Security Update 2005-003 Released

[MacRumors]

Now available via Software Update:

Security Update 2005-003 delivers a number of security enhancements and is recommended for all Macintosh users. This update includes the following components:AFP ServerBluetooth Setup AssistantCoreFoundationCyrus SASLFolder permissionsSafariSambaFor detailed information on this Update, please visit this website: http://www.info.apple.com/kbnum/n61798

Further details can be found at http://docs.info.apple.com/article.html?artnum=301061.The previous Mac OS X Security Update was released February 22.

 

[Doctor Q]

Changes described:

AFP Server
Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
CVE-ID: CAN-2005-0340
Impact: A specially crafted packet can cause a Denial of Service against the AFP Server.
Description: A specially crafted packet will terminate the operation of the AFP Server due to an incorrect memory reference.

AFP Server
Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
CVE-ID: CAN-2005-0715
Impact: The contents of a Drop Box can be discovered.
Description: Fixes the checking of file permissions for access to Drop Boxes. Credit to John M. Glenn of San Francisco for reporting this issue.

Bluetooth Setup Assistant
Available for: Mac OS X 10.3.8, Mac OS X Server 10.3.8
CVE-ID: CAN-2005-0713
Impact: Local security bypass when using a Bluetooth input device.
Description: The Bluetooth Setup Assistant may be launched on systems without a keyboard or a preconfigured Bluetooth input device. In these cases, access to certain privileged functions has been disabled within the Bluetooth Setup Assistant.

Core Foundation
Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
CVE-ID: CAN-2005-0716
Impact: Buffer overflow via an environment variable.
Description: The incorrect handling of an environment variable within Core Foundation can result in a buffer overflow that may be used to execute arbitrary code. This issue has been addressed by correctly handling the environment variable. Credit to iDEFENSE and Adriano Lima of SeedSecurity.com for reporting this issue.

Cyrus IMAP
Available for: Mac OS X Server v10.3.8
CVE-ID: CAN-2004-1011, CAN-2004-1012, CAN-2004-1013, CAN-2004-1015, CAN-2004-1067
Impact: Multiple vulnerabilities in Cyrus IMAP, including remotely exploitable denial of service and buffer overflows.
Description: Cyrus IMAP is updated to version 2.2.12, which includes fixes for buffer overflows in fetchnews, backend, proxyd, and imapd. Further information is available from http://asg.web.cmu.edu/cyrus/download/imapd/changes.html.

Cyrus SASL
Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
CVE-ID: CAN-2002-1347, CAN-2004-0884
Impact: Multiple vulnerabilities in Cyrus SASL, including remote denial of service and possible remote code execution in applications that use this library.
Description: Cyrus SASL is updated to address several security holes caused by improper data validation, memory allocation, and data handling.

Folder permissions
Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
CVE-ID: CAN-2005-0712
Impact: World-writable permissions on several directories, allowing potential file race conditions or local privilege escalation.
Description: Secure folder permissions are applied to protect the installer's receipt cache and system-level ColorSync profiles. Credit to Eric Hall of DarkArt Consulting Services, Michael Haller (info@cilly.com), and (root at addcom.de) for reporting this issue.

Mailman
Available for: Mac OS X Server v10.3.8
CVE-ID: CAN-2005-0202
Impact: Directory traversal issue in Mailman that could allow access to arbitrary files.
Description: Mailman is a software package that provides mailing list management. This update addresses an exposure in Mailman's private archive handling that allowed remote access to arbitrary files on the system. Further information is available from http://www.gnu.org/software/mailman/security.html.

Safari
Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
CVE-ID: CAN-2005-0234
Impact: Maliciously registered International Domain Names (IDN) can make URLs visually appear as legitimate sites.
Description: Support for Unicode characters within domain names (International Domain Name support) can allow maliciously registered domain names to visually appear as legitimate sites. Safari has been modified so that it consults a user-customizable list of scripts that are allowed to be displayed natively. Characters based on scripts that are not in the allowed list are displayed in their Punycode equivalent. The default list of allowed scripts does not include Roman look-alike scripts. Credit to Eric Johanson (ericj@shmoo.com) for reporting this issue to us. More information is available here.

 

[1macker1]

Great, there goes my uptime

Isn't this pretty bad:
"Impact: Buffer overflow via an environment variable."

 

[Mitthrawnuruodo]

Looking good... buffer overflows are always nasty... installing now on my iBook and my girlfriends Pismo. Will let you know if somethings wrong...

 

[PlaceofDis]

quite an update, 15.4 mb too

too bad there are no fixes for the pop-up blockers

 

[iGary]

I want my pop-up blocker to work.

 

[J@ffa]

Wow, this made my mac feel much snappier!

Wait, I haven't installed it yet.

Seriously though, that's quite a big whack of updates. Is this any indication of Apple cleaning house before Tiger comes out, or just coincidental?

 

[PlaceofDis]

Wow, this made my mac feel much snappier!

Wait, I haven't installed it yet.

Seriously though, that's quite a big whack of updates. Is this any indication of Apple cleaning house before Tiger comes out, or just coincidental?

id say just coincidental because security updates will still be released for old OSes after Tiger comes out

 

[redeye be]

just finished the update.
The adiumX menu bar icon does not work anymore. Adium itself does work without a problem. I'll try repairing permissions.

EDIT: permissions look ok according to Disk Utility...

 

[iriejedi]

Use Firefox

I want my pop-up blocker to work.

Firefox's pop up blockers works REALLY well!

 

[vancenase]

[gratuitous reply]

the third update this year?!? my gosh! why does Apple release so many updates?

[/gratuitous reply]

 

[Doctor Q]

I'm glad Apple added a feature to identify sneaky URLs that use other scripts to make a URL look like a well-known one.

Here is a sample of a URL containing an imposter letter "a":

http://www.аpple.com/

That is not a Latin-1 letter "a" in the word "apple". Instead, it is a Cyrillic lowercase a and there is a non-Apple website at that URL. The entity used is: & # 1 0 7 2 ;

You might be fooled by this URL before you apply this Security Update but should not be fooled afterwards, because the URL in your Address Bar will show as "www.xn--pple-43d.com/" instead of as "www.apple.com".

You can use the link above, before and after you update, to test how the change works.

 

[timnosenzo]

I'm glad Apple added a feature to identify sneaky URLs that use other scripts to make a URL look like a well-known one.

Here is a sample of a URL containing an imposter letter "a":

http://www.?pple.com/

That is not a Latin-1 letter "a" in the word "apple". Instead, it is a Cyrillic lowercase a and there is a non-Apple website at that URL.

You might be fooled by this URL before you apply this Security Update but should not be fooled afterwards. You should be able to use this post to test how the change works.

whoa, that's a little scary!

 

[PlaceofDis]

just finished the update.
The adiumX menu bar icon does not work anymore. Adium itself does work without a problem. I'll try repairing permissions.

EDIT: permissions look ok according to Disk Utility...

i would toggle this feature off and then back on, because its working without a problem over here for me

 

[nagromme]

FYI, more on Punycode here:

http://www.answers.com/topic/punycode

Since I'm backed up recently, for once I'll be the guinea pig and install this early I prefer to wait and let OTHERS be brave!

 

[MacBandit]

Firefox's pop up blockers works REALLY well!

I've been having the same problem with a new form of pop-unders with Safari and Firefox both seem to be vulnerable. There is a possibility that one of the nightly builds of Firefox has fixed this as I haven't been running the nightly builds.

 

[munkle]

Nice to see issues being dealt with why still no solution to the 'pop-under' probs? I've only encountered this once but it's been a known issue for awhile now...

 

[auxplage]

Oh, darn, time to reboot. Oh, I have always wondered; when it says "optimizing HD", what exactly is going on during that process?

 

[DPazdanISU]

Nice to see issues being dealt with why still no solution to the 'pop-under' probs? I've only encountered this once but it's been a known issue for awhile now...

they pop under not over so who cares?

 

[MacBandit]

Oh, darn, time to reboot. Oh, I have always wondered; when it says "optimizing HD", what exactly is going on during that process?

http://www.thexlab.com/faqs/maintainingmacosx.html

Read the last section relating to Update prebinding.

 

[redeye be]

i would toggle this feature off and then back on, because its working without a problem over here for me

thx
working now indeed

 

[nagromme]

Optimizing/prebinding

when it says "optimizing HD", what exactly is going on during that process?

"Optimizing" means the same thing as "prebinding":

A dynamic library is just a big collection of functionality that the application can use to implement whatever features it needs. *When an application dynamically loads a library, it has to find all of the chunks of functionality before it can use them. * Each bit of functionality-- each function, class, constant, global variable, or whatever-- is represented by a symbol. ...

When an application or dynamic library is prebound, it means that the application or dynamic library contains a cache of all of the symbols it needs in an already bound state. *When the application is launched, it automatically uses this information cache such that all symbols are bound without having to go through the arduous task of binding each symbol individually."

All about prebinding:
http://radio.weblogs.com/0100490/stories/2002/08/24/prebindingExplained.html

 

[Mitthrawnuruodo]

I've been having the same problem with a new form of pop-unders with Safari and Firefox both seem to be vulnerable. There is a possibility that one of the nightly builds of Firefox has fixed this as I haven't been running the nightly builds.

Are you sure, I haven't had one single pop-up or -under since I "switched" to Firefox last November, not one single one! When the reports of pup-unders started emerging a month ago (or so) I visited every single site where Safari users reported pop-unders and Firefox took care of every single one... I've yet to see a site that cracks the pop-up blocker in Firefox, even if I've tried...please give me examples of sites that trigger a pop-up or -under in Firefox...

 

[auxplage]

http://www.thexlab.com/faqs/maintainingmacosx.html

Read the last section relating to Update prebinding.

Thanks (Nagromme as well)!

 

[PlaceofDis]

thx
working now indeed

cool glad to know it was such a simple fix too, whew!