This document describes Security Update 2005-008, which can be downloaded and installed via Software Update preferences, or from Apple Downloads.
For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.
For information about the Apple Product Security PGP Key, see "How To Use The Apple Product Security PGP Key."
Where possible, CVE IDs are used to reference the vulnerabilities for further information.
To learn about other Security Updates, see "Apple Security Updates."
CVE-ID: CAN-2005-2747
Available for: Mac OS X v10.4.2, Mac OS X Server v10.4.2
Impact: Viewing a maliciously-crafted GIF image may result in arbitrary code execution.
Description: By carefully crafting a corrupt GIF image, an attacker can trigger a buffer overflow in ImageIO which may result in arbitrary code execution. Several components of Mac OS X utilize ImageIO including WebCore and Safari. This update addresses the issue by performing additional validation of images.
CVE-ID: CAN-2005-2746
Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.2, Mac OS X Server v10.4.2
Impact: When using auto-reply rules, Mail.app may expose the contents of encrypted messages.
Description: Mail.app includes the contents of messages when processing auto-reply rules. If a message being processed was encrypted, the automatically generated response will include the decrypted message contents. This could allow an attacker to intercept the message. This update addresses the issue by ensuring that unencrypted responses to encrypted messages are not generated. Credit to Norbert Rittel of Rittel Consulting for reporting this issue.
CVE-ID: CAN-2005-2745
Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9
Impact: Using Kerberos Version 5 for SMTP authentication Mail.app may disclose sensitive information.
Description: When using SMTP authentication with Kerberos Version 5, Mail.app may append un-initialized memory to a message. This update addresses the issue by updating Mail.app. Credit to the MIT Kerberos team for reporting this issue. This issue was resolved in Mac OS X v10.4.2 by Security Update 2005-007.
CVE-ID: CAN-2005-2748
Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.2, Mac OS X Server v10.4.2
Impact: Insecure file handling may result in local privilege escalation.
Description: When certain environmental variables are set to enable debugging of application memory allocation, files with diagnostic information are created insecurely. This could allow a malicious local user to alter arbitrary files. This update addresses the issue by disallowing malloc debugging in privileged programs. Credit to Ilja van Sprundel of Suresec LTD for reporting this issue.
CVE-ID: CAN-2005-2744
Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.2, Mac OS X Server v10.4.2
Impact: Viewing a maliciously-crafted PICT image may result in arbitrary code execution.
Description: By carefully crafting a corrupt PICT image, an attacker can trigger a buffer overflow in QuickDraw Manager which may result in arbitrary code execution. Several components of Mac OS X utilize QuickDraw Manager, including Safari, Mail, and Finder. This update addresses the issue by performing additional validation of images. Credit to Henrik Dalgaard of Echo One for reporting this issue.
CVE-ID: CAN-2005-2743
Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9
Impact: An untrusted applet may gain elevated privileges.
Description: The Java extensions bundled with QuickTime 6.52 and earlier allow untrusted applets to call arbitrary functions from system libraries. This update addresses the issue by limiting these calls to trusted applets. Systems running QuickTime 7 or later are not affected by this issue. Systems running Mac OS X v10.4 or later are also not affected by this issue. Credit to Dino Dai Zovi for reporting this issue.
CVE-ID: CAN-2005-1992
Available for: Mac OS X v10.4.2, Mac OS X Server v10.4.2
Impact: Ruby applications utilizing the xmlrpc module may be vulnerable to arbitrary code execution.
Description: The Ruby xmlrpc/utils module utilizes the method Module#public_instance_methods to determine which methods may be invoked remotely using XML-RPC. A change between different versions of Ruby caused this method list to unintentionally include methods that may be used to execute arbitrary Ruby code. This update addresses the issue by updating the xmlrpc/utils module. This issue does not affect systems prior to Mac OS X v10.4.
CVE-ID: CAN-2005-2524
Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9
Impact: Maliciously crafted web archives could potentially allow cross-site scripting.
Description: It is possible to view web archives served from remote sites in Safari. Maliciously crafted web archives may be rendered as content from sites they did not server them. This update prevents remote web archives from being loaded. Safari web archives were introduced in Safari 2.0. This issue was resolved in Mac OS X v10.4.2 by Security Update 2005-007.
CVE-ID: CAN-2005-2742
Available for: Mac OS X v10.4.2, Mac OS X Server v10.4.2
Impact: A user with physical access to the system may be able to bypass the "Require password to wake this computer from sleep or screen saver" setting.
Description: Under certain situations, the "Switch User..." button may appear even though the "Enable fast user switching" setting is disabled. This could cause the currently logged-in user's desktop to be displayed without authentication. This update prevents the "Switch User..." button from appearing when inappropriate. This issue does not affect systems prior to Mac OS X v10.4. Credit to Luke Fowler of the Indiana University Global Research Network Operations Center for reporting this issue.
CVE-ID: CAN-2005-2741
Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9, Mac OS X v10.4.2, Mac OS X Server v10.4.2
Impact: Malicious users may grant themselves rights to manipulate arbitrary files or perform other privileged actions.
Description: Authorization Services allows unprivileged users to grant certain rights that should be restricted to administrators, which may lead to privilege escalation. This update addresses the issue by adding restrictions to which rights unprivileged users can grant themselves.
Also included in this update are enhancements to LoginWindow for improved interaction with Parental Controls (Mac OS X v10.3.9), X509Anchors to include the Wells Fargo root certificate (Mac OS X v10.3.9), and Safe Download Validation to include Web Archives (Mac OS X v10.4.2).