Also, Stand-Alone Safari 3.2.3 Update for Windows and Tiger Users

Severity: High

12 May, 2009

Summary:

  • These vulnerabilities affect: OS X 10.4.x (Tiger) and OS X 10.5.x (Leopard), both client and server versions
  • How an attacker exploits them: Multiple vectors of attack, including enticing one of your users into downloading and viewing malicious documents, disk images, or into visiting malicious web sites
  • Impact: Various results; in the worst case, attacker executes code on your user's computer, potentially gaining full control of it
  • What to do: OS X administrators should download, test and install OS X 10.5.7 Update or Security Update 2009-002. Tiger and Windows users should also install Safari 3.2.3

Exposure:

Late today, Apple released a security update to fix vulnerabilities in OS X. The update fixes at least 67 (number based on CVE-IDs) security issues in 31 of the components that ship as part of OS X, including Apache, BIND, Safari, and iChat. Some of these vulnerabilities allow attackers to execute code on your OS X machines, so we rate this update Critical. Apply it as soon as you can. Three of the fixed vulnerabilities include:

  • Multiple PDF handling vulnerabilities in CoreGraphics. CoreGraphics is an OS X component that helps output graphics to your display (or printer). CoreGraphics suffers from a several vulnerabilities involving the way it handles PDF files. If an attacker can get a victim to view a specially crafted PDF document (perhaps hosted on a malicious web site), he could exploit this flaw to either crash an application or to execute attack code on the victim's computer. By default, the attacker would only execute code with that user's privileges. However, other vulnerabilities described in Apple's Security Update could allow an attacker to elevate his privileges and gain complete control of your user's Mac.
  • Multiple Flash Player Plug-in vulnerabilities. OS X ships with the Flash Player Plug-in to allow you to view Adobe Flash content in Safari. Unfortunately, the Flash Player Plug-in suffers from various unspecified vulnerabilities. Apple doesn't describe these flaws in any detail, however, they describe the potential impact of these flaws. By luring one of your users to a malicious web site, an attacker can exploit the worst of these flaws to execute code on that user's computer. The attacker could then leverage other vulnerabilities (fixed by this Security Update) to potentially gain complete control of that user's computer.
  • Apple Type Service heap buffer overflow vulnerability. The Apple Type Service (ATS) helps OS X machines handle fonts. ATS suffers from a buffer overflow vulnerability having to do with the way it handles Compact Font Format (CFF) fonts. By tricking one of your users into downloading and viewing a malicious document containing a specially crafted font, an attacker can exploit this flaw to execute code on that user's computer. By default, the attacker would only execute code with that user's privileges. However, other vulnerabilities described in Apple's Security Update could allow an attacker to elevate his privileges and gain complete control of your user's Mac.

Apple's alert includes many more code execution flaws, as well as Denial of Service (DoS) flaws, elevation of privilege flaws, and Spoofing vulnerabilities, plus others. Components patched by this security update include:


Apache         

ATS

BIND

CFNetwork

CoreGraphics

CScope

CUPS

Disk Images

enscript

Flash Player plug-in

Help Viewer

iChat

International Components for Unicode

IPSec

Kerberos

Kernel

Launch Services

libxml

Net-SNMP

Network Time

Networking,

OpenSSL

PHP

QuickDraw Manager

ruby

Safari

Spotlight

system_cmds

telnet

WebKit

X11

Please refer to Apple's OS X alert for more details (see below References section for hyperlink details).
Apple also released a Safari 3.2.3 update, today. If you use OS X 10.5.x (Leopard), Apple already includes this Safari update in their OS X update. However, if you use Safari for Windows or OS X 10.4.x (Tiger) you should also download and install Safari version 3.2.3 as soon as possible.

Solution Path:

Apple has released OS X Security Update 2009-002 and OS X Update 10.5.7 to fix these security issues. OS X administrators should download, test, and deploy the corresponding update as soon as they can.

Note: If you have trouble figuring out which of these patches corresponds to your version of OS X, we recommend that you let OS X's Software Update utility pick the correct updates for you automatically.

For All Users:

These flaws enable many diverse exploitation methods. Some of the exploits are local, meaning that your perimeter firewall never encounters the attack (unless you use firewalls internally between departments). Installing these updates, therefore, is the most secure course of action.

Status:

Apple has released updates to fix these issues.

References:

At the time of writing, Apple had emailed these security alerts, but had not yet published the web pages associated with them. To ensure you receive these updates as quickly as possible, we decided to send this LiveSecurity alert to you without Apple's links. We will update the web version of this LiveSecurity Alert with Apple's hyperlink as soon as Apple makes them available. You can also check Apple's Security Update page yourself to see whether or not Apple has posted their updates.

  • OS X Security Update 2009-002 (link pending)
  • Safari 3.2.3 Security Update (link pending)

This alert was researched and written by Corey Nachreiner, CISSP.