac OS X 10.4.2
- Apple Mac OS X 10.4.3
- Apple Mac OS X 10.4.4
- Apple Mac OS X 10.4.5
- Apple Mac OS X Server 10.3.0
- Apple Mac OS X Server 10.3.1
- Apple Mac OS X Server 10.3.2
- Apple Mac OS X Server 10.3.3
- Apple Mac OS X Server 10.3.4
- Apple Mac OS X Server 10.3.5
- Apple Mac OS X Server 10.3.6
- Apple Mac OS X Server 10.3.7
- Apple Mac OS X Server 10.3.8
- Apple Mac OS X Server 10.3.9
- Apple Mac OS X Server 10.4.0
- Apple Mac OS X Server 10.4.1
- Apple Mac OS X Server 10.4.2
- Apple Mac OS X Server 10.4.3
- Apple Mac OS X Server 10.4.4
- Apple Mac OS X Server 10.4.5
References:
- Apple: Mac OS X Home Page
- Suresec: Suresec security advisory 11
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
