# MA-313.052012: MyCERT Alert - Latest Security Update for Multiple Apple Products Vulnerabilities (May 2012)

**Date:** 10 May 2012  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-313.052012  
**Advisory ID:** MA-313.052012

---

**1.0 Introduction**
Apple has recently released several security updates for Mac OS that cover several vulnerabilities such as:
- **Login Window**
- **Available for:** OS X Lion v10.7.3, OS X Lion Server v10.7.3
**Impact:** Remote admins and persons with physical access to the system may obtain account information
**Description:** An issue existed in the handling of network account logins. The login process recorded sensitive information in the system log, where other users of the system could read it. The sensitive information may persist in saved logs after installation of this update. This issue only affects systems running OS X Lion v10.7.3 with users of Legacy File Vault and/or networked home directories. See http://support.apple.com/kb/TS4272 for more information about how to securely remove any remaining records.
- **Bluetooth**
- **Available for:** OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** A local user may be able to execute arbitrary code with system privileges
**Description:** A temporary file race condition issue existed in blued's initialization routine
- **curl**
- **Available for:** Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** An attacker may be able to decrypt data protected by SSL
**Description:** There are known attacks on the confidentiality of SSL 3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. curl disabled the 'empty fragment' countermeasure which prevented these attacks. This issue is addressed by enabling empty fragments.
- **curl**
- **Available for:** OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** Using curl or libcurl with a maliciously crafted URL may lead to protocol-specific data injection attacks
**Description:** A data injection issue existed in curl's handling of URLs. This issue is addressed through improved validation of URLs. This issue does not affect systems prior to OS X Lion.
- **Directory Service**
- **Available for:** Mac OS X 10.6.8, Mac OS X Server 10.6.8
**Impact:** A remote attacker may obtain sensitive information
**Description:** Multiple issues existed in the directory server's handling of messages from the network. By sending a maliciously crafted message, a remote attacker could cause the directory server to disclose memory from its address space, potentially revealing account credentials or other sensitive information. This issue does not affect OS X Lion systems. The Directory Server is disabled by default in non-server installations of OS X.
- **HFS**
- **Available for:** OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** Mounting a maliciously crafted disk image may lead to a system shutdown or arbitrary code execution.
**Description:** An integer underflow existed in the handling of HFS catalog files.
- **ImageIO**
- **Available for:** Mac OS X v10.6.8, Mac OS X Server v10.6.8
**Impact:** Viewing a maliciously crafted TIFF file may lead to an unexpected application termination or arbitrary code execution
**Description:** A buffer overflow existed in ImageIO's handling of CCITT Group 4 encoded TIFF files. This issue does not affect OS X Lion systems.
- **ImageIO**
- **Available for:** Mac OS X 10.6.8, Mac OS X Server 10.6.8
**Impact:** Multiple vulnerabilities in libpng
**Description:** libpng is updated to version 1.5.5 to address multiple vulnerabilities, the most serious of which may lead to information disclosure. Further information is available via the libpng website at http://www.libpng.org/pub/png/libpng.html
- **ImageIO**
- **Available for:** Mac OS X v10.6.8, Mac OS X Server v10.6.8
**Impact:** Viewing a maliciously crafted TIFF file may lead to an unexpected application termination or arbitrary code execution
**Description:** A buffer overflow existed in libtiff's handling of ThunderScan encoded TIFF images. This issue is addressed by updating libtiff to version 3.9.5.
- **Kernel**
- **Available for:** OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** When FileVault is used, the disk may contain unencrypted user data
**Description:** An issue in the kernel's handling of the sleep image used for hibernation left some data unencrypted on disk even when FileVault was enabled. This issue is addressed through improved handling of the sleep image, and by overwriting the existing sleep image when updating to OS X v10.7.4. This issue does not affect systems prior to OS X Lion.
- **libarchive**
- **Available for:** Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** Extracting a maliciously crafted archive may lead to an unexpected application termination or arbitrary code execution.
**Description:** Multiple buffer overflows existed in the handling of tar archives and iso9660 files.
- **libarchive**
- **Available for:** Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** Verifying a maliciously crafted X.509 certificate, such as when visiting a maliciously crafted website, may lead to an unexpected application termination or arbitrary code execution
**Description:** An uninitialized memory access issue existed in the handling of X.509 certificates.
- **libarchive**
- **Available for:** Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** Support for X.509 certificates with insecure-length RSA keys may expose users to spoofing and information disclosure
**Description:** Certificates signed using RSA keys with insecure key lengths were accepted by libsecurity. This issue is addressed by rejecting certificates containing RSA keys less than 1024 bits.
- **libxml**
- **Available for:** Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** Viewing a maliciously crafted web page may lead to an unexpected application termination or arbitrary code execution
**Description:** Multiple vulnerabilities existed in libxml, the most serious of which may lead to an unexpected application termination or arbitrary code execution. These issues are addressed by applying the relevant upstream patches.
- **LoginUIFramework**
- **Available for:** OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** If the Guest user is enabled, a user with physical access to the computer may be able to log in to a user other than the Guest user without entering a password
**Description:** A race condition existed in the handling of Guest user logins. This issue does not affect systems prior to OS X Lion.
- **PHP**
- **Available for:** OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** Multiple vulnerabilities in PHP
**Description:** PHP is updated to version 5.3.10 to address several vulnerabilities, the most serious of which may lead to arbitrary code execution. Further information is available via the PHP web site at http://www.php.net
- **Quartz Composer**
- **Available for:** Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** A user with physical access to the computer may be able to cause Safari to launch if the screen is locked and the RSS Visualizer screen saver is used
**Description:** An access control issue existed in Quartz Composer's handling of screen savers. This issue is addressed through improved checking for whether or not the screen is locked.
- **QuickTime**
- **Available for:** Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** Viewing a maliciously crafted movie file during progressive download may lead to an unexpected application termination or arbitrary code execution
**Description:** A buffer overflow existed in the handling of audio sample tables.
- **QuickTime**
- **Available for:** Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** Viewing a maliciously crafted MPEG file may lead to an unexpected application termination or arbitrary code execution
**Description:** An integer overflow existed in the handling of MPEG files.
- **QuickTime**
- **Available for:** Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** Viewing a maliciously crafted MPEG file may lead to an unexpected application termination or arbitrary code execution
**Description:** A buffer underflow existed in the handling of MPEG files.
- **QuickTime**
- **Available for:** OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution
**Description:** A use after free issue existed in the handling of JPEG2000 encoded movie files. This issue does not affect systems prior to OS X Lion.
- **Ruby**
- **Available for:** Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** Multiple vulnerabilities in Ruby
**Description:** Ruby is updated to 1.8.7-p357 to address multiple vulnerabilities.
- **Samba**
- **Available for:** Mac OS X 10.6.8, Mac OS X Server 10.6.8
**Impact:** If SMB file sharing is enabled, an unauthenticated remote attacker may cause a denial of service or arbitrary code execution with system privileges
**Description:** Multiple buffer overflows existed in Samba's handling of remote procedure calls. By sending a maliciously crafted packet, an unauthenticated remote attacker could cause a denial of service or arbitrary code execution with system privileges. These issues do not affect OS X Lion systems.
- **Security Framework**
- **Available for:** Mac OS X 10.6.8, Mac OS X Server 10.6.8, OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** A remote attacker may cause an unexpected application termination or arbitrary code execution
**Description:** An integer overflow existed in the Security framework. Processing untrusted input with the Security framework could result in memory corruption. This issue does not affect 32-bit processes.
- **Time Machine**
- **Available for:** OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** A remote attacker may access a user's Time Machine backup credentials
**Description:** The user may designate a Time Capsule or remote AFP volume attached to an AirPort Base Station to be used for Time Machine backups. Beginning with AirPort Base Station and Time Capsule Firmware Update 7.6, Time Capsules and Base Stations support a secure SRP-based authentication mechanism over AFP. However, Time Machine did not require that the SRP-based authentication mechanism was used for subsequent backup operations, even if Time Machine was initially configured or had ever contacted a Time Capsule or Base Station that supported it. An attacker who is able to spoof the remote volume could gain access to user's Time Capsule credentials, although not backup data, sent by the user's system. This issue is addressed by requiring use of the SRP-based authentication mechanism if the backup destination has ever supported it.
- **X11**
- **Available for:** OS X Lion v10.7 to v10.7.3, OS X Lion Server v10.7 to v10.7.3
**Impact:** Applications that use libXfont to process LZW-compressed data may be vulnerable to an unexpected application termination or arbitrary code execution
**Description:** A buffer overflow existed in libXfont's handling of LZW-compressed data. This issue is addressed by updating libXfont to version 1.4.4.
You can find more information at Apple Security Update 2012-002 by visiting the following URL:
- <http://support.apple.com/kb/HT5281>
All of the patches could be done automatically via the Software Update application.
Users who want to learn more about the Software Update application are highly recommended to visit “Mac OS X: Update your software” page at the following URL:
- <http://support.apple.com/kb/HT1338>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor. MyCERT can be reached through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#c8a5b1abadbabc88a5b1abadbabce6a7baafe6a5b1)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT   to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
i - <http://support.apple.com/kb/HT5167>
ii - <http://support.apple.com/kb/HT5281>