Severity:High
1 August, 2008
Summary:
§ These vulnerabilities affect: OS X 10.4.x (Tiger) and OS X 10.5.x (Leopard), both client and server versions
§ How an attacker exploits them: Multiple vectors of attack, including enticing one of your users into visiting a malicious web site or into downloading a malicious document
§ Impact: Various results; in the worst case, attacker executes code on your user’s computer, potentially gaining full control of it
§ What to do: OS X administrators should download, test and install Security Update 2008-005
Severity:High
1 August, 2008
Summary:
§ These vulnerabilities affect: OS X 10.4.x (Tiger) and OS X 10.5.x (Leopard), both client and server versions
§ How an attacker exploits them: Multiple vectors of attack, including enticing one of your users into visiting a malicious web site or into downloading a malicious document
§ Impact: Various results; in the worst case, attacker executes code on your user’s computer, potentially gaining full control of it
§ What to do: OS X administrators should download, test and install Security Update 2008-005
Exposure:
Late yesterday, Apple released a security update to fix vulnerabilities in OS X. The update fixes around 17 (number based on CVE-IDs) security issues in many software packages that ship as part of OS X, including BIND, CoreGraphics, and OpenSSL. Some of these vulnerabilities allow attackers to execute code on your OS X machines, so we rate this update Critical. Apply it as soon as you can. Three of the fixed vulnerabilities include:
§ Two CoreGraphics code execution vulnerabilities. CoreGraphics is an OS X framework that helps developers display different types of graphics on an OS X computer. CoreGraphics suffers from both a buffer overflow vulnerability having to do with the way it handles PDF documents, and a memory corruption vulnerability involving how it handles specially crafted web pages. By luring on of your users to a malicious web site, or tricking that user into downloading and viewing a malicious PDF document, an attacker can exploit either flaw to execute code on that user’s computer. By default, the attacker would only execute code with that user’s privileges. However, other vulnerabilities described in Apple’s Security Update could allow an attacker to elevate his privileges and gain complete control of your user’s Mac.
§ BIND DNS cache poisoning vulnerabilities. In previous alerts [1 / 2 ], we described new vulnerabilities found in the DNS protocol, which attackers could exploit to poison almost any DNS server’s cache — forcing your users to malicious web sites. BIND, the DNS service that ships with OS X, also suffers from these DNS cache poisoning vulnerabilities. Apple’s update incorporates the patches to fix these DNS issues. Keep in mind that researchers have already released exploit code to leverage these serious DNS flaws; so, if you use an OS X machine as a DNS server, you should apply Apple’s update immediately. For more information on these industry-wide DNS issues, listen to this month’s episode of Radio Free Security: Firebox Special.
§ QuickLook code execution vulnerability. QuickLook is an OS X feature that allows you to quickly preview the contents of many documents without actually opening them in separate programs. QuickLook suffers from an unspecified memory corruption vulnerability, having to do with the way it handles specially crafted Microsoft Office files. By enticing one of your users to download and preview a malicious Office document, an attacker can exploit this flaw to execute code on that user’s computer, with that user’s privileges. The attacker could then leverage other vulnerabilities (fixed by this Security Update) to potentially gain complete control of the user’s computer.
Apple’s alert includes many more flaws, including other code execution flaws in addition to those described above. The remaining vulnerabilities also include Denial of Service (DoS) flaws, elevation of privilege flaws, and crash vulnerabilities, plus others. Components patched by this security update include:
| Open Scripting Architecture | BIND |
| CarbonCore | CoreGraphics |
| Data Detectors Engine | Disk Utility |
| OpenLDAP | OpenSSL |
| PHP | QuickLook |
| rsync |
Please refer to Apple’s OS X alert for more details.
Solution Path:
Apple has released OS X Security Update 2008-005 to fix these security issues. OS X administrators should download, test, and deploy the corresponding update as soon as they can.
§ Security Update 2008-005 (PPC)
§ Security Update 2008-005 (Intel)
§ Security Update 2008-005 Server (PPC)
§ Security Update 2008-005 Server (Intel)
§ Security Update 2008-005 (Leopard)
Note: If you have trouble figuring out which of these patches corresponds to your version of OS X and Safari, we recommend that you let OS X’s Software Update utility pick the correct updates for you automatically.
For All Users:
These flaws enable many diverse exploitation methods. Some of the exploits are local, meaning that your perimeter firewall never encounters the attack (unless you use firewalls internally between departments). Installing these updates, therefore, is the most secure course of action.
Status:
Apple has released updates to fix these issues.