RETIRED: Apple Mac OS X Prior to 10.7.3 Multiple Security Vulnerabilities

Bugtraq ID:	51798
Class:	Unknown
CVE:
Remote:	Yes
Local:	Yes
Published:	Feb 01 2012 12:00AM
Updated:	Mar 19 2015 09:27AM
Credit:	Bernard Desruisseaux of Oracle Corporation, Anonymous, Erling Ellingsen of Facebook, Scott Stender of iSEC Partners, Will Dormann of the CERT/CC, Ben Syverson, Ilja van Sprundel of IOActive, Chris Evans of the Google Chrome Security Team, Luigi Auriemma, a
Vulnerable:	Apple Mac OS X Server 10.6.6 Apple Mac OS X Server 10.6.5 Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac Os X Server 10.7.2 Apple Mac Os X Server 10.7.1 Apple Mac Os X Server 10.7 Apple Mac Os X Server 10.6.8 Apple Mac Os X Server 10.6.7 Apple Mac OS X Server 10.6 Apple Mac OS X 10.6.5 Apple Mac OS X 10.6.4 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac Os X 10.7.2 Apple Mac Os X 10.7.1 Apple Mac OS X 10.6
Not Vulnerable:	Apple Mac Os X Server 10.7.3 Apple Mac Os X 10.7.3

RETIRED: Apple Mac OS X Prior to 10.7.3 Multiple Security Vulnerabilities

Apple Mac OS X is prone to multiple security vulnerabilities that have been addressed in Security Update 2012-001.

The update addresses new vulnerabilities that affect Address Book, CFNetwork, CoreMedia, CoreText, CoreUI, libresolv, OpenGL, Internet Sharing, Kernel, Time Machine, QuickTime, and WebDAV.

These issues affect OS X prior to 10.7.3.

This BID is being retired. The following individual records exist to better document the issues:

51807 Apple Mac OS X CVE-2011-3453 Integer Overflow Vulnerability
51808 Apple Mac OS X CVE-2011-3457 Multiple Memory Corruption Vulnerabilities
51809 Apple Mac OS X CVE-2011-3458 Remote Code Execution Vulnerability
51810 Apple Mac OS X 'Address Book' Component CVE-2011-3444 Information Disclosure Vulnerability
51811 Apple Mac OS X CVE-2011-3459 Remote Code Execution Vulnerability
51812 Apple Mac OS X Prior To 10.7.3 CoreText Use After Free Code Execution Vulnerability
51813 Apple Mac OS X CFNetwork Component CVE-2011-3447 Information Disclosure Vulnerability
51814 Apple Mac OS X CVE-2011-3460 Buffer Overflow Vulnerability
51815 Apple Mac OS X CVE-2011-3450 CoreUI Remote Code Execution Vulnerability
51816 Apple Mac OS X CVE-2011-3463 Local Privilege Escalation Vulnerability
51817 Apple Mac OS X CoreMedia Component CVE-2011-3448 Heap Based Buffer Overflow Vulnerability
51818 Apple Mac OS X CVE-2011-3462 Security Bypass Vulnerability
51819 Apple Mac OS X CVE-2011-3452 Internet Sharing Security Bypass Vulnerability

RETIRED: Apple Mac OS X Prior to 10.7.3 Multiple Security Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NOTE: Some of these issues will not require specific exploit code and may be trivial to exploit.

RETIRED: Apple Mac OS X Prior to 10.7.3 Multiple Security Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.


Apple Mac Os X Server 10.7.2

• Apple MacOSXServerUpd10.7.3.dmg
  For OS X Lion Server v10.7.2
  http://www.apple.com/support/downloads/

Apple Mac Os X Server 10.6.8

• Apple SecUpdSrvr2012-001.dmg
  For Mac OS X Server v10.6.8
  http://www.apple.com/support/downloads/

Apple Mac Os X 10.7.1

• Apple MacOSXUpdCombo10.7.3.dmg
  For OS X Lion v10.7 and v10.7.1
  http://www.apple.com/support/downloads/

Apple Mac Os X 10.7.2

• Apple MacOSXUpd10.7.3.dmg
  For OS X Lion v10.7.2
  http://www.apple.com/support/downloads/

Apple Mac Os X Server 10.7.1

• Apple MacOSXServerUpdCombo10.7.3.dmg
  For OS X Lion Server v10.7 and v10.7.1
  http://www.apple.com/support/downloads/

Apple Mac Os X Server 10.7

• Apple MacOSXServerUpdCombo10.7.3.dmg
  For OS X Lion Server v10.7 and v10.7.1
  http://www.apple.com/support/downloads/

RETIRED: Apple Mac OS X Prior to 10.7.3 Multiple Security Vulnerabilities

References:

• Mac OS X Homepage (Apple)