APPLE-SA-2009-09-10-1 Mac OS X v10.6.1

Apple has included an update to the current version of the Flash Player plug-in to 10.0.32.18. Snow Leopard Server and Client both shipped with an older version of the player and downgraded systems that updated to Mac OSX 10.6. These older version had multiple vulnerabilities. Users can check their version of Flash by visiting http://kb2.adobe.com/cps/155/tn_15507.html. A handy utility for managing Flash content is Click To Flash. To check or change Flash Player privacy and update settings visit http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html.

APPLE-SA-2009-09-10-2 Security Update 2009-005

Apple Security Update 2009-090-10-2 addresses multiple vulnerabilities that span all versions of OSX Client and Server. A buffer overflow existed in the Alias Manager which allowed a maliciously crafted alias file to terminate an application or execute arbitrary code. This is addressed by using improved bounds checking.

CoreGraphics could be exploited by either an integer overflow or heap buffer overflow which could lead to application termination or arbitrary code execution. In a chained case (interger overflow+heap buffer overflow) this could lead to an attacker using JBIG2 files embedded in PDF to trigger an application failure or execute malicious code.

CUPS (Common UNIX Printing System : see :http://localhost:631) have been updated to eliminate the possibility of an unprivileged user using the CUPS USB backend to gain root access. In addition validation is improved by preventing maliciously crafted scheduler requests from gaining access to print sharing services. 

The update also updates the Flash Player Plug-in, it is recommended that users and administrator supdate theri flash and set Flash to check for updates to weekly, see magmatic.com articles. Users can check and set their Flash preferences using the following links:

1. http://kb2.adobe.com/cps/155/tn_15507.html
2. http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager.html

PixarFilm encoded TIFF validation processhas been improved to eliminate memory corruption issues in ImageIO. Common vulnerabilities have been addressed in Wiki Server, MySql and PHP on Client and Server. The cross site scripting vulnerability in the Wiki Server has been fixed by setting UTF-8 as the default character set in HTTP responses.

Mac OSX server updates also include patches to ClamAV, CarbonCore, ColorSync, Launch Services and SMB. In the case of SMB services an unchecked error condition existed that allowed a user without a home directory configured to access the file system with local file system privileges.

Firefox Update 3.5.3 With Flash Version Check

Mozilla has released updates to Firefox which address the following issues, view source articles for details.

• Crashes with evidence of memory corruption (rv:1.9.1.3/1.9.0.14
• TreeColumns dangling pointer vulnerability
• Location bar spoofing via tall line-height Unicode characters
• Chrome privilege escalation with FeedWriter
• Flash Version Check

Mozilla has incorporated a Flash Version Check to insure that the latest version in running for Firefox users. In addition I recommend the No-Script plug-in to get control of scripts from various sites. Users can apply this update by selecting check for updates or going to the direct download page at http://www.mozilla.com/en-US/firefox/firefox.html

QuickTime 7.6.4 Update

APPLE-SA-2009-09-09-2 QuickTime 7.6.4 addresses various CVE-ID related to QuickTime in Mac OSX and Windows by improving bounds checking. This includes memory corruption in QuickTime's handling of H.264 movie files, the heap buffer overflow related to the way in which QuickTime handles FlashPix and the buffer overflow issues related to MPEG-4. Due to poor bounds checking these vulnerabilities can cause an application crash, arbitrary code execution and possible escalation of privileges.

iPhone OS 3.1 and iPhone OS 3.1.1 for iPod Touch

The following CVE-ID issues have been addressed and fixed

• The heap overflow in the handling of AAC or MP3 files leading to DoS or arbitrary code execution. 
• The "Require Passcode" on the iPhone did not sync with "Maximum inactivity time lock" for exchange servers. This created a window in which a user with physical access to the device access even to exchange services.
• Spotlight search would allow access to delete email messages.
• A heap buffer overflow in Recovery Mode allowed for Passcode bypass. This could allow someone with physical access to the device to gain access.
• Maliciously crafted SMS exploiting null pointer dereference issues could lead to a DoS.
• The Undo Manager allowed for deleted passwords characters to be visible. 
• User names and passwords in original URL referrer header may disclose information to linked sites.
• WebKit's handling of numeric character references allowed memory to become corrupt which could allow a maliciously crafted website to terminate the application and code execution.   
• WebKit's handling of parent and top object could be exploited using cross-site scripting attack.
• Look-a-like characters could be created using International Domain Name (IDN) support and Unicode fonts.