xar Package Signature Validation Remote Security Bypass Vulnerability
BID:39292
Info
xar Package Signature Validation Remote Security Bypass Vulnerability
| Bugtraq ID: | 39292 |
| Class: | Design Error |
| CVE: |
CVE-2010-0055 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 29 2010 12:00AM |
| Updated: | Apr 13 2015 10:24PM |
| Credit: | Braden Thomas of the Apple Security Team |
| Vulnerable: |
xar xar 1.5.2 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5 |
| Not Vulnerable: |
xar xar 1.5.3 |
Discussion
xar Package Signature Validation Remote Security Bypass Vulnerability
xar (eXtensible ARchiver) is prone to a security-bypass vulnerability because it fails to properly verify signatures in a modified xar archive.
Attackers can exploit this issue to make modified archives appear to have a valid signature. This may lead to other attacks.
Versions prior to xar 1.5.3 are vulnerable.
NOTE: This issue was previously covered in BID 39020 (Apple Mac OS X APPLE-SA-2010-03-29-1 Multiple Security Vulnerabilities) but has been assigned its own record to better document it.
xar (eXtensible ARchiver) is prone to a security-bypass vulnerability because it fails to properly verify signatures in a modified xar archive.
Attackers can exploit this issue to make modified archives appear to have a valid signature. This may lead to other attacks.
Versions prior to xar 1.5.3 are vulnerable.
NOTE: This issue was previously covered in BID 39020 (Apple Mac OS X APPLE-SA-2010-03-29-1 Multiple Security Vulnerabilities) but has been assigned its own record to better document it.
Exploit / POC
xar Package Signature Validation Remote Security Bypass Vulnerability
Attackers can use readily available utilities to exploit this issue.
Attackers can use readily available utilities to exploit this issue.
Solution / Fix
xar Package Signature Validation Remote Security Bypass Vulnerability
Solution:
Updates are available. Please see the references for details.
Apple Mac OS X Server 10.5
Apple Mac OS X 10.5
Apple Mac OS X 10.5.1
Apple Mac OS X Server 10.5.1
Apple Mac OS X 10.5.2
Apple Mac OS X Server 10.5.2
Apple Mac OS X 10.5.3
Apple Mac OS X Server 10.5.3
Apple Mac OS X 10.5.4
Apple Mac OS X Server 10.5.4
Apple Mac OS X Server 10.5.5
Apple Mac OS X 10.5.5
Apple Mac OS X 10.5.6
Apple Mac OS X Server 10.5.6
Apple Mac OS X Server 10.5.7
Apple Mac OS X 10.5.7
Apple Mac OS X Server 10.5.8
Apple Mac OS X 10.5.8
Solution:
Updates are available. Please see the references for details.
Apple Mac OS X Server 10.5
-
Apple SecUpdSrvr2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X 10.5
-
Apple SecUpd2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X 10.5.1
-
Apple SecUpd2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.5.1
-
Apple SecUpdSrvr2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X 10.5.2
-
Apple SecUpd2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.5.2
-
Apple SecUpdSrvr2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X 10.5.3
-
Apple SecUpd2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.5.3
-
Apple SecUpdSrvr2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X 10.5.4
-
Apple SecUpd2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.5.4
-
Apple SecUpdSrvr2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.5.5
-
Apple SecUpdSrvr2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X 10.5.5
-
Apple SecUpd2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X 10.5.6
-
Apple SecUpd2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.5.6
-
Apple SecUpdSrvr2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.5.7
-
Apple SecUpdSrvr2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X 10.5.7
-
Apple SecUpd2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.5.8
-
Apple SecUpdSrvr2010-002Leo.dmg
http://www.apple.com/support/downloads/
Apple Mac OS X 10.5.8
-
Apple SecUpd2010-002Leo.dmg
http://www.apple.com/support/downloads/
References
xar Package Signature Validation Remote Security Bypass Vulnerability
References:
References:
- #572556 CVE-2010-0055: Signature verification bypass (Moritz Muehlenhoff)
- Cisco TelePresence Video Communication Server (VCS) Homepage (Cisco)
- Issue 73: SECURITY: please release 1.5.3 (CVE-2010-0055: Signature verificati (Jari Aalto)
- xar Homepage (xar)