Technical Description

Apple has released security patches to correct ten vulnerabilities affecting Mac OS X. These flaws could be exploited by remote or local attackers to execute arbitrary commands, cause a denial of service, obtain elevated privileges, or disclose sensitive information.

The first issue is due to a buffer overflow error in ImageIO when processing specially crafted GIF images, which could be exploited by malicious websites to execute arbitrary commands (e.g. via WebCore or Safari).

The second flaw is due to an error in Mail.app when processing auto-reply rules, which could be exploited by attackers to intercept contents of encrypted messages.

The third vulnerability is due to an unspecified error in Mail.app when using SMTP authentication with Kerberos5, which could cause the application to append un-initialized memory to a message and disclose sensitive information.

The fourth issue is due to an error where files with diagnostic information are created insecurely when certain environmental variables are set to enable debugging of application memory allocation, which could be exploited by local attackers to obtain elevated privileges.

The fifth flaw is due to a buffer overflow error in QuickDraw Manager when processing specially crafted PICT images, which could be exploited by malicious websites to execute arbitrary commands (e.g. via Safari or Mail).

The sixth vulnerability is due to an error in QuickTime for Java that allows untrusted applets to call arbitrary functions from system libraries, which could cause untrusted applets to gain elevated privileges.

The seventh flaw resides in the Ruby xmlrpc/utils module, which could be exploited by attackers to bypass certain security protections and execute arbitrary commands. For additional information, see : VUPEN/ADV-2005-0833

The eighth problem is due to an error in Safari that does not properly filter specially crafted web archives, which could be exploited to conduct cross site scripting attacks.

The ninth vulnerability is due to an error where the "Switch User..." button may appear even though the "Enable fast user switching" setting is disabled, which could be exploited by a user (with physical access to the system) to bypass the "Require password to wake this computer from sleep or screen saver" setting and gain access to the currently logged-in user's desktop without authentication.

The last flaw is due to an error where Authorization Services may allow unprivileged users to grant certain rights that should be restricted to administrators, which may lead to privilege escalation.

Affected Products

Mac OS X 10.3.9
Mac OS X Server 10.3.9
Mac OS X 10.4.2
Mac OS X Server 10.4.2

Solution

Security Update 2005-008 for Mac OS X 10.3.9 :
http://www.apple.com/support/downloads/securityupdate2005008macosx1039.html
Security Update 2005-008 for Mac OS X 10.4.2 :
http://www.apple.com/support/downloads/securityupdate2005008macosx1042.html

References

http://www.vupen.com/english/advisories/2005/1823
http://docs.info.apple.com/article.html?artnum=302413

Credits

Vulnerabilities reported by Norbert Rittel, Ilja van Sprundel, Henrik Dalgaard, Dino Dai Zovi and Luke Fowler.

ChangeLog

2005-09-22 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.