RETIRED: Apple Mac OS X 2009-005 Multiple Security Vulnerabilities

Bugtraq ID:	36349
Class:	Unknown
CVE:
Remote:	Yes
Local:	Yes
Published:	Sep 10 2009 12:00AM
Updated:	Sep 11 2009 02:31PM
Credit:	Apple, Will Dormann of CERT/CC, J. David Hester of LCG Systems National Institutes of Health
Vulnerable:	Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.10 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.4.11 Apple Mac OS X 10.4.11 Apple Mac OS X 10.4.10 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.5
Not Vulnerable:

RETIRED: Apple Mac OS X 2009-005 Multiple Security Vulnerabilities

Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2009-005.

The update addresses new vulnerabilities that affect Alias Manager, CarbonCore, ColorSync, CoreGraphics, ImageIO, Launch Services, SMB, and Wiki Server.

NOTE: This BID is being retired. The following individual records have been created to better document these issues:

36354 Apple Mac OS X Alias Manager Buffer Overflow Vulnerability
36355 Apple Mac OS X CarbonCore Memory Corruption Vulnerability
36357 Apple Mac OS X ColorSync Heap Based Buffer Overflow Vulnerability
36358 Apple Mac OS X CoreGraphics Heap Based Buffer Overflow Vulnerability
36359 Apple Mac OS X ImageIO Multiple Memory Corruption Vulnerabilities
36360 Apple Mac OS X Launch Services Security Bypass Vulnerability
36361 Apple Mac OS X Launch Services Remote Code Execution Vulnerability
36363 Apple Mac OS X SMB Security Bypass Vulnerability
36364 Apple Mac OS X Wiki Server Cross Site Scripting Vulnerability

RETIRED: Apple Mac OS X 2009-005 Multiple Security Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NOTE: Some of these issues will not require specific exploit code and may be trivial to exploit.

RETIRED: Apple Mac OS X 2009-005 Multiple Security Vulnerabilities

Solution:
The vendor has released an advisory and updates. Please see the references for details.


Apple Mac OS X Server 10.4.11

• Apple SecUpdSrvr2009-005PPC.dmg
  PPC
  http://www.apple.com/support/downloads/


• Apple SecUpdSrvr2009-005Univ.dmg
  Universal
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.4.11

• Apple SecUpd2009-005Intel.dmg
  Intel
  http://www.apple.com/support/downloads/


• Apple SecUpd2009-005PPC.dmg
  PPC
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.5.8

• Apple SecUpdSrvr2009-005.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.5.8

• Apple SecUpd2009-005.dmg
  http://www.apple.com/support/downloads/

RETIRED: Apple Mac OS X 2009-005 Multiple Security Vulnerabilities

References:

• Mac OS X Homepage (Apple)