Adobe Addresses CVE-2009-3459

Adobe will be releasing an update for Acrobat Reader 9.1.3 and Acrobat 9.1.3 for Macintosh and Windows versions. A critical vulnerability exist and is being exploited in the wild, users should disable JavaScript in Acrobat. Adobe is reporting that it is possiable that an attacker may be able to work around this and conduct the exploit taking control of your machine. Users should use caution and only open PDF from trusted sites.

The release is expected to be available on October 13, 2009.

iTunes 9.0.1 Patches Buffer Overflow

Apple has released iTunes 9.0.1 which addresses a buffer overflow in Mac OSX Server/Client and Windows. A malicious .pls file could be used to cause program termination or lead to code execution. The update improves the bound checking in iTunes. Users should install the update as soon as possible using Software Update or directly from http://www.apple.com/itunes/download/

APPLE-SA-2009-09-14-1 Xsan 2.2

Using Xsan Admin application for screen sharing embedded user credentials including passwords can result in an error dialog containing the user name and password. The password could be then shoulder surfed by another user  within view of the display.

APPLE-SA-2009-09-10-1 Mac OS X v10.6.1

Apple has included an update to the current version of the Flash Player plug-in to 10.0.32.18. Snow Leopard Server and Client both shipped with an older version of the player and downgraded systems that updated to Mac OSX 10.6. These older version had multiple vulnerabilities. Users can check their version of Flash by visiting http://kb2.adobe.com/cps/155/tn_15507.html. A handy utility for managing Flash content is Click To Flash. To check or change Flash Player privacy and update settings visit http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html.

APPLE-SA-2009-09-10-2 Security Update 2009-005

Apple Security Update 2009-090-10-2 addresses multiple vulnerabilities that span all versions of OSX Client and Server. A buffer overflow existed in the Alias Manager which allowed a maliciously crafted alias file to terminate an application or execute arbitrary code. This is addressed by using improved bounds checking.

CoreGraphics could be exploited by either an integer overflow or heap buffer overflow which could lead to application termination or arbitrary code execution. In a chained case (interger overflow+heap buffer overflow) this could lead to an attacker using JBIG2 files embedded in PDF to trigger an application failure or execute malicious code.

CUPS (Common UNIX Printing System : see :http://localhost:631) have been updated to eliminate the possibility of an unprivileged user using the CUPS USB backend to gain root access. In addition validation is improved by preventing maliciously crafted scheduler requests from gaining access to print sharing services. 

The update also updates the Flash Player Plug-in, it is recommended that users and administrator supdate theri flash and set Flash to check for updates to weekly, see magmatic.com articles. Users can check and set their Flash preferences using the following links:

1. http://kb2.adobe.com/cps/155/tn_15507.html
2. http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html

PixarFilm encoded TIFF validation processhas been improved to eliminate memory corruption issues in ImageIO. Common vulnerabilities have been addressed in Wiki Server, MySql and PHP on Client and Server. The cross site scripting vulnerability in the Wiki Server has been fixed by setting UTF-8 as the default character set in HTTP responses.

Mac OSX server updates also include patches to ClamAV, CarbonCore, ColorSync, Launch Services and SMB. In the case of SMB services an unchecked error condition existed that allowed a user without a home directory configured to access the file system with local file system privileges.