AusCERT - ESB-2011.1034 - [OSX] Apple Mac OS X: Multiple vulnerabilities

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
ESB-2011.1034 - [OSX] Apple Mac OS X: Multiple vulnerabilities
Date: 13 October 2011
References: ESB-2009.1561  ESB-2010.0604  ESB-2010.0625  ESB-2010.0671  ESB-2010.0998  ESB-2010.1064  ASB-2010.0244  ESB-2011.0116  ESB-2011.0119  ESB-2011.0199
ESB-2011.0314  ESB-2011.0502  ESB-2011.0552  ASB-2011.0061  ESB-2011.0802  ESB-2011.1026  ESB-2011.1032  ESB-2011.1085  ESB-2011.1139  ESB-2012.0114  ESB-2012.0159
ESB-2012.0458  ESB-2012.0803

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2011.1034
              OS X Lion v10.7.2 and Security Update 2011-006
                              13 October 2011

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:          Apple Mac OS X
Publisher:        Apple
Operating System: Mac OS X
Impact/Access:    Execute Arbitrary Code/Commands -- Remote with User Interaction
                  Access Privileged Data          -- Remote with User Interaction
                  Denial of Service               -- Remote/Unauthenticated      
                  Delete Arbitrary Files          -- Existing Account            
                  Cross-site Scripting            -- Remote with User Interaction
                  Provide Misleading Information  -- Remote with User Interaction
                  Unauthorised Access             -- Remote with User Interaction
                  Access Confidential Data        -- Existing Account            
Resolution:       Patch/Upgrade
CVE Names:        CVE-2011-3437 CVE-2011-3436 CVE-2011-3435
                  CVE-2011-3246 CVE-2011-3228 CVE-2011-3227
                  CVE-2011-3226 CVE-2011-3225 CVE-2011-3224
                  CVE-2011-3223 CVE-2011-3222 CVE-2011-3221
                  CVE-2011-3220 CVE-2011-3219 CVE-2011-3218
                  CVE-2011-3217 CVE-2011-3216 CVE-2011-3215
                  CVE-2011-3214 CVE-2011-3213 CVE-2011-3212
                  CVE-2011-3192 CVE-2011-2692 CVE-2011-2691
                  CVE-2011-2690 CVE-2011-2464 CVE-2011-1910
                  CVE-2011-1755 CVE-2011-1521 CVE-2011-1471
                  CVE-2011-1470 CVE-2011-1469 CVE-2011-1468
                  CVE-2011-1467 CVE-2011-1466 CVE-2011-1153
                  CVE-2011-1092 CVE-2011-0708 CVE-2011-0707
                  CVE-2011-0534 CVE-2011-0421 CVE-2011-0420
                  CVE-2011-0419 CVE-2011-0411 CVE-2011-0260
                  CVE-2011-0259 CVE-2011-0252 CVE-2011-0251
                  CVE-2011-0250 CVE-2011-0249 CVE-2011-0231
                  CVE-2011-0230 CVE-2011-0229 CVE-2011-0226
                  CVE-2011-0224 CVE-2011-0187 CVE-2011-0185
                  CVE-2011-0013 CVE-2010-4645 CVE-2010-4172
                  CVE-2010-3718 CVE-2010-3614 CVE-2010-3613
                  CVE-2010-3436 CVE-2010-2227 CVE-2010-2089
                  CVE-2010-1634 CVE-2010-1157 CVE-2010-0097
                  CVE-2009-4022  

Reference:        ASB-2011.0061
                  ESB-2011.1032
                  ESB-2011.1026
                  ESB-2011.0802
                  ESB-2011.0552
                  ESB-2011.0502
                  ESB-2011.0314
                  ESB-2011.0199
                  ESB-2011.0119
                  ESB-2011.0116
                  ASB-2010.0244
                  ESB-2010.1064
                  ESB-2010.0998
                  ESB-2010.0671
                  ESB-2010.0625
                  ESB-2010.0604
                  ESB-2009.1561
                  ASB-2011.0076.2
                  ESB-2011.0524.2
                  ESB-2010.0053.2

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

APPLE-SA-2011-10-12-3 OS X Lion v10.7.2 and Security Update 2011-006

OS X Lion v10.7.2 and Security Update 2011-006 is now available and
addresses the following:

Apache
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7 and v10.7.1, OS X Lion Server v10.7 and v10.7.1
Impact:  Multiple vulnerabilities in Apache
Description:  Apache is updated to version 2.2.20 to address several
vulnerabilities, the most serious of which may lead to a denial of
service. CVE-2011-0419 does not affect OS X Lion systems. Further
information is available via the Apache web site at
http://httpd.apache.org/
CVE-ID
CVE-2011-0419
CVE-2011-3192

Application Firewall
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7 and v10.7.1, OS X Lion Server v10.7 and v10.7.1
Impact:  Executing a binary with a maliciously crafted name may lead
to arbitrary code execution with elevated privileges
Description:  A format string vulnerability existed in Application
Firewall's debug logging.
CVE-ID
CVE-2011-0185 : an anonymous reporter

ATS
Available for:  OS X Lion v10.7 and v10.7.1,
OS X Lion Server v10.7 and v10.7.1
Impact:  Viewing or downloading a document containing a maliciously
crafted embedded font may lead to arbitrary code execution
Description:  A signedness issue existed in ATS' handling of Type 1
fonts. This issue does not affect systems prior to OS X Lion.
CVE-ID
CVE-2011-3437

ATS
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  Viewing or downloading a document containing a maliciously
crafted embedded font may lead to arbitrary code execution
Description:  An out of bounds memory access issue existed in ATS'
handling of Type 1 fonts. This issue does not affect OS X Lion
systems.
CVE-ID
CVE-2011-0229 : Will Dormann of the CERT/CC

ATS
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7 and v10.7.1, OS X Lion Server v10.7 and v10.7.1
Impact:  Applications which use the ATSFontDeactivate API may be
vulnerable to an unexpected application termination or arbitrary code
execution
Description:  A buffer overflow issue existed in the
ATSFontDeactivate API.
CVE-ID
CVE-2011-0230 : Steven Michaud of Mozilla

BIND
Available for:  OS X Lion v10.7 and v10.7.1,
OS X Lion Server v10.7 and v10.7.1
Impact:  Multiple vulnerabilities in BIND 9.7.3
Description:  Multiple denial of service issues existed in BIND
9.7.3. These issues are addressed by updating BIND to version
9.7.3-P3.
CVE-ID
CVE-2011-1910
CVE-2011-2464

BIND
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  Multiple vulnerabilities in BIND
Description:  Multiple denial of service issues existed in BIND.
These issues are addressed by updating BIND to version 9.6-ESV-R4-P3.
CVE-ID
CVE-2009-4022
CVE-2010-0097
CVE-2010-3613
CVE-2010-3614
CVE-2011-1910
CVE-2011-2464

Certificate Trust Policy
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7 and v10.7.1, OS X Lion Server v10.7 and v10.7.1.
Impact:  Root certificates have been updated
Description:  Several trusted certificates were added to the list of
system roots. Several existing certificates were updated to their
most recent version. The complete list of recognized system roots may
be viewed via the Keychain Access application.

CFNetwork
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  Safari may store cookies it is not configured to accept
Description:  A synchronization issue existed in CFNetwork's handling
of cookie policies. Safari's cookie preferences may not be honored,
allowing websites to set cookies that would be blocked were the
preference enforced. This update addresses the issue through improved
handling of cookie storage.
CVE-ID
CVE-2011-0231 : Martin Tessarek, Steve Riggins of Geeks R Us, Justin
C. Walker, and Stephen Creswell

CFNetwork
Available for:  OS X Lion v10.7 and v10.7.1,
OS X Lion Server v10.7 and v10.7.1
Impact:  Visiting a maliciously crafted website may lead to the
disclosure of sensitive information
Description:  An issue existed in CFNetwork's handling of HTTP
cookies. When accessing a maliciously crafted HTTP or HTTPS URL,
CFNetwork could incorrectly send the cookies for a domain to a server
outside that domain. This issue does not affect systems prior to OS X
Lion.
CVE-ID
CVE-2011-3246 : Erling Ellingsen of Facebook

CoreFoundation
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  Viewing a maliciously crafted website or e-mail message may
lead to an unexpected application termination or arbitrary code
execution
Description:  A memory corruption issue existed in CoreFoundation's
handling of string tokenization. This issue does not affect OS X Lion
systems. This update addresses the issue through improved bounds
checking.
CVE-ID
CVE-2011-0259 : Apple

CoreMedia
Available for:  OS X Lion v10.7 and v10.7.1,
OS X Lion Server v10.7 and v10.7.1
Impact:  Visiting a maliciously crafted website may lead to the
disclosure of video data from another site
Description:  A cross-origin issue existed in CoreMedia's handling of
cross-site redirects. This issue is addressed through improved origin
tracking.
CVE-ID
CVE-2011-0187 : Nirankush Panchbhai and Microsoft Vulnerability
Research (MSVR)

CoreMedia
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description:  Multiple memory corruption issues existed in the
handling of QuickTime movie files. These issues do not affect OS X
Lion systems.
CVE-ID
CVE-2011-0224 : Apple

CoreProcesses
Available for:  OS X Lion v10.7 and v10.7.1,
OS X Lion Server v10.7 and v10.7.1
Impact:  A person with physical access to a system may partially
bypass the screen lock
Description:  A system window, such as a VPN password prompt, that
appeared while the screen was locked may have accepted keystrokes
while the screen was locked. This issue is addressed by preventing
system windows from requesting keystrokes while the screen is locked.
This issue does not affect systems prior to OS X Lion.
CVE-ID
CVE-2011-0260 : Clint Tseng of the University of Washington, Michael
Kobb, and Adam Kemp

CoreStorage
Available for:  OS X Lion v10.7 and v10.7.1,
OS X Lion Server v10.7 and v10.7.1
Impact:  Converting to FileVault does not erase all existing data
Description:  After enabling FileVault, approximately 250MB at the
start of the volume was left unencrypted on the disk in an unused
area. Only data which was present on the volume before FileVault was
enabled was left unencrypted. This issue is addressed by erasing this
area when enabling FileVault, and on the first use of an encrypted
volume affected by this issue. This issue does not affect systems
prior to OS X Lion.
CVE-ID
CVE-2011-3212 : Judson Powers of ATC-NY

File Systems
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7 and v10.7.1, OS X Lion Server v10.7 and v10.7.1
Impact:  An attacker in a privileged network position may manipulate
HTTPS server certificates, leading to the disclosure of sensitive
information
Description:  An issue existed in the handling of WebDAV volumes on
HTTPS servers. If the server presented a certificate chain that could
not be automatically verified, a warning was displayed and the
connection was closed. If the user clicked the "Continue" button in
the warning dialog, any certificate was accepted on the following
connection to that server. An attacker in a privileged network
position may have manipulated the connection to obtain sensitive
information or take action on the server on the user's behalf. This
update addresses the issue by validating that the certificate
received on the second connection is the same certificate originally
presented to the user.
CVE-ID
CVE-2011-3213 : Apple

IOGraphics
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  A person with physical access may be able to bypass the
screen lock
Description:  An issue existed with the screen lock when used with
Apple Cinema Displays. When a password is required to wake from
sleep, a person with physical access may be able to access the system
without entering a password if the system is in display sleep mode.
This update addresses the issue by ensuring that the lock screen is
correctly activated in display sleep mode. This issue does not affect
OS X Lion systems.
CVE-ID
CVE-2011-3214 : Apple

iChat Server
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7 and v10.7.1, OS X Lion Server v10.7 and v10.7.1
Impact:  A remote attacker may cause the Jabber server to consume
system resources disproportionately
Description:  An issue existed in the handling of XML external
entities in jabberd2, a server for the Extensible Messaging and
Presence Protocol (XMPP). jabberd2 expands external entities in
incoming requests. This allows an attacker to consume system
resources very quickly, denying service to legitimate users of the
server. This update addresses the issue by disabling entity expansion
in incoming requests.
CVE-ID
CVE-2011-1755

Kernel
Available for:  OS X Lion v10.7 and v10.7.1,
OS X Lion Server v10.7 and v10.7.1
Impact:  A person with physical access may be able to access the
user's password
Description:  A logic error in the kernel's DMA protection permitted
firewire DMA at loginwindow, boot, and shutdown, although not at
screen lock. This update addresses the issue by preventing firewire
DMA at all states where the user is not logged in.
CVE-ID
CVE-2011-3215 : Passware, Inc.

Kernel
Available for:  OS X Lion v10.7 and v10.7.1,
OS X Lion Server v10.7 and v10.7.1
Impact:  An unprivileged user may be able to delete another user's
files in a shared directory
Description:  A logic error existed in the kernel's handling of file
deletions in directories with the sticky bit.
CVE-ID
CVE-2011-3216 : Gordon Davisson of Crywolf, Linc Davis, R. Dormer,
and Allan Schmid and Oliver Jeckel of brainworks Training

libsecurity
Available for:  OS X Lion v10.7 and v10.7.1,
OS X Lion Server v10.7 and v10.7.1
Impact:  Viewing a maliciously crafted website or e-mail message may
lead to an unexpected application termination or arbitrary code
execution
Description:  An error handling issue existed when parsing a
nonstandard certificate revocation list extension.
CVE-ID
CVE-2011-3227 : Richard Godbee of Virginia Tech

Mailman
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  Multiple vulnerabilities in Mailman 2.1.14
Description:  Multiple cross-site scripting issues existed in Mailman
2.1.14. These issues are addressed by improved encoding of characters
in HTML output. Further information is available via the Mailman site
at http://mail.python.org/pipermail/mailman-
announce/2011-February/000158.html This issue does not affect OS X
Lion systems.
CVE-ID
CVE-2011-0707

MediaKit
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  Opening a maliciously crafted disk image may lead to an
unexpected application termination or arbitrary code execution
Description:  Multiple memory corruption issues existed in the
handling of disk images. These issues do not affect OS X Lion
systems.
CVE-ID
CVE-2011-3217 : Apple

Open Directory
Available for:  OS X Lion v10.7 and v10.7.1,
OS X Lion Server v10.7 and v10.7.1
Impact:  Any user may read another local user's password data
Description:  An access control issue existed in Open Directory. This
issue does not affect systems prior to OS X Lion.
CVE-ID
CVE-2011-3435 : Arek Dreyer of Dreyer Network Consultants, Inc, and
Patrick Dunstan at defenseindepth.net

Open Directory
Available for:  OS X Lion v10.7 and v10.7.1,
OS X Lion Server v10.7 and v10.7.1
Impact:  An authenticated user may change that account's password
without providing the current password
Description:  An access control issue existed in Open Directory. This
issue does not affect systems prior to OS X Lion.
CVE-ID
CVE-2011-3436 : Patrick Dunstan at defenceindepth.net

Open Directory
Available for:  OS X Lion v10.7 and v10.7.1,
OS X Lion Server v10.7 and v10.7.1
Impact:  A user may be able to log in without a password
Description:  When Open Directory is bound to an LDAPv3 server using
RFC2307 or custom mappings, such that there is no
AuthenticationAuthority attribute for a user, an LDAP user may be
allowed to log in without a password. This issue does not affect
systems prior to OS X Lion.
CVE-ID
CVE-2011-3226 : Jeffry Strunk of The University of Texas at Austin,
Steven Eppler of Colorado Mesa University, Hugh Cole-Baker, and
Frederic Metoz of Institut de Biologie Structurale

PHP
Available for:  OS X Lion v10.7 and v10.7.1,
OS X Lion Server v10.7 and v10.7.1
Impact:  Viewing a maliciously crafted PDF file may lead to an
unexpected application termination or arbitrary code execution
Description:  A signedness issue existed in FreeType's handling of
Type 1 fonts. This issue is addressed by updating FreeType to version
2.4.6. This issue does not affect systems prior to OS X Lion. Further
information is available via the FreeType site at
http://www.freetype.org/
CVE-ID
CVE-2011-0226

PHP
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7 and v10.7.1, OS X Lion Server v10.7 and v10.7.1
Impact:  Multiple vulnerabilities in libpng 1.4.3
Description:  libpng is updated to version 1.5.4 to address multiple
vulnerabilities, the most serious of which may lead to arbitrary code
execution. Further information is available via the libpng website at
http://www.libpng.org/pub/png/libpng.html
CVE-ID
CVE-2011-2690
CVE-2011-2691
CVE-2011-2692

PHP
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  Multiple vulnerabilities in PHP 5.3.4
Description:  PHP is updated to version 5.3.6 to address multiple
vulnerabilities, the most serious of which may lead to arbitrary code
execution. This issues do not affect OS X Lion systems. Further
information is available via the PHP website at http://www.php.net/
CVE-ID
CVE-2010-3436
CVE-2010-4645
CVE-2011-0420
CVE-2011-0421
CVE-2011-0708
CVE-2011-1092
CVE-2011-1153
CVE-2011-1466
CVE-2011-1467
CVE-2011-1468
CVE-2011-1469
CVE-2011-1470
CVE-2011-1471

postfix
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  An attacker in a privileged network position may manipulate
mail sessions, resulting in the disclosure of sensitive information
Description:  A logic issue existed in Postfix in the handling of the
STARTTLS command. After receiving a STARTTLS command, Postfix may
process other plain-text commands. An attacker in a privileged
network position may manipulate the mail session to obtain sensitive
information from the encrypted traffic. This update addresses the
issue by clearing the command queue after processing a STARTTLS
command. This issue does not affect OS X Lion systems. Further
information is available via the Postfix site at
http://www.postfix.org/announcements/postfix-2.7.3.html
CVE-ID
CVE-2011-0411

python
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7 and v10.7.1, OS X Lion Server v10.7 and v10.7.1
Impact:  Multiple vulnerabilities in python
Description:  Multiple vulnerabilities existed in python, the most
serious of which may lead to arbitrary code execution. This update
addresses the issues by applying patches from the python project.
Further information is available via the python site at
http://www.python.org/download/releases/
CVE-ID
CVE-2010-1634
CVE-2010-2089
CVE-2011-1521

QuickTime
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7 and v10.7.1, OS X Lion Server v10.7 and v10.7.1
Impact:  Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description:  Multiple memory corruption issues existed in
QuickTime's handling of movie files.
CVE-ID
CVE-2011-3228 : Apple

QuickTime
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description:  A heap buffer overflow existed in the handling of STSC
atoms in QuickTime movie files. This issue does not affect OS X Lion
systems.
CVE-ID
CVE-2011-0249 : Matt 'j00ru' Jurczyk working with TippingPoint's Zero
Day Initiative

QuickTime
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description:  A heap buffer overflow existed in the handling of STSS
atoms in QuickTime movie files. This issue does not affect OS X Lion
systems.
CVE-ID
CVE-2011-0250 : Matt 'j00ru' Jurczyk working with TippingPoint's Zero
Day Initiative

QuickTime
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description:  A heap buffer overflow existed in the handling of STSZ
atoms in QuickTime movie files. This issue does not affect OS X Lion
systems.
CVE-ID
CVE-2011-0251 : Matt 'j00ru' Jurczyk working with TippingPoint's Zero
Day Initiative

QuickTime
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description:  A heap buffer overflow existed in the handling of STTS
atoms in QuickTime movie files. This issue does not affect OS X Lion
systems.
CVE-ID
CVE-2011-0252 : Matt 'j00ru' Jurczyk working with TippingPoint's Zero
Day Initiative

QuickTime
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  An attacker in a privileged network position may inject
script in the local domain when viewing template HTML
Description:  A cross-site scripting issue existed in QuickTime
Player's "Save for Web" export. The template HTML files generated by
this feature referenced a script file from a non-encrypted origin. An
attacker in a privileged network position may be able to inject
malicious scripts in the local domain if the user views a template
file locally. This issue is resolved by removing the reference to an
online script. This issue does not affect OS X Lion systems.
CVE-ID
CVE-2011-3218 : Aaron Sigel of vtty.com

QuickTime
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7 and v10.7.1, OS X Lion Server v10.7 and v10.7.1
Impact:  Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description:  A buffer overflow existed in QuickTime's handling of
H.264 encoded movie files.
CVE-ID
CVE-2011-3219 : Damian Put working with TippingPoint's Zero Day
Initiative

QuickTime
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7 and v10.7.1, OS X Lion Server v10.7 and v10.7.1
Impact:  Viewing a maliciously crafted movie file may lead to the
disclosure of memory contents
Description:  An uninitialized memory access issue existed in
QuickTime's handling of URL data handlers within movie files.
CVE-ID
CVE-2011-3220 : Luigi Auriemma working with TippingPoint's Zero Day
Initiative

QuickTime
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7 and v10.7.1, OS X Lion Server v10.7 and v10.7.1
Impact:  Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description:  An implementation issue existed in QuickTime's handling
of the atom hierarchy within a movie file.
CVE-ID
CVE-2011-3221 : an anonymous researcher working with TippingPoint's
Zero Day Initiative

QuickTime
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7 and v10.7.1, OS X Lion Server v10.7 and v10.7.1
Impact:  Viewing a maliciously crafted FlashPix file may lead to an
unexpected application termination or arbitrary code execution
Description:  A buffer overflow existed in QuickTime's handling of
FlashPix files.
CVE-ID
CVE-2011-3222 : Damian Put working with TippingPoint's Zero Day
Initiative

QuickTime
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7 and v10.7.1, OS X Lion Server v10.7 and v10.7.1
Impact:  Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description:  A buffer overflow existed in QuickTime's handling of
FLIC files.
CVE-ID
CVE-2011-3223 : Matt 'j00ru' Jurczyk working with TippingPoint's Zero
Day Initiative

SMB File Server
Available for:  OS X Lion v10.7 and v10.7.1,
OS X Lion Server v10.7 and v10.7.1
Impact:  A guest user may browse shared folders
Description:  An access control issue existed in the SMB File Server.
Disallowing guest access to the share point record for a folder
prevented the '_unknown' user from browsing the share point but not
guests (user 'nobody'). This issue is addressed by applying the
access control to the guest user. This issue does not affect systems
prior to OS X Lion.
CVE-ID
CVE-2011-3225

Tomcat
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  Multiple vulnerabilities in Tomcat 6.0.24
Description:  Tomcat is updated to version 6.0.32 to address multiple
vulnerabilities, the most serious of which may lead to a cross site
scripting attack. Tomcat is only provided on Mac OS X Server systems.
This issue does not affect OS X Lion systems. Further information is
available via the Tomcat site at http://tomcat.apache.org/
CVE-ID
CVE-2010-1157
CVE-2010-2227
CVE-2010-3718
CVE-2010-4172
CVE-2011-0013
CVE-2011-0534

User Documentation
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8
Impact:  An attacker in a privileged network position may manipulate
App Store help content, leading to arbitrary code execution
Description:  App Store help content was updated over HTTP. This
update addresses the issue by updating App Store help content over
HTTPS. This issue does not affect OS X Lion systems.
CVE-ID
CVE-2011-3224 : Aaron Sigel of vtty.com

Web Server
Available for:  Mac OS X Server v10.6.8
Impact:  Clients may be unable to access web services that require
digest authentication
Description:  An issue in the handling of HTTP Digest authentication
was addressed. Users may be denied access to the server's resources,
when the server configuration should have allowed the access. This
issue does not represent a security risk, and was addressed to
facilitate the use of stronger authentication mechanisms. Systems
running OS X Lion Server are not affected by this issue.

X11
Available for:  Mac OS X v10.6.8, Mac OS X Server v10.6.8,
OS X Lion v10.7 and v10.7.1, OS X Lion Server v10.7 and v10.7.1
Impact:  Multiple vulnerabilities in libpng
Description:  Multiple vulnerabilities existed in libpng, the most
serious of which may lead to arbitrary code execution. These issues
are addressed by updating libpng to version 1.5.4 on OS Lion systems,
and to 1.2.46 on Mac OS X v10.6 systems. Further information is
available via the libpng website at
http://www.libpng.org/pub/png/libpng.html
CVE-ID
CVE-2011-2690
CVE-2011-2691
CVE-2011-2692

OS X Lion v10.7.2 also includes Safari 5.1.1. For information on
the security content of Safari 5.1.1, please visit:
http://support.apple.com/kb/HT5000

OS X Lion v10.7.2 and Security Update 2011-006 may be obtained from
the Software Update pane in System Preferences, or Apple's Software
Downloads web site:
http://www.apple.com/support/downloads/

The Software Update utility will present the update that applies
to your system configuration. Only one is needed, either
Security Update 2011-006 or OS X v10.7.2.

For OS X Lion v10.7.1
The download file is named: MacOSXUpd10.7.2.dmg
Its SHA-1 digest is: 37f784e08d4461e83a891a7f8b8af24c2ceb8229

For OS X Lion v10.7
The download file is named: MacOSXUpdCombo10.7.2.dmg
Its SHA-1 digest is: accd06d610af57df24f62ce7af261395944620eb

For OS X Lion Server v10.7.1
The download file is named: MacOSXServerUpd10.7.2.dmg
Its SHA-1 digest is: e4084bf1dfa295a42f619224d149e515317955da

For OS X Lion Server v10.7
The download file is named: MacOSXServerUpdCombo10.7.2.dmg
Its SHA-1 digest is: 25e86f5cf97b6644c7a025230431b1992962ec4a

For Mac OS X v10.6.8
The download file is named: SecUpd2011-006Snow.dmg
Its SHA-1 digest is: 0f9c29610a06370d0c85a4c92dc278a48ba17a84

For Mac OS X Server v10.6.8
The download file is named: SecUpdSrvr2011-006.dmg
Its SHA-1 digest is: 12de3732710bb03059f93527189d221c97ef8a06

Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.16 (Darwin)

iQEcBAEBAgAGBQJOlc/zAAoJEGnF2JsdZQeeWFcH/RDHS+dCP8T4a92uYRIbs9T3
TFbT7hnOoTB0H+2eN3oziLNime2N4mO921heHobiAKSXv/luU41ZPHxVd6rE77Md
/BHDqLv65RA0XFTIPmrTcfpLhI5UgXDLfOLrsmdwTm52l5zQZkoxufYFf3mB3h7U
ZJUD1s081Pjy45/Cbao097+JrDwS7ahhgkvTmpmSvJK/wWRz4JtZkvIYcQ2uQFR4
sTg4l6pmi3d8sJJ4wzrEaxDpclRjvjURI4DiBMYwGAXeCMRgYi0y03tYtkjXoaSG
69h2yD8EXQBuJkDyouak7/M/eMwUfb2S6o1HyXTldjdvFBFvvwvl+Y3xp8YmDzU=
=gsvn
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBTpZ1SO4yVqjM2NGpAQLb3g/9HmZOwHFGHpOZNxZtO+LEswsu/h1Wdnm+
haMaArpfKlY7x5vmoWY7SvuZNKk5c5fV2DgxpbC/k1mlZar7NI9sAQrEfWbQDGEW
wgF9BoCAVcahKe1rtfBN0wv169l2fzMPNBk5YORTqUaN/YzkKRHOsYQLpFe+W8/g
k3JRPAxHYr68uFbhIo06HvjiRACdB87kRxsPDc9iYs7yym4rP8BiJKeAb4vjavtO
CcoxShUle2YVGaUzdfI+K+rWNVmWsLovFhrnFk3zN2fD3Jur9yesWMyyZSDOfAnj
zCdScMoqqmuWNHqaCClvvgiSRGj2i6SMm+MHqFJSXqaOYGhLuCZAzAeTOZsT/xcG
yrg2KXLtL4OxmQ+xh8XLHdj6IBstm0T3+GtYtBI0DsJZFgUsl/QJv1Sq55mHV7Qo
eayphyYrfXzsrRGvEoM0OJc62ldD5sbg6JXoYpnOkVZ4sfXRL9YMLTrnGe2jvdIr
EoV+0ZnT4nxVk8o4YhqxHRZ8fqYLTP/2Agy82ju1HON0vXbni768DNkmPceHZkTY
aSq+aGfhmAjbbFN4gyrXF2j9arq7YQtWpk2ais6uCccy/BPj59QyCJFy/vNOFDjl
ITSd5qTfe4JSw3tyrLs6vsYT96kd2t7k1h6wzHtE0kKra2BwKbnE9oOk+K0PDcgo
Xr2Y07wrZPc=
=98Tn
-----END PGP SIGNATURE-----