Firefox 3.6.3 Fixes Object Scope Confusion

Mozilla Foundation has released an update to Firefox which addresses a retain and scope issues related to objects. Nils from MWR InfoSecuirty was able to use this during the 2010 Pwn2Own contest to defeat Firefox. A moved node incorrectly retained its old scope, thus an attacker could trigger garbage collection Firefox would still be able to use the freed object. Users should update to this version of Firefox.

Apple Releases a Security and Update Bonanza

Apple has released a security and update bonanza for various system components, iTunes and QuickTime. Users and administrators should perform these updates right away if that have not already. Some critical highlights which address Common Vulnerability and Exploits (CVE) identifications include the following:

• Buffer overflow in the AppKit related to spell checking
• Firewall startup timing issues in 10.5.x
• AFP file server access control checks failed to ensure credentials and allowed guessed access even if disabled
• World readable files could be accessed outside the shared folder, file path handling has been approved in this update
• Input validation issue is address along with other apache vulnerabilities by updating to version 2.2.14
• Two memory corruption errors are address in CoreAudio
• CoreTypes has added .ibplugin and .url are now flagged as unsafe by the system, thus the user will be flagged and the object will not automatically be launched
• Cups and Curl have been improved by improving the handling of null characters, validation improvements and setuid directory handling
• Cyrus IMAP authentication is improved with better bounds checking
• Disk Image flaw and memory corruption issue is addressed with bounds checking and better handling of package types regarding internet enabled disk images
•  IChat server issues have been address with memory management, reference tracking and improved SASL negotiation
• ImageIO and ImageRAW  are improved by better memory initialization, bounds checking and validation of images
• OS Services has improved privilege management
• MailMan and Mail have been updated
• MySQL is updated to version 5.0.88
• QuickTime has been updated to address various vulnerabilities
• vim, X11 and xar have all been updated or improved
• Wiki Server web SACL does not override service ACL (10.5.x only)

 Needless to say that Apple has been busy patching holes in a variety of packages and components. 

Mozilla.org Has Released Firefox 3.6.2

Firefox version 3.6.2 has been released to address a WOFF heap corruption due to integer overflow discovered by Evgeny Legerov. The flaw can cause the allocation of memory for a downloaded font to be inadequate. This causes a crash which can result in arbitrary code execution. 

Ransomeware, Scareware and Trojans are a Real Threat

It is very clear that as the user and developer base of Mac OSX grows so will the value of exploited Macintosh computers to cyber criminal organizations. The Mac is an intriguing target since it is truely a Unix box. The iPhone's and iPad's popularity has only increased interest in exploiting the Macintosh platform. 

One of the down sides of Apple's advertising campaign is that users fall victim to a false sense of security. They usually have weak password, no backups, opt out of firewall and virus protection software. Cyber criminals exploited jail broken iPhones after a proof of concept exploit was altered into a trojan that stole information, locked the users phone and re-directed users of a particular bank to a phishing site to steal account information. 

Dancho Danchev has an excellent article on ZDNet blog that is a must read. POC of various Mac SmS Ransomeware have been posted to various forums in Russian and Chinese. (Several 0day exploits have been posted to Zero Day Initiative that have also appeared on Chinese forums. With the DOD moving many client systems to MacOS the interest in MacOS by foreign governments will only increase.) It is only a matter of time before these POC are re-engineer into  criminalizeware. So, now is the time to start thinking about security within MacOS. Install anti-virus software, advance firewall that does egress and ingress filtering especially if you are not familiar with ipfw, install snort, auditing tools and only open files from trusted sources.

Ransomeware, scareware and trojans are a real threat, Mac users and administrators need to get used to it.

APPLE-SA-2010-03-11-1 Safari 4.0.5

Apple has released a security update to Safari to 4.0.5 to address 10 issues including zero -days related to ColorSync, ImageIO and WebKit. Six additional issues affect the windows version of Safari. 

One issue is related to bypassing the blocking of cookies even if Safari is set to block them when using PubSub. PubSub is used for feed handling, cookies set by RSS and Atom feeds would be accepted even if Safari is set to block them. This implementation error has been corrected. Some of the vulnerabilities in WebKit center around the handling of CSS, HTML handling and XML documents resulting in memory corruption which can result in malicious code execution or application DOS.  One such vulnerability related to the handling of CSS format () arguments resulting in application DOS and malicious code execution is addressed with better memory tracking. Other issues include the handling of HTML element callback content, handling of right-to-left display text, use after free handling of incorrectly nested HTML tags and parsing of XML documents. Again, these WebKit issues are addressed by improving memory reference tracking. 

There are also a host of improvements in the handling of 3rd party plug-ins, stability improvements for Web sites that use forms, stability improvements in the handling of Scalable Vector Graphics and fixing an issue related to iWork.com users being unable to comment on documents. The installation does require a restart of the system and is critical, users should not surf the Web with Safari until this update is installed.