RETIRED: Apple Mac OS X 2009-001 Multiple Security Vulnerabilities

BID:33759

Info

RETIRED: Apple Mac OS X 2009-001 Multiple Security Vulnerabilities

Bugtraq ID: 33759
Class: Unknown
CVE:
Remote: Yes
Local: Yes
Published: Feb 12 2009 12:00AM
Updated: Feb 18 2009 04:37PM
Credit: Rosyna of Unsanity, Graham Perrin of CENTRIM, Mark Dalrymple, Lars Haulin, Clint Ruoho of Laconic Security, Billy Rios of Microsoft, Brian Mastenbrook, and the vendor
Vulnerable: Apple Mac OS X Server 10.5.6
Apple Mac OS X Server 10.5.5
Apple Mac OS X Server 10.5.4
Apple Mac OS X Server 10.5.3
Apple Mac OS X Server 10.5.2
Apple Mac OS X Server 10.5.1
Apple Mac OS X Server 10.4.11
Apple Mac OS X Server 10.4.11
Apple Mac OS X Server 10.4.10
Apple Mac OS X Server 10.4.9
Apple Mac OS X Server 10.4.8
Apple Mac OS X Server 10.4.7
Apple Mac OS X Server 10.4.6
Apple Mac OS X Server 10.4.5
Apple Mac OS X Server 10.4.4
Apple Mac OS X Server 10.4.3
Apple Mac OS X Server 10.4.2
Apple Mac OS X Server 10.4.1
Apple Mac OS X Server 10.4
Apple Mac OS X Server 10.5
Apple Mac OS X 10.5.6
Apple Mac OS X 10.5.5
Apple Mac OS X 10.5.4
Apple Mac OS X 10.5.3
Apple Mac OS X 10.5.2
Apple Mac OS X 10.5.1
Apple Mac OS X 10.4.11
Apple Mac OS X 10.4.11
Apple Mac OS X 10.4.10
Apple Mac OS X 10.4.9
Apple Mac OS X 10.4.8
Apple Mac OS X 10.4.7
Apple Mac OS X 10.4.6
Apple Mac OS X 10.4.5
Apple Mac OS X 10.4.4
Apple Mac OS X 10.4.3
Apple Mac OS X 10.4.2
Apple Mac OS X 10.4.1
Apple Mac OS X 10.4
Apple Mac OS X 10.5
Not Vulnerable:

Discussion

RETIRED: Apple Mac OS X 2009-001 Multiple Security Vulnerabilities

Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2009-001.

The security update addresses new vulnerabilities that affect the AFP server, movie playing, Resource Manager, Certificate Assistant, CoreText, 'dscl', Folder Manager, FSEvents, csregprinter, Remote Apple Event Viewer, Safari, Xterm, and SMB components of Mac OS X. The advisory also contains security updates for 32 previously reported issues.

NOTE: The new issues have been covered in the following BIDs to better document them:

33806 Apple Mac OS X Pixlet Video Handling Remote Code Execution Vulnerability
33820 Apple Mac OS X Insecure Downloads Folder Permissions Information Disclosure Vulnerability
33815 Apple Mac OS X 'dscl' Local Information Disclosure Vulnerability
33816 Apple Mac OS X Remote Apple Events Uninitialized Buffer Information Disclosure Vulnerability
33814 Apple Mac OS X Remote Apple Events Out of Bounds Memory Access Security Vulnerability
33813 Apple Mac OS X Server Manager Authentication Bypass Security Vulnerability
33812 Apple Mac OS X AFP Server Remote Denial of Service Vulnerability
33810 Apple Mac OS X Certificate Assistant Insecure Temporary File Creation Vulnerability
33811 Apple Mac OS X 'csregprinter' Local Privilege Escalation Vulnerability
33808 Apple Mac OS X Resource Manager Remote Code Execution Vulnerability
33809 Apple Mac OS X CoreText Unicode String Handling Heap Based Buffer Overflow Vulnerability
33800 Apple Mac OS X SMB Component Unspecified Buffer Overflow Vulnerability
33798 Apple Mac OS X Xterm Local Privilege Escalation Vulnerability
33796 Apple Mac OS X SMB File System Remote Denial Of Service Vulnerability
33234 Apple Safari 'feed:' URI Multiple Input Validation Vulnerabilities
33821 Apple Mac OS X 'FSEvents' Local Information Disclosure Vulnerabilit

Exploit / POC

RETIRED: Apple Mac OS X 2009-001 Multiple Security Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NOTE: Some of these issues will not require specific exploit code and may be trivial to exploit.

Solution / Fix

RETIRED: Apple Mac OS X 2009-001 Multiple Security Vulnerabilities

Solution:
The vendor has released an advisory and updates to address these issues. Please see the references for more information.


Apple Mac OS X Server 10.4.11

Apple Mac OS X 10.4.11

Apple Mac OS X 10.5.6

Apple Mac OS X Server 10.5.6

References

RETIRED: Apple Mac OS X 2009-001 Multiple Security Vulnerabilities

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report