Apple Mac OS X Preview PDF Insecure Encryption Weakness

Bugtraq ID:	28386
Class:	Design Error
CVE:	CVE-2008-0994
Remote:	Yes
Local:	No
Published:	Mar 21 2008 12:00AM
Updated:	Mar 24 2008 05:00PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5
Not Vulnerable:

Apple Mac OS X Preview PDF Insecure Encryption Weakness

Apple Mac OS X is prone to a weakness that stems from the use of an insecure encryption algorithm.

Attackers can use trivial brute-force tactics to view data that was encrypted with the insecure algorithm. Information harvested may aid in further attacks.

NOTE: This vulnerability was previously covered in BID 28304 (Apple Mac OS X 2008-002 Multiple Security Vulnerabilities), but has been given its own record to better document the issue.

Apple Mac OS X Preview PDF Insecure Encryption Weakness

Attackers can use trivial brute-force tactics to launch attacks.

Apple Mac OS X Preview PDF Insecure Encryption Weakness

Solution:
The vendor released an advisory and fixes. Please see the references for more information.


Apple Mac OS X 10.5.2

• Apple SecUpd2008-002.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpd2008-002.dmg

Apple Mac OS X Server 10.5.2

• Apple SecUpdSrvr2008-002.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpdSrvr2008-002.dmg

Apple Mac OS X Preview PDF Insecure Encryption Weakness

References:

• Cisco TelePresence Video Communication Server (VCS) Homepage (Cisco)