WatchGuard Live Security: Malicious Images Help Attackers Hack OS X

Severity: High

15 September, 2008

Summary:

§ These vulnerabilities affect: OS X 10.4.x (Tiger) and OS X 10.5.x (Leopard), both client and server versions

§ How an attacker exploits them: Multiple vectors of attack, including enticing one of your users into downloading and viewing malicious images, documents, or email

§ Impact: Various results; in the worst case, attacker executes code on your user’s computer, potentially gaining full control of it

§ What to do: OS X administrators should download, test and install Security Update 2008-006 or the OS X 10.5.5 update

Severity: High

15 September, 2008

Summary:

§ These vulnerabilities affect: OS X 10.4.x (Tiger) and OS X 10.5.x (Leopard), both client and server versions

§ How an attacker exploits them: Multiple vectors of attack, including enticing one of your users into downloading and viewing malicious images, documents, or email

§ Impact: Various results; in the worst case, attacker executes code on your user’s computer, potentially gaining full control of it

§ What to do: OS X administrators should download, test and install Security Update 2008-006 or the OS X 10.5.5 update

Exposure:

Today, Apple released a security update to fix vulnerabilities in OS X. The update fixes around 35 (number based on CVE-IDs) security issues in many software packages that ship as part of OS X, including BIND, Finder, and Time Machine. Some of these vulnerabilities allow attackers to execute code on your OS X machines, so we rate this update Critical. Apply it as soon as you can. Three of the fixed vulnerabilities include:

§ Apple Type Service buffer overflow vulnerability. The Apple Type Service (ATS) helps OS X machines handle fonts. ATS suffers from a buffer overflow vulnerability having to do with the way it handles PostScript font names. By tricking one of your users into downloading and viewing a malicious document containing a specially crafted font, an attacker can exploit this flaw to execute code on that user’s computer. By default, the attacker would only execute code with that user’s privileges.

§ Multiple ClamAV vulnerabilities. Apple’s OS X update fixes nine unspecified vulnerabilities in ClamAV, the open source antivirus package that ships with OS X Server. According to Apple, the most serious of these vulnerabilities allows an attacker to execute arbitrary code on your OS X server. We assume an attacker would exploit this flaw by sending one of your users a specially crafted email, or more specifically, an email with a maliciously crafted attachment.

§ Multiple ImageIO vulnerabilities. ImageIO is one of the OS X framework components that helps the operating system handle images. ImageIO suffers from three memory corruption vulnerabilities involving the way it handles both TIFF and JPEG images. By enticing one of your users to view a maliciously crafted image, an attacker can exploit any of these flaws to execute code on that user’s computer, with that user’s privileges. Since OS X separates the user account from the root (administrator) account, the attacker would only gain the privileges of that user.

Apple’s alert includes many more flaws, including other code execution flaws in addition to those described above. The remaining vulnerabilities also include Denial of Service (DoS) flaws, information disclosure flaws and crash vulnerabilities, plus others. The update also corrects some performance issues. Components patched by this security update include:

Please refer to Apple’s OS X alert for more details.

Solution Path:

Apple has released OS X Security Update 2008-006 and OS X 10.5.5 to fix these security issues. OS X administrators should download, test, and deploy the corresponding update as soon as they can.

§ Security Update 2008-006 (PPC)

§ Security Update 2008-006 (Intel)

§ Security Update 2008-006 Server (PPC)

§ Security Update 2008-006 Server (Universal)

§ Security Update OS X 10.5.5

§ Security Update OS X 10.5.5 Combo Update

§ Security Update OS X Server 10.5.5

§ Security Update OS X Server 10.5.5 Combo Update

Note: If you have trouble figuring out which of these patches corresponds to your version of OS X and Safari, we recommend that you let OS X’s Software Update utility pick the correct updates for you automatically.

For All Users:

These flaws enable many diverse exploitation methods. Some of the exploits are local, meaning that your perimeter firewall never encounters the attack (unless you use firewalls internally between departments). Installing these updates, therefore, is the most secure course of action.

Status:

Apple has released updates to fix these issues.

References:

Apple’s September OS X Advisory