Apple iCal Calendar Import Alarm Notification Failure Vulnerability

Bugtraq ID:	11728
Class:	Design Error
CVE:	CVE-2004-1021
Remote:	Yes
Local:	No
Published:	Nov 22 2004 12:00AM
Updated:	Jul 12 2009 08:06AM
Credit:	This vulnerability was announced by the vendor.
Vulnerable:	Apple iCal 1.5.3 + Apple Mac OS X 10.3.5 + Apple Mac OS X 10.3.4 + Apple Mac OS X 10.3.3 + Apple Mac OS X 10.3.2 + Apple Mac OS X 10.3.1 + Apple Mac OS X 10.3 + Apple Mac OS X 10.2.8 + Apple Mac OS X 10.2.7 + Apple Mac OS X 10.2.6 + Apple Mac OS X 10.2.5 + Apple Mac OS X 10.2.4 + Apple Mac OS X 10.2.3 + Apple Mac OS X Server 10.3.5 + Apple Mac OS X Server 10.3.4 + Apple Mac OS X Server 10.3.3 + Apple Mac OS X Server 10.3.2 + Apple Mac OS X Server 10.3.1 + Apple Mac OS X Server 10.3 + Apple Mac OS X Server 10.2.8 + Apple Mac OS X Server 10.2.7 + Apple Mac OS X Server 10.2.6 + Apple Mac OS X Server 10.2.5 + Apple Mac OS X Server 10.2.4 + Apple Mac OS X Server 10.2.3
Not Vulnerable:	Apple iCal 1.5.4

Apple iCal Calendar Import Alarm Notification Failure Vulnerability

It is reported that when importing an Apple iCal calendar, iCal fails to warn an end user if the calendar contains an alarm. This may result in a victim importing a calendar that is believed to be safe when in reality the calendar contains malicious alarm entries.

Apple iCal Calendar Import Alarm Notification Failure Vulnerability

No exploit is required.

Apple iCal Calendar Import Alarm Notification Failure Vulnerability

Solution:
The vendor has released an advisory (APPLE-SA-2004-11-22) and an updated to address this issue:


Apple iCal 1.5.3

• Apple iCal154.dmg
  http://www.apple.com/ical/download/

Apple iCal Calendar Import Alarm Notification Failure Vulnerability

References:

• iCal Homepage (Apple)