Apple has released security patches to correct ten vulnerabilities affecting Mac OS X. These flaws could be exploited by remote or local attackers to execute arbitrary commands, cause a denial of service, obtain elevated privileges, or disclose sensitive information.
The first issue is due to a buffer overflow error in ImageIO when processing specially crafted GIF images, which could be exploited by malicious websites to execute arbitrary commands (e.g. via WebCore or Safari).
The second flaw is due to an error in Mail.app when processing auto-reply rules, which could be exploited by attackers to intercept contents of encrypted messages.
The third vulnerability is due to an unspecified error in Mail.app when using SMTP authentication with Kerberos5, which could cause the application to append un-initialized memory to a message and disclose sensitive information.
The fourth issue is due to an error where files with diagnostic information are created insecurely when certain environmental variables are set to enable debugging of application memory allocation, which could be exploited by local attackers to obtain elevated privileges.
The fifth flaw is due to a buffer overflow error in QuickDraw Manager when processing specially crafted PICT images, which could be exploited by malicious websites to execute arbitrary commands (e.g. via Safari or Mail).
The sixth vulnerability is due to an error in QuickTime for Java that allows untrusted applets to call arbitrary functions from system libraries, which could cause untrusted applets to gain elevated privileges.
The seventh flaw resides in the Ruby xmlrpc/utils module, which could be exploited by attackers to bypass certain security protections and execute arbitrary commands. For additional information, see : FrSIRT/ADV-2005-0833
The eighth problem is due to an error in Safari that does not properly filter specially crafted web archives, which could be exploited to conduct cross site scripting attacks.
The ninth vulnerability is due to an error where the "Switch User..." button may appear even though the "Enable fast user switching" setting is disabled, which could be exploited by a user (with physical access to the system) to bypass the "Require password to wake this computer from sleep or screen saver" setting and gain access to the currently logged-in user's desktop without authentication.
The last flaw is due to an error where Authorization Services may allow unprivileged users to grant certain rights that should be restricted to administrators, which may lead to privilege escalation.
Credits
Vulnerabilities reported by Norbert Rittel, Ilja van Sprundel, Henrik Dalgaard, Dino Dai Zovi and Luke Fowler.
ChangeLog
2005-09-22 : Initial release
Vulnerability Management
Subscribe to FrSIRT VNS and receive real-time e-mail and SMS alerts when new vulnerabilities, exploits, or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form or by email to updates@frsirt.com.
French
