June 16, 2010, 10:12AM
Apple Patches Critical Mac OS X Security Flaws
4 Comments
Apple has shipped another mega Mac OS X patch bundle to fix a total of 28 documented security vulnerabilities affecting the Mac ecosystem.
The update, which includes fixes for the Adobe Flash Player plugin and several open-source components, is rated highly-critical because it exposes Mac OS X users to remote code execution attacks.
Editor's Pick
In some cases, a hacker could take complete control of an affected machine if a user is lured to a malicious Web site or views a rigged movie file.
Here’s the skinny on the most serious issues fixes in this Security Update 2010-004 / Mac OS X v10.6.4 bundle:
- Flash Player plug-in: Multiple vulnerabilities exist in the Adobe Flash Player plug-in, the most serious of which may lead to unauthorized cross-domain requests. The issues are addressed by updating the Flash Player plug-in to version 10.0.45.2.
- Help Viewer: A cross-site scripting issue exists in Help Viewer’s handling of help: URLs. Visiting a maliciously crafted website may lead to the execution of JavaScript in the local domain. This may lead to information disclosure or arbitrary code execution. This issue is addressed through improved escaping of URL parameters in HTML content. This issue does not affect systems prior to Mac OS X 10.6.
- ImageIO: Multiple integer overflows in the handling of TIFF files may result in a heap buffer overflow. Opening a maliciously crafted TIFF file may lead to an unexpected application termination or arbitrary code execution. The issues are addressed through improved bounds checking.
- ImageIO: A memory corruption exists in the handling of MPEG2 encoded movie files. Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution. This issue is addressed by performing additional validation of MPEG2 encoded movie files.
- Kerberos: A double free issue exists in the renewal or validation of existing tickets in the KDC process. A remote user may cause an unexpected termination of the KDC process, or arbitrary code execution. This issue is addressed through improved ticket handling.
- libcurl: A buffer overflow exists in libcurl’s handling of gzip-compressed web content. When processing compressed content, libcurl may return an unexpectedly large amount of data to the calling application. This may lead to an unexpected application termination or arbitrary code execution. The issue is addressed by ensuring that the size of data blocks returned to the calling application by libcurl adheres to documented limits.
Featured Resource:
- Network Authorization: A format string issue exists in the handling of afp:, cifs:, and smb: URLs. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This issue is addressed through improved validation of afp:, cifs:, and smb: URLs. This issue does not affect systems prior to Mac OS X v10.6.
- Printing: An integer overflow issue exists in the calculation of page sizes in the cgtexttops CUPS filter. A local or remote user with access to the printer may cause an unexpected application termination or arbitrary code execution. This issue is addressed through improved bounds checking.
As always, the security update may be obtained from Software Update pane in System Preferences, or Apple’s Software Downloads web site.
Commenting on this Article is closed.
Today's Most Popular
- Yahoo Includes Private Key in Source File For Axis Chrome Extension
- Researchers Unveil New Way to Trust Certificates
- FBI Warns Top Firms Of Anonymous Protest Hacks on May 25
- DNSChanger Lingers: 330k Systems Still Infected, 77,000 In The U.S.
- Defense Contractor Northrop Grumman Hiring For Offensive Cyber Ops
Most Commented Stories
Newsletter Sign-up
Take Our Poll
The Internet Crime Complaint Center recently warned of malware targeting travelers connecting to Wi-Fi. When traveling, do you
Connect to anything
21%
Only connect to password-protected, secure connections
39%
Only use websites with HTTPS
27%
I don’t pay attention to how I access the internet while traveling
13%
Total votes: 70
Follow Threatpost
 |  |  |  |
| Tumblr |
Comments
OOPS, They missed one! It's called AT&T. We've known about this vulnerability for years, but Apple of course is right out front with "life changing" "New" technology. Yup.
They are installing a vulnerable version of Adobe Flash, y0. 10.1 fixes the critical vulnerabilities, no?
How many of these are real security problems? From what I read, they are more of carelessness and lack of foresight during software development.
"How many of these are real security problems? From what I read, they are more of carelessness and lack of foresight during software development."
Carelessness and lack of foresight during the software development is the root cause of almost all computer security problems nowadays, as they open potential path of compromise for would-be attackers. This is what has plagued Windows for many years, this is what plagues Adobe products currently, and this is what Apple led its user community to believe that they were exempt of such problems, whereas most of Apple products' "security" derives from the fact that the installed-base of Mac systems in the wild is less appealing in terms of numbers than other systems (Windows, *Nix).
At least, Apple seems to be prompt to fix its issues once they're discovered, even if all is not perfect as we can see in the case of the Flash update.
I hope this answers your question appropriately.