Twenty-five vulnerabilities have been identified in Apple Mac OS X, which could be exploited by remote or local attackers to execute arbitrary commands, cause a denial of service, disclose sensitive information, or bypass security restrictions.
The first issue is caused by an error in the AFP Client that executes commands without properly cleaning the environment, which could be exploited by local attackers to create malicious files or execute arbitrary commands with system privileges [...]
Solution
Security Update 2007-004 v1.1 (10.3.9 Client) :
http://www.apple.com/support/downloads/securityupdate2007004v111039client.html
Security Update 2007-004 v1.1 (PPC) :
http://www.apple.com/support/downloads/securityupdate2007004v11ppc.html
Security Update 2007-004 v1.1 (Universal) :
http://www.apple.com/support/downloads/securityupdate2007004v11universal.html
Security Update 2007-004 (10.3.9 Server) :
http://www.apple.com/support/downloads/securityupdate20070041039server.html
Security Update 2007-004 (10.3.9 Client) :
http://www.apple.com/support/downloads/securityupdate20070041039client.html
Security Update 2007-004 (PPC) :
http://www.apple.com/support/downloads/securityupdate2007004ppc.html
Security Update 2007-004 (Universal) :
http://www.apple.com/support/downloads/securityupdate2007004universal.html
Credits
Vulnerabilities reported by Kevin Finisterre (DigitalMunition), Landon Fuller (Three Rings Design), Mu Security Research Team, Daniel Ball (Pittsburgh Technical Institute), Geoff Franks (Hauptman Woodward Medical Research Institute), Jamie Cox (Sophos) and Bradley Schwoerer (University of Wisconsin-Madison).
ChangeLog
2007-04-19 : Initial release
2007-05-01 : Updated Solution
Vulnerability Management
Subscribe to FrSIRT VNS and receive real-time e-mail and SMS alerts when new vulnerabilities, exploits, or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form or by email to updates@frsirt.com.
French
