Apple released a security patch fixing several vulnerabilities, which can be exploited by attackers to cause a Denial of Service, obtain elevated privileges or compromise a system.
- A specially crafted packet will terminate the operation of the AFP Server due to an incorrect memory reference.
- The contents of a Drop Box can be discovered due to insecure file permissions.
- The Bluetooth Setup Assistant may be launched on systems without a keyboard or a preconfigured Bluetooth input device.
- The incorrect handling of an environment variable within Core Foundation can result in a buffer overflow that may be used to execute arbitrary code.
- Multiple vulnerabilities in Cyrus IMAP, including remotely exploitable denial of service and buffer overflows.
- Multiple vulnerabilities in Cyrus SASL, including remote denial of service and possible remote code execution in applications that use this library.
- World-writable permissions on several directories, allowing potential file race conditions or local privilege escalation.
- Directory traversal issue in Mailman that could allow remote access to arbitrary files on the system.
- Maliciously registered International Domain Names (IDN) can make URLs visually appear as legitimate sites.
ChangeLog
2005-03-22 : Initial release
Vulnerability Management
Subscribe to FrSIRT VNS and receive real-time e-mail and SMS alerts when new vulnerabilities, exploits, or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form or by email to updates@frsirt.com.
French
