Apple Mac OS X CFNetwork (CVE-2010-1834) Security Vulnerability

Bugtraq ID:	44811
Class:	Unknown
CVE:	CVE-2010-1834
Remote:	Yes
Local:	No
Published:	Nov 10 2010 12:00AM
Updated:	Nov 12 2010 09:27PM
Credit:	Apple.
Vulnerable:	Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.6 Apple Mac OS X 10.6.4 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.6
Not Vulnerable:	Apple Mac OS X Server 10.6.5

Apple Mac OS X CFNetwork (CVE-2010-1834) Security Vulnerability

Apple Mac OS X is prone to a security vulnerability in the CFNetwork component.

Specifically, the application allows cookies to be set with a partial IP.

This issue affects Mac OS X 10.6 to 10.6.4 and Mac OS X Server 10.6 to 10.6.4.

NOTE: This issue was previously covered in BID 44778 (Apple Mac OS X Prior to 10.6.5 Multiple Security Vulnerabilities), but has been given its own record to better document it.

Apple Mac OS X CFNetwork (CVE-2010-1834) Security Vulnerability

Attackers can exploit this issue using readily available tools.

Apple Mac OS X CFNetwork (CVE-2010-1834) Security Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for details.


Apple Mac OS X 10.6

• Apple MacOSXUpdCombo10.6.5.dmg
  For Mac OS X v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6

• Apple MacOSXServUpdCombo10.6.5.dmg
  For Mac OS X Server v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.1

• Apple MacOSXServUpdCombo10.6.5.dmg
  For Mac OS X Server v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.1

• Apple MacOSXUpdCombo10.6.5.dmg
  For Mac OS X v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.2

• Apple MacOSXUpdCombo10.6.5.dmg
  For Mac OS X v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.2

• Apple MacOSXServUpdCombo10.6.5.dmg
  For Mac OS X Server v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.3

• Apple MacOSXServUpdCombo10.6.5.dmg
  For Mac OS X Server v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.3

• Apple MacOSXUpdCombo10.6.5.dmg
  For Mac OS X v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.4

• Apple MacOSXServerUpd10.6.5.dmg
  For Mac OS X Server v10.6.4
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.4

• Apple MacOSXUpd10.6.5.dmg
  For Mac OS X v10.6.4
  http://www.apple.com/support/downloads/

Apple Mac OS X CFNetwork (CVE-2010-1834) Security Vulnerability

References:

• Mac OS X Homepage (Apple)
  
• APPLE-SA-2010-11-10-1 Mac OS X v10.6.5 and Security Update 2010-007 (Apple)