OS X 10.5.3 Fixes Over 40 Security Vulnerabilities

Severity: High

28 May, 2008

Summary:

• These vulnerabilities affect: OS X 10.4.x (Tiger) and OS X 10.5.x (Leopard), both client and server versions
• How an attacker exploits them: Multiple vectors of attack, including enticing one of your users into visiting a URL or web site
• Impact: Various results; in the worst case, attacker executes code on your user’s computer, potentially gaining control of your user’s computer
• What to do: OS X administrators should download, test and install Security Update 2008-003 / Mac OS X 10.5.3

Exposure:

Today, Apple released a security update fixing at least 41 (number based on CVE-IDs) security issues in software packages that ship as part of OS X, including Apache, iCal, and Mail. Some of these vulnerabilities allow attackers to execute code on your OS X machines, so we rate this update Critical. Apply it as soon as you can. Three of the vulnerabilities which have been fixed are:

Severity: High

28 May, 2008

Summary:

• These vulnerabilities affect: OS X 10.4.x (Tiger) and OS X 10.5.x (Leopard), both client and server versions
• How an attacker exploits them: Multiple vectors of attack, including enticing one of your users into visiting a URL or web site
• Impact: Various results; in the worst case, attacker executes code on your user’s computer, potentially gaining control of your user’s computer
• What to do: OS X administrators should download, test and install Security Update 2008-003 / Mac OS X 10.5.3

Exposure:

Today, Apple released a security update fixing at least 41 (number based on CVE-IDs) security issues in software packages that ship as part of OS X, including Apache, iCal, and Mail. Some of these vulnerabilities allow attackers to execute code on your OS X machines, so we rate this update Critical. Apply it as soon as you can. Three of the vulnerabilities which have been fixed are:

• AppKit code execution vulnerability. AppKit is a OS X framework that helps developers implement graphical, event-driven user interfaces. According to Apple, Appkit suffers from an unspecified vulnerability involving the way it process specially crafted document files. By luring one of your users into downloading a malicious document, then enticing that user to open the document in an editor that uses AppKit (such as TextEdit), an attacker could exploit this flaw to execute code on your user’s computer, with that user’s privileges.

• Help Viewer buffer overflow vulnerability. Help Viewer is an OS X component responsible for displaying Apple’s help content. Help Viewer suffers from a buffer overflow vulnerability involving the way it handles specially malformed help:topic URLs. By enticing one of your users into clicking a specially crafted link, an attacker can exploit this flaw to execute code on that user’s computer. By default, the attacker would only execute code with that user’s privileges.

• CoreGraphics code execution vulnerability. CoreGraphics is a OS X framework that helps developers display different types of graphics on an OS X computer. CoreGraphics suffers from a what Apple calls a uninitialized variable issue having to do with the way it handles PDF documents. By tricking one of your users into downloading and viewing a malicious PDF document, an attacker can exploit this flaw to execute code on that user’s computer. By default, the attacker would only execute code with that user’s privileges.

Apple’s alert includes many, many more flaws, including other code execution flaws in addition to those described above. The remaining vulnerabilities also include Denial of Service (DoS) flaws, elevation of privilege flaws, and information disclosure vulnerabilities, plus others. Components patched by this security update include:

Please refer to Apple’s alert for more details.

If you manage OS X machines, we highly recommend you apply this update right away.

Solution Path:

Apple has released OS X Security Update 2008-003 / OS X 10.5.3 to fix all these security issues. OS X administrators should download, test, and deploy the corresponding update as soon as they can.

• Security Update 2008-003 (PPC)
• Security Update 2008-003 (Intel)
• Security Update 2008-003 Server (PPC)
• Security Update 2008-003 Server (Universal)
• Security Update OS X 10.5.3 (Leopard)
• Security Update OS X 10.5.3 Combo Update (Leopard)

Note: If you have trouble figuring out which of these patches corresponds to your version of OS X, we recommend that you let OS X’s Software Update utility pick the correct update for you automatically.

For All Users:

These flaws enable many diverse exploitation methods. Some of the exploits are local, meaning that your perimeter firewall never encounters the attack (unless you use firewalls internally between departments). Installing these updates, therefore, is the most secure course of action.

Status:

Apple has released updates to fix these issues.

References:

Apple’s May OS X Advisory