Severity: High
1 July, 2008
Summary:
§ These vulnerabilities affect: OS X 10.4.x (Tiger) and OS X 10.5.x (Leopard), both client and server versions; as well as Safari 3.x for OS X 10.4.x
§ How an attacker exploits them: Multiple vectors of attack, including enticing one of your users into visiting a malicious web site
§ Impact: Various results; in the worst case, attacker executes code on your user’s computer, potentially gaining control of your user’s computer
§ What to do: OS X administrators should download, test and install Security Update 2008-004, Mac OS X 10.5.4, and Safari 3.1.2
Severity: High
1 July, 2008
Summary:
§ These vulnerabilities affect: OS X 10.4.x (Tiger) and OS X 10.5.x (Leopard), both client and server versions; as well as Safari 3.x for OS X 10.4.x
§ How an attacker exploits them: Multiple vectors of attack, including enticing one of your users into visiting a malicious web site
§ Impact: Various results; in the worst case, attacker executes code on your user’s computer, potentially gaining control of your user’s computer
§ What to do: OS X administrators should download, test and install Security Update 2008-004, Mac OS X 10.5.4, and Safari 3.1.2
Exposure:
Late yesterday, Apple released two security updates to fix vulnerabilities in both OS X and Safari for Mac. The OS X security update fixes around 25 (number based on CVE-IDs) security issues in software packages that ship as part of OS X, including Ruby, Tomcat, and Webkit. Some of these vulnerabilities allow attackers to execute code on your OS X machines, so we rate this update Critical. Apply it as soon as you can. Three of the fixed vulnerabilities include:
§ WebKit code execution vulnerability. WebKit is an OS X framework used to help display the various types of content found in web pages. According to Apple, Webkit suffers from a memory corruption vulnerability involving the way it processes JavaScript arrays. By luring one of your users to a maliciously crafted web page, an attacker could exploit this flaw to execute code on your user’s computer, with that user’s privileges.
§ SMB File Server buffer overflow vulnerability. The SMB File Server allows OS X to share files with Windows computers. SMB File Server suffers from a heap buffer overflow vulnerability involving the way it handles SMB packets. By sending specially crafted packets to an SMB File Server, or by enticing one of your users to connect to a malicious SMB File Server, an attacker can exploit this flaw to execute code on that user’s computer.
§ Launch Services code execution vulnerability. Launch Services is an OS X application programming interface (API) that allows a running application to open other applications, or their documents. Launch Services suffers from something called a race condition vulnerability, having to do with its validation of symbolic links. By luring one of your users to a specially created web site, an attacker can exploit this flaw to execute code on that user’s computer, with that user’s privileges. However, this attack can only succeed if your users has enabled the “Open ‘safe’ files” preference in Safari.
Apple’s alert includes many more flaws, including other code execution flaws in addition to those described above. The remaining vulnerabilities also include Denial of Service (DoS) flaws, elevation of privilege flaws, and spoofing vulnerabilities, plus others. Components patched by this security update include:
| Alias Manager | CoreTypes |
| c++filt | Dock |
| Launch Services | Net-SNMP |
| Ruby | SMB File Server |
| System Configuration | Tomcat |
| VPN | Webkit |
Please refer to Apple’s OS X alert for more details.
Apple also released a small security update for Safari 3.x. This update fixes one serious vulnerability that only affects Tiger (OS X 10.4.x) users. This flaw is identical to the Webkit vulnerability described above. For some reason, though, Tiger users must also apply this Safari update in order to completely patch the vulnerability.
Solution Path:
Apple has released OS X Security Update 2008-004, OS X 10.5.4, and Safari 3.1.2 to fix all these security issues. OS X administrators should download, test, and deploy the corresponding update as soon as they can.
§ Security Update 2008-004 (PPC)
§ Security Update 2008-004 (Intel)
§ Security Update 2008-004 Server (PPC)
§ Security Update 2008-004 Server (Intel)
§ Security Update OS X 10.5.4 Combo Update
§ Security Update OS X Server 10.5.4
§ Security Update OS X Server 10.5.4 Combo Update
Note: If you have trouble figuring out which of these patches corresponds to your version of OS X and Safari, we recommend that you let OS X’s Software Update utility pick the correct updates for you automatically.
For All Users:
These flaws enable many diverse exploitation methods. Some of the exploits are local, meaning that your perimeter firewall never encounters the attack (unless you use firewalls internally between departments). Installing these updates, therefore, is the most secure course of action.
Status:
Apple has released updates to fix these issues.