This document describes Security Update 2006-004 for Mac Pro, which can be downloaded and installed using Software Update, or from Apple Downloads.
For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred, and any necessary patches or releases are available. To learn more about Apple Product Security, visit the Apple Product Security website.
For information about the Apple Product Security PGP Key, see "How to Use the Apple Product Security PGP Key."
Where possible, CVE IDs are used to reference the vulnerabilities for further information.
To learn about other Security Updates, see "Apple Security Updates."
Security Update 2006-004 was released on August 1, and details are available via:
http://docs.info.apple.com/article.html?artnum=304063
Mac Pro computers ship with Mac OS X v10.4.7 Build 8K1079. Also, the existing Xserve hardware now includes Mac OS X Server v10.4.7 Build 8K1079.
The fixes provided in Security Update 2006-004 (August 1 release) are contained in Build 8K1079, with the exception of the ones listed below for ImageIO and OpenSSH. The fixes for these issues were not fully tested in time for the manufacturing of the Mac Pro, and are being provided via this security update.
This update is a proper subset of the full Security Update 2006-004 released on August 1. Existing systems that have already applied Security Update 2006-004 (Aug 1 release) do not need to install this update.
The following security fixes are provided only for systems running Mac OS X v10.4.7 Build 8K1079 or Mac OS X Server v10.4.7 Build 8K1079 to reach the full security level provided with Security Update 2006-004 (August 1 release).
ImageIO
CVE-ID: CVE-2006-3459, CVE-2006-3461, CVE-2006-3462, CVE-2006-3465
Available for: Mac OS X v10.4.7 Build 8K1079, Mac OS X Server v10.4.7 Build 8K1079
Impact: Viewing a maliciously-crafted TIFF image may lead to an application crash or arbitrary code execution
Description: Buffer overflows were discovered in TIFF tag handling (CVE-2006-3459, CVE-2006-3465), the TIFF PixarLog decoder (CVE-2006-3461), and the TIFF NeXT RLE decoder (CVE-2006-3462). By carefully crafting a corrupt TIFF image, an attacker can trigger a buffer overflow which may lead to an application crash or arbitrary code execution. This update addresses the issue by performing additional validation of TIFF images. Systems prior to Mac OS X v10.4 are affected only by the TIFF NeXT RLE decoder issue (CVE-2006-3462). Credit to Tavis Ormandy, Google Security Team for reporting this issue.
Note:A fifth issue discovered by Tavis Ormandy, CVE-2006-3460, does not affect Mac OS X.
OpenSSH
CVE-ID: CVE-2006-0393
Available for: Mac OS X v10.4.7 Build 8K1079, Mac OS X Server v10.4.7 Build 8K1079
Impact: When remote login is enabled, remote attackers may cause a denial of service or determine whether an account exists
Description: Attempting to log in to an OpenSSH server ("Remote Login") using a nonexistent account causes the authentication process to hang. An attacker can exploit this behavior to detect the existence of a particular account. A large number of such attempts may lead to a denial of service. This update addresses the issue by properly handling attempted logins by nonexistent users. This issue does not affect systems prior to Mac OS X v10.4. Credit to Rob Middleton of the Centenary Institute (Sydney, Australia) for reporting this issue.