Apple Mac OS X Multiple Vulnerabilities
BID:13480
Info
Apple Mac OS X Multiple Vulnerabilities
| Bugtraq ID: | 13480 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | May 03 2005 12:00AM |
| Updated: | May 03 2005 12:00AM |
| Credit: | Discovery of the htdigest issue is credited to JxT of SNOsoft, the Cocoa NXSeek issue is credited to Henrik Dalgaard of Echo One. The Terminal, 'applescript: URI', and Help Viewer issues are credited to David Remahl. The Bluetooth issues are credited to Ke |
| Vulnerable: |
Apple Mac OS X Server 10.3.9 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X 10.3.9 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 |
| Not Vulnerable: | |
Discussion
Apple Mac OS X Multiple Vulnerabilities
Multiple security vulnerabilities are reported to affect Apple Mac OS X. These issues were disclosed in the referenced vendor advisory.
Apache htdigest is prone to a buffer overflow that could be leveraged through a CGI application.
Appkit is prone to an integer overflow when handling TIFF files.
Appkit is also prone to a denial of service due to an unhandled exception in NXSeek().
AppleScript is prone to a code obfuscation issue.
The Bluetooth file exchange service may allow downloaded files to be disclosed.
Bluetooth is also prone to a directory traversal vulnerability.
chfn/chpass/chsh programs could allow privilege escalation.
Finder handles .DS_Store files in an insecure manner that could allow local attackers to overwrite files and allow privilege escalation.
The Foundation framework is prone to a buffer overflow in environmental variables.
The Help Viewer is prone to a cross-zone scripting vulnerability.
LDAP allows passwords to initially be stored in plain text when using an LDAP server not running on OS X.
The XFree86 libXpm library is prone to a stack overflow when parsing malformed image files.
The XFree86 libXpm library also contains multiple routines that are prone to integer overflows.
lukemftpd could allow authenticated users to escape chroot.
The NetInfo Setup Tool (NeST) is prone to a buffer overflow.
When the HTTP proxy service is enabled through Server Admin, it is also available for users outside the local network.
Sudo versions prior to 1.6.8p2 do not adequately sanitize their environments.
Terminal allows malicious content to inject data when it is displayed.
Terminal also allows escape characters embedded in x-man-path URI's to insert commands into a Terminal session.
vpnd is prone to a buffer overflow that could allow a local user to obtain root privileges.
Multiple security vulnerabilities are reported to affect Apple Mac OS X. These issues were disclosed in the referenced vendor advisory.
Apache htdigest is prone to a buffer overflow that could be leveraged through a CGI application.
Appkit is prone to an integer overflow when handling TIFF files.
Appkit is also prone to a denial of service due to an unhandled exception in NXSeek().
AppleScript is prone to a code obfuscation issue.
The Bluetooth file exchange service may allow downloaded files to be disclosed.
Bluetooth is also prone to a directory traversal vulnerability.
chfn/chpass/chsh programs could allow privilege escalation.
Finder handles .DS_Store files in an insecure manner that could allow local attackers to overwrite files and allow privilege escalation.
The Foundation framework is prone to a buffer overflow in environmental variables.
The Help Viewer is prone to a cross-zone scripting vulnerability.
LDAP allows passwords to initially be stored in plain text when using an LDAP server not running on OS X.
The XFree86 libXpm library is prone to a stack overflow when parsing malformed image files.
The XFree86 libXpm library also contains multiple routines that are prone to integer overflows.
lukemftpd could allow authenticated users to escape chroot.
The NetInfo Setup Tool (NeST) is prone to a buffer overflow.
When the HTTP proxy service is enabled through Server Admin, it is also available for users outside the local network.
Sudo versions prior to 1.6.8p2 do not adequately sanitize their environments.
Terminal allows malicious content to inject data when it is displayed.
Terminal also allows escape characters embedded in x-man-path URI's to insert commands into a Terminal session.
vpnd is prone to a buffer overflow that could allow a local user to obtain root privileges.
Exploit / POC
Apple Mac OS X Multiple Vulnerabilities
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Apple Mac OS X Multiple Vulnerabilities
Solution:
Apple has released advisory (APPLE-SA-2005-05-03) to address various issues. Please see the referenced advisory for more information.
Apple Mac OS X 10.3.9
Apple Mac OS X Server 10.3.9
Solution:
Apple has released advisory (APPLE-SA-2005-05-03) to address various issues. Please see the referenced advisory for more information.
Apple Mac OS X 10.3.9
-
Apple SecUpd2005-005Pan.dmg
http://www.apple.com/support/downloads/securityupdate2005005client.htm l
Apple Mac OS X Server 10.3.9
-
Apple SecUpdSrvr2005-005Pan.dmg
http://www.apple.com/support/downloads/securityupdate2005005server.htm l