Safari 4.0 Update

Safari 4.0 addresses issues in CFNetwork, libxml, Private browsing session ghosting, Web Kit and passwords remaining in memory on application exit. In addition to some new features over fifty security issues have been addressed and fixed.

Update on Thursday, June 18, 2009 at 09:32AM by drStrangeP0rk

Apple has already released an update to Safari to 4.01 to address compatibility issues related to photo sharing locally and on the internet. This includes iPhoto, Facebook and Picasa.

QuickTime 7.6.2 Update

Apple also is including an update of QuickTime to address several vectors which can be exploited by maliciously crafted images, videos or music. In the worst case an attacker can gain complete control by exploiting a privileged user. 

iTunes 8.2 Update

Apple has plugged a buffer overflow in iTunes which would allow an attacker to insert code. In a primitive attack the application will terminate. The update improves the overall bounds checking.

Java Runtime Environment in Mac OSX

Java Runtime Environment in Mac OSX has vulnerabilities that Sun has released updates to. Apple will have to provide an update via Software Update for general users shortly, see references from a complete list from the Sun Solve site. The issues include privilege escalation, failure to check signatures, buffer overflows, parsing of Zip allowing reading of arbitrary memory and code from local system accessing the local host. The current test below will result in a bootstrap failure.

At this time users should disable Java, if however it is needed then only trusted sites' .class and JAR files should be run. 

 <<Note: Test site below is a link to test CVE-2008-5353, it will cause your system to crash. Currently Virus Barrier is detecting this security hole. It is not a live link, you are responsible, you have to cut and paste the link.>>

http://landonf.bikemonkey.org/static/moab-tests/CVE-2008-5353/hello.html

Update on Sunday, May 31, 2009 at 08:19AM by drStrangeP0rk

Marc Schoenefeld has posted information on how to install a non-OSX java distribution and a link to a site with the exploit. Currently Virus Barrier detects and will put the virus into quarantine. You should of course delete the class files which all have the Java/Evasion.A virus.

http://www.illegalaccess.org/

Update on Tuesday, June 16, 2009 at 08:21AM by drStrangeP0rk

Apple has released updates to the Java Platform released by Apple. Make sure to select update from Software Update to install these updates, they are critical. When installing the update make sure no applications that use Java are running before installing. This fixes many of the issues including preventing Java applets/applications from running and gaining elevated privileges.

http://support.apple.com/kb/HT3633

http://support.apple.com/kb/HT3632

Mac OSX Security Updates for Client and Server

Over 67 vulnerabilities spanning Mac OSX 10.4.x-10.5.x including in Apache, BIND, CoreGraphics, CUPS, enscript, Help Viewer, International Components for Unicode, Kerberos, Launch Services, Net SNMP, ATS, CFNetwork, CScope, Disk Images, Flash Plug-In iChat, IPSec, Kernel libxml ad Network Time. 

Within CoreGraphics it relates mostly to PDF's, the exploit requires a users to loaded a specially crafted file from download or a web site. Used in conjunction it is possible for and elevation of privileges so having a limit account is not a full proof solution. ATS service can experience a buffer overflow due to the way that t handles Compact Fonts, this again used with other vulnerabilities can allow an attacker to elevate privileges. Use of a limited account is not one hundred percent effective. 

Sites that are hosted from Mac OSX servers using Apache can publish specially crafted files that can substitute their own response for any web page being hosted on that system. CFnetwork flaw is related Set-Cookie parsing which can result in certain cookies being sent with clear text information. For developers that use XCode and need to print line number, many resort to using enscript. This update address several issues including the possibility to execute arbitrary code.

The update also address various issues related to Safari including the heap buffer issues related to libxml.There are also updates for Safari Public Beta which should not for any reason be used on a production system or a system with access to internal network resources. 

Update on Wednesday, May 13, 2009 at 08:25PM by drStrangeP0rk

This update also address important issues relates to Mac OSX Server. Administrators should patch their servers only after testing on non-production systems. Many of these updates are listed as critical, I currently have been using Parallels server for Mac OSX server and have not experienced any issues with our in-house test systems. These systems make up the bulk o my security lab.