Apple Mac OS X Install Helper Arbitrary Agent Installation Input Validation Vulnerability

Bugtraq ID:	47023
Class:	Input Validation Error
CVE:	CVE-2011-0190
Remote:	Yes
Local:	No
Published:	Mar 21 2011 12:00AM
Updated:	Mar 19 2015 08:12AM
Credit:	Aaron Sigel of vtty.com
Vulnerable:	Apple Mac OS X Server 10.6.6 Apple Mac OS X Server 10.6.5 Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.6 Apple Mac OS X 10.6.5 Apple Mac OS X 10.6.4 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.6
Not Vulnerable:	Apple Mac Os X Server 10.6.7

Apple Mac OS X Install Helper Arbitrary Agent Installation Input Validation Vulnerability

Apple Mac OS X is prone to a vulnerability that affects URI processing in Install Helper.

Exploiting this issue can allow attackers to provide unexpected input and possibly bypass input-validation protection mechanisms, leading to the installation of an agent that contacts an arbitrary server. Users may have a false sense of security, believing that the agent contacts Apple, not an arbitrary domain.

Mac OS X 10.6 through 10.6.6 and Mac OS X Server 10.6 through 10.6.6 are vulnerable.

NOTE: This issue was previously discussed in BID 46950 (Apple Mac OS X Prior to 10.6.7 Multiple Security Vulnerabilities) but has been given its own record to better document it.

Apple Mac OS X Install Helper Arbitrary Agent Installation Input Validation Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to visit a specially crafted website.

Apple Mac OS X Install Helper Arbitrary Agent Installation Input Validation Vulnerability

Solution:
Updates are available. Please see the references for more information.


Apple Mac OS X 10.6

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6

• Apple MacOSXServerUpdCombo10.6.7.dmg
  For Mac OS X Server v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.1

• Apple MacOSXServerUpdCombo10.6.7.dmg
  For Mac OS X Server v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.1

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.2

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.2

• Apple MacOSXServerUpdCombo10.6.7.dmg
  For Mac OS X Server v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.3

• Apple MacOSXServerUpdCombo10.6.7.dmg
  For Mac OS X Server v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.3

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.4

• Apple MacOSXServerUpdCombo10.6.7.dmg
  For Mac OS X Server v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.4

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.5

• Apple MacOSXServerUpdCombo10.6.7.dmg
  For Mac OS X Server v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.5

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.6

• Apple MacOSXServerUpd10.6.7.dmg
  For Mac OS X Server v10.6.6
  http://www.apple.com/support/downloads/

Apple Mac OS X Install Helper Arbitrary Agent Installation Input Validation Vulnerability

References:

• Mac OS X Homepage (Apple)