Apple Mac OS X Pre 10.4.8 Multiple Security Vulnerabilities

Bugtraq ID:	20271
Class:	Unknown
CVE:	CVE-2006-4387 CVE-2006-4390 CVE-2006-4391 CVE-2006-4392 CVE-2006-4393 CVE-2006-4394 CVE-2006-4395 CVE-2006-4397 CVE-2006-4399
Remote:	Yes
Local:	Yes
Published:	Sep 29 2006 12:00AM
Updated:	Oct 03 2006 06:30PM
Credit:	The vendor credits Adam Bryzak of Queensland University of Technology, Tom Saxton of Idle Loop Software Design, Dino Dai Zovi of Matasano Security, Patrick Gallagher of Digital Peaks Corporation, Ragnar Sundblad of the Royal Institute of Technology, Stockh
Vulnerable:	Cosmicperl Directory Pro 10.0.3 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.3.9 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X Server 10.2.8 Apple Mac OS X Server 10.2.7 Apple Mac OS X Server 10.2.6 Apple Mac OS X Server 10.2.5 Apple Mac OS X Server 10.2.4 Apple Mac OS X Server 10.2.3 Apple Mac OS X Server 10.2.2 Apple Mac OS X Server 10.2.1 Apple Mac OS X Server 10.2 Apple Mac OS X Server 10.1.5 Apple Mac OS X Server 10.1.4 Apple Mac OS X Server 10.1.3 Apple Mac OS X Server 10.1.2 Apple Mac OS X Server 10.1.1 Apple Mac OS X Server 10.1 Apple Mac OS X Server 10.0 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.3.9 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 Apple Mac OS X 10.2.8 Apple Mac OS X 10.2.7 Apple Mac OS X 10.2.6 Apple Mac OS X 10.2.5 Apple Mac OS X 10.2.4 Apple Mac OS X 10.2.3 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2 Apple Mac OS X 10.1.5 Apple Mac OS X 10.1.4 Apple Mac OS X 10.1.3 Apple Mac OS X 10.1.2 Apple Mac OS X 10.1.1 Apple Mac OS X 10.1 Apple Mac OS X 10.1 Apple Mac OS X 10.0.4 Apple Mac OS X 10.0.3 Apple Mac OS X 10.0.2 Apple Mac OS X 10.0.1 Apple Mac OS X 10.0 3 Apple Mac OS X 10.0
Not Vulnerable:	Apple Mac OS X Server 10.4.8 Apple Mac OS X 10.4.8

Apple Mac OS X Pre 10.4.8 Multiple Security Vulnerabilities

Apple Mac OS X is prone to multiple security vulnerabilities.

These issue affect Mac OS X and various applications including CFNetwork, Safari, Kernel, ImageIO, LoginWindow, System Preferences, QuickDraw Manager, and Workgroup Manager. An attacker can exploit these issues to execute arbitrary code, gain elevated privileges, cause denial-of-service conditions, and gain unauthorized access.

Apple Mac OS X versions prior to 10.4.8 are vulnerable to these issues.

Apple Mac OS X Pre 10.4.8 Multiple Security Vulnerabilities

An exploit is available for the Mach exception-ports issue.

Note that some of these issues may not require specific exploit code.

• /data/vulnerabilities/exploits/20271_exploit.c.txt
• /data/vulnerabilities/exploits/20271_exploit.c_patch.txt

Apple Mac OS X Pre 10.4.8 Multiple Security Vulnerabilities

Solution:
The vendor has released Mac OS X 10.4.8 to address these issues.

Please see the referenced advisories for more information.


Apple Mac OS X Server 10.3.9

• Apple SecUpdSrvr2006-006Pan.dmg
  Security Update 2006-006 (10.3.9 Server)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11770&cat= 1&platform=osx&method=sa/SecUpdSrvr2006-006Pan.dmg

Apple Mac OS X 10.3.9

• Apple SecUpd2006-006Pan.dmg
  Security Update 2006-006 (10.3.9 Client)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11769&cat= 1&platform=osx&method=sa/SecUpd2006-006Pan.dmg

Apple Mac OS X 10.4

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X Server 10.4

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X Server 10.4.1

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X 10.4.1

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X 10.4.2

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X Server 10.4.2

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X Server 10.4.3

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X 10.4.3

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X Server 10.4.4

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg


• Apple Mac OS X Server 10.4.8 Combo Update (PPC)
  PPC
  http://www.apple.com/support/downloads/macosxserver1048comboupdateppc. html

Apple Mac OS X 10.4.4

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg


• Apple Mac OS X 10.4.8 Combo Update (Intel)
  Intel
  http://www.apple.com/support/downloads/macosx1048comboupdateintel.html

Apple Mac OS X Server 10.4.5

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg


• Apple Mac OS X Server 10.4.8 Combo Update (PPC)
  PPC
  http://www.apple.com/support/downloads/macosxserver1048comboupdateppc. html

Apple Mac OS X 10.4.5

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg


• Apple Mac OS X 10.4.8 Combo Update (Intel)
  Intel
  http://www.apple.com/support/downloads/macosx1048comboupdateintel.html

Apple Mac OS X Server 10.4.6

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg


• Apple Mac OS X Server 10.4.8 Combo Update (PPC)
  PPC
  http://www.apple.com/support/downloads/macosxserver1048comboupdateppc. html

Apple Mac OS X 10.4.6

• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg


• Apple Mac OS X 10.4.8 Combo Update (Intel)
  Intel
  http://www.apple.com/support/downloads/macosx1048comboupdateintel.html

Apple Mac OS X Server 10.4.7

• Apple MacOSXUpd10.4.8Intel.dmg
  Mac OS X 10.4.8 Update (Intel)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11796&cat= 1&platform=osx&method=sa/MacOSXUpd10.4.8Intel.dmg


• Apple MacOSXUpd10.4.8PPC.dmg
  Mac OS X 10.4.8 Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11794&cat= 1&platform=osx&method=sa/MacOSXUpd10.4.8PPC.dmg


• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg


• Apple Mac OS X Server 10.4.8 Update (PPC)
  PPC
  http://www.apple.com/support/downloads/macosxserver1048updateppc.html


• Apple Mac OS X Server 10.4.8 Update (Universal)
  PPC
  http://www.apple.com/support/downloads/macosxserver1048updateuniversal .html

Apple Mac OS X 10.4.7

• Apple MacOSXUpd10.4.8Intel.dmg
  Mac OS X 10.4.8 Update (Intel)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11796&cat= 1&platform=osx&method=sa/MacOSXUpd10.4.8Intel.dmg


• Apple MacOSXUpd10.4.8PPC.dmg
  Mac OS X 10.4.8 Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11794&cat= 1&platform=osx&method=sa/MacOSXUpd10.4.8PPC.dmg


• Apple MacOSXUpdCombo10.4.8PPC.dmg
  Mac OS X 10.4.8 Combo Update (PPC)
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=11795&cat= 1&platform=osx&method=sa/MacOSXUpdCombo10.4.8PPC.dmg

Apple Mac OS X Pre 10.4.8 Multiple Security Vulnerabilities

References:

• About the security content of the Mac OS X 10.4.8 Update and Security Update 200 (Apple)
  
• Mac OS X Homepage (Apple)
  
• TA06-275A - Multiple Vulnerabilities in Apple and Adobe Products (US-CERT)
  
• Matasano Advisory: MacOS X Mach Exception Server Privilege Escalation (Matasano)