Causa vulnerabilita’ del sistema si invitano tutti i possessori di Mac con
\nsistemi operativi Mac OS X version 10.3.9 (Panther) e Mac OS X Server
\nversion 10.3.9 ad aggiornare il proprio computer.<\/p>\n
franco leveraro<\/p>\n
———- Forwarded message ———-<\/p>\n
From: CERT Advisory <cert-advisory@cert.org<\/a>> —–BEGIN PGP SIGNED MESSAGE—– Technical Cyber Security Alert TA05-136A Original release date: May 16, 2005 Systems Affected<\/p>\n Mac OS X version 10.3.9 (Panther) and Mac OS X Server version 10.3.9<\/p>\n Overview<\/p>\n Apple has released Security Update 2005-005 to address multiple I. Description<\/p>\n Apple Security Update 2005-005 resolves a number of vulnerabilities VU#356070 – Apple Terminal fails to properly sanitize input for Apple Terminal on Mac OS X fails to sanitize x-man-page URIs, allowing VU#882750 – libXpm image library vulnerable to buffer overflow<\/p>\n libXpm image parsing code contains a buffer-overflow vulnerability VU#125598 – LibTIFF vulnerable to integer overflow via corrupted An integer overflow in LibTIFF may allow a remote attacker to execute VU#539110 – LibTIFF vulnerable to integer overflow in the An integer overflow in LibTIFF may allow a remote attacker to execute VU#537878 – libXpm library contains multiple integer overflow libXpm contains multiple integer-overflow vulnerabilities that may VU#331694 – Apple Mac OS X chpass\/chfn\/chsh utilities do not properly Mac OS X Directory Service utilities do not properly validate code VU#582934 – Apple Mac OS X Foundation framework vulnerable to buffer A buffer overflow in Mac OS X’s Foundation Framework’s processing of VU#706838 – Apple Mac OS X vulnerable to buffer overflow via vpnd Apple Mac OS X contains a buffer overflow in vpnd that could allow a VU#258390 – Apple Mac OS X with Bluetooth enabled may allow file Apple Mac OS X with Bluetooth support may unintentionally allow files VU#354486 – Apple Mac OS X Server Netinfo Setup Tool fails to validate Apple Mac OS X Server NeST tool contains a vulnerability in the Please note that Apple Security Update 2005-005 addresses additional II. Impact<\/p>\n The impacts of these vulnerabilities vary, for information about III. Solution<\/p>\n Install an Update<\/p>\n Install the update as described in Apple Security Update 2005-005.<\/p>\n Appendix A. References<\/p>\n * US-CERT Vulnerability Note VU#582934 – * US-CERT Vulnerability Note VU#258390 – * US-CERT Vulnerability Note VU#331694 – * US-CERT Vulnerability Note VU#706838 – * US-CERT Vulnerability Note VU#539110 – * US-CERT Vulnerability Note VU#354486 – * US-CERT Vulnerability Note VU#882750 – * US-CERT Vulnerability Note VU#537878 – * US-CERT Vulnerability Note VU#125598 – * US-CERT Vulnerability Note VU#356070 –
\nTo: cert-advisory@cert.org<\/a>
\nSubject: US-CERT Technical Cyber Security Alert TA05-136A — Apple Mac OS X
\n is affected by multiple vulnerabilities <\/p>\n
\nHash: SHA1<\/p>\n
\n Apple Mac OS X is affected by multiple vulnerabilities<\/p>\n
\n Last revised: —
\n Source: US-CERT<\/p>\n
\n vulnerabilities affecting Mac OS X and Mac OS X Server. The most
\n serious of these vulnerabilities may allow a remote attacker to
\n execute arbitrary code. Impacts of other vulnerabilities addressed by
\n the update include disclosure of information and denial of service.<\/p>\n
\n affecting Mac OS X and OS X Server. Further details are available in
\n the following Vulnerability Notes:<\/p>\n
\n x-man-page URI<\/p>\n
\n a remote attacker to execute arbitrary commands.
\n (CAN-2005-1342)<\/p>\n
\n that may allow a remote attacker execute arbitrary code or cause a
\n denial-of-service condition.
\n (CAN-2004-0687)<\/p>\n
\n directory entry count<\/p>\n
\n arbitrary code.
\n (CAN-2004-1308)<\/p>\n
\n TIFFFetchStrip() routine<\/p>\n
\n arbitrary code.
\n (CAN-2004-1307)<\/p>\n
\n vulnerabilities<\/p>\n
\n allow a remote attacker execute arbitrary code or cause a
\n denial-of-service condition.
\n (CAN-2004-0688)<\/p>\n
\n validate external programs<\/p>\n
\n paths to external programs, potentially allowing a local attacker to
\n execute arbitrary code.
\n (CAN-2004-1335)<\/p>\n
\n overflow via incorrect handling of an environmental variable<\/p>\n
\n environment variables may lead to elevated privileges.
\n (CAN-2004-1336)<\/p>\n
\n daemon<\/p>\n
\n local, authenticated attacker to execute arbitrary code with root
\n privileges.
\n (CAN-2004-1343)<\/p>\n
\n exchange without prompting users<\/p>\n
\n to be exchanged with other systems by default.
\n (CAN-2004-1332)<\/p>\n
\n command line parameters<\/p>\n
\n processing of command line arguments that could allow a local attacker
\n to execute arbitrary code.
\n (CAN-2004-0594)<\/p>\n
\n vulnerabilities not described above. As further information becomes
\n available, we will publish individual Vulnerability Notes.<\/p>\n
\n specific impacts please see the Vulnerability Notes. Potential
\n consequences include remote execution of arbitrary code or commands,
\n disclosure of sensitive information, and denial of service.<\/p>\n
\n <www.kb.cert.org\/vuls\/id\/582934<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/258390<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/331694<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/706838<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/539110<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/354486<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/882750<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/537878<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/125598<\/a>><\/p>\n
\n <www.kb.cert.org\/vuls\/id\/356070<\/a>><\/p>\n