You are here: ZDNet UK > News > Security

Security threats Toolkit

Mac OS 10.5.5 packs plethora of security fixes

Robert Vamosi CNET News

Published: 16 Sep 2008 16:26 BST

…to DNS cache poisoning and may return forged information.

Apple explained that libresolv provides translation between host names and IP addresses for applications that use its unicast DNS resolution API. A weakness in the DNS protocol may allow remote attackers to perform DNS cache poisoning attacks. Apple credits Dan Kaminsky of IOActive for reporting this vulnerability.

Login Window I
This patch affects users of Mac OS X v10.5 to v10.5.4 and Mac OS X Server v10.5 to v10.5.4.

The update addresses the vulnerability detailed within CVE-2008-3610, in which a user may log in without providing a password.

Apple explained that a race condition exists in Login Window. To trigger this issue, the system must have the guest account enabled or another account with no password. This issue does not affect systems prior to Mac OS X v10.5.

Login Window II
This patch only affects users of Mac OS X v10.4.11 and Mac OS X Server v10.4.11.

The update addresses the vulnerability described in CVE-2008-3611, in which person with access to the login screen may be able to change a user's password.

Apple said that, when a system has been configured to enforce policies on login passwords, users may be required to change their password in the login screen.

If a password change fails, an error message is displayed, but the current password is not cleared and this may not be obvious to the user.

Apple credited Christopher A Grande of Middlesex Community College for reporting this vulnerability.

mDNSResponder
This patch affects users running Mac OS X v10.5 to v10.5.4, and Mac OS X Server v10.5 to v10.5.4.

The update addresses a buffer overflow vulnerability described in CVE-2008-1447, in which mDNSResponder is susceptible to DNS cache poisoning and may return forged information.

Apple credited Dan Kaminsky of IOActive for reporting this vulnerability.

OpenSSH
This patch affects users of Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 to v10.5.4, and Mac OS X Server v10.5 to v10.5.4.

The update addresses multiple vulnerabilities in OpenSSH described in CVE-2008-1483 and CVE-2008-1657, the most serious of which is local X11 session control.

QuickDraw Manager
This patch only affects users of Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 to v10.5.4, and Mac OS X Server v10.5 to v10.5.4.

The update addresses the integer overflow vulnerability described in CVE-2008-3614, in which opening a maliciously crafted Pict image may lead to an unexpected application termination or arbitrary code execution.

Ruby
This patch affects users of Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 to v10.5.4, and Mac OS X Server v10.5 to v10.5.4.

The update addresses a vulnerability described in CVE-2008-2376, in which running a Ruby script that uses untrusted input as the arguments to the Array#fill method may lead to an unexpected application termination or arbitrary code execution.

Apple said there's an integer overflow in rb_ary_fill(), which implements the Ruby Array#fill method.

Search Kit
This patch affects users of Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 to v10.5.4, Mac OS X Server v10.5 to v10.5.4.

The update addresses a vulnerability described in CVE-2008-3616, in which applications passing untrusted input to the Search Kit API may lead to an unexpected application termination or arbitrary code execution.

Apple explained that an integer overflow issues exist in functions within the Search Kit framework.

System Configuration I
This patch affects users of Mac OS X v10.4.11 and Mac OS X Server v10.4.11.

The update addresses the vulnerability described in CVE-2008-2312, in which a local user may obtain the PPP password.

Apple said Network Preferences stores PPP passwords unencrypted in a world readable file, accessible to any local user.

Apple credited Hernan Ochoa of Core Security Technologies, Tore Halset of pvv.org, and Matt Johnston of the University Computer Club for reporting this vulnerability.

System Preferences I
This patch affects users of Mac OS X v10.5 to v10.5.4, and Mac OS X Server v10.5 to v10.5.4.

The update addresses the vulnerability described in CVE-2008-3617, in which users may be misled into believing their passwords are stronger than they are.

Apple said: "Remote Management and Screen Sharing can be configured to require a password for VNC viewers. The maximum length for VNC viewer passwords is eight characters. The password field can display more than eight characters, implying that the additional characters are used in the password. This update addresses the issue by limiting VNC viewer passwords to eight characters in the user interface."

Apple credits Michal Fresel of hi competence eU for reporting this vulnerability.

System Preferences II
This patch affects users of Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 to v10.5.3, and Mac OS X Server v10.5 to v10.5.3.

The update addresses the vulnerability described in CVE-2008-3618, in which authenticated users may have unexpected remote access to files and directories.

Time Machine
This patch affects users of Mac OS X v10.5 to v10.5.4, Mac OS X Server v10.5 to v10.5.4.

The update addresses the vulnerability described in CVE-2008-3619, in which backing up a system with Time Machine may lead to the disclosure of sensitive information.

Apple said that, during a Time Machine backup, several log files are saved to the backup drive with read permission allowed to other users and may lead to the disclosure of sensitive information.

VideoConference
This patch affects users of Mac OS X v10.4.11, Mac OS X Server v10.4.11, Mac OS X v10.5 to v10.5.4, and Mac OS X Server v10.5 to v10.5.4.

The update addresses the vulnerability described in CVE-2008-3621, in which videoconferencing with a malicious user may lead to an unexpected application termination or arbitrary code execution. Apple said a memory-corruption issue exists in the VideoConference framework's handling of H.264 encoded media.

Wiki Server
This patch affects users of Mac OS X v10.5 to v10.5.4, and Mac OS X Server v10.5 to v10.5.4.

The update addresses a divide by zero vulnerability described in CVE-2008-3622, in which a remote attacker may cause persistent JavaScript injection on a Wiki server.

Apple said "the Wiki Server mailing list archive will execute JavaScript code embedded in messages. A remote person may send an email containing JavaScript code to a mailing list hosted on a Wiki server. Viewing the message from the Wiki Server mailing list archive will trigger the execution of the embedded JavaScript code on the system of the person viewing the message."