Hash: SHA1

             AUSCERT External Security Bulletin Redistribution

                   ESB-2005.0091 -- APPLE-SA-2005-01-25
 Security Update 2005-001 - Multiple Vulnerabilities in Mac OS X Software
                              27 January 2005


        AusCERT Security Bulletin Summary

Product:           at
Publisher:         Apple
Operating System:  Mac OS X
Impact:            Increased Privileges
                   Execute Arbitrary Code/Commands
                   Denial of Service
                   Provide Misleading Information
Access:            Remote/Unauthenticated
                   Existing Account
CVE Names:         CAN-2005-0127 CAN-2005-0126 CAN-2005-0125
                   CAN-2004-1314 CAN-2004-1065 CAN-2004-1064
                   CAN-2004-1063 CAN-2004-1036 CAN-2004-1020
                   CAN-2004-1019 CAN-2004-1018 CAN-2004-0989
                   CAN-2004-0595 CAN-2004-0594 CAN-2003-0863

- --------------------------BEGIN INCLUDED TEXT--------------------

Hash: SHA1

APPLE-SA-2005-01-25 Security Update 2005-001

Security Update 2005-001 is now available and delivers the following
security enhancements:

at commands
Available for:  Mac OS X v10.3.7, Mac OS X Server v10.3.7
CVE-ID:  CAN-2005-0125
Impact:  Updates the "at" commands to address a local privilege
escalation vulnerability
Description:  The "at" family of commands did not properly drop
privileges.  This could allow a local user to remove files not owned
by them, run programs with added privileges, or read the contents of
normally unreadable files.  This update patches the commands at,
atrm, batch, atq, and atrun.  Credit to
kf_lists[at]digitalmunition[dot]com for reporting this issue.

Available for:  Mac OS X v10.3.7, Mac OS X Server v10.3.7, Mac OS X
v10.2.8, Mac OS X Server v10.2.8
CVE-ID:  CAN-2005-0126
Impact:  Malformed ICC color profiles could overwrite the program
heap resulting in arbitrary code execution.
Description:  An out-of-specification or improperly embedded ICC
color profile could overwrite the program heap and allow arbitrary
code execution.  There are no known exploits for this issue.  With
this update, ColorSync will reject incorrectly-formed ICC color

Available for:  Mac OS X v10.3.7, Mac OS X Server v10.3.7
CVE-ID:  CAN-2004-0989
Impact:  The libxml2 library contains unsafe code that may be
exploited in applications linked against it.
Description:  This update fixes several functions in the libxml2
library that have been identified as unsafe due to potentially
exploitable buffer overflows.

Available for:  Mac OS X v10.3.7 Client, Mac OS X Server v10.3.7
CVE-ID:  CAN-2005-0127
Impact:  Email messages sent from a single machine can be identified
Description:  A GUUID containing an identifier associated with the
ethernet networking hardware was used in the construction an RFC-822
required Message-ID header.  Mail now hides this information by
computing the Message-ID using a cryptographic hash of the GUUID
concatenated with data from /dev/random.  Credit to Carl Purvis for
reporting this issue.

Available for:  Mac OS X v10.3.7, Mac OS X Server v10.3.7, Mac OS X
v10.2.8, Mac OS X Server v10.2.8
CVE-ID:  CAN-2003-0860, CAN-2003-0863, CAN-2004-0594, CAN-2004-0595,
CAN-2004-1018, CAN-2004-1019, CAN-2004-1020, CAN-2004-1063,
CAN-2004-1064, CAN-2004-1065
Impact:  Multiple vulnerabilities in PHP including remote denial of
service and execution of arbitrary code
Description:  PHP is updated to version 4.3.10 to address several
issues.  The PHP release announcement for version 4.3.10 is located
at http://www.php.net/release_4_3_10.php

Available for:  Mac OS X v10.3.7, Mac OS X Server v10.3.7, Mac OS X
v10.2.8, Mac OS X Server v10.2.8
CVE-ID:  CAN-2004-1314
Impact:  When Safari's "Block Pop-Up Windows" feature is not enabled,
a malicious pop-up window could appear as being from a trusted site
Description:  If the "Block Pop-Up Windows" feature is enabled, then
this issue does not occur.  If the "Block Pop-Up Windows" feature is
not enabled, a user can be misled about the content of a Pop-up
window if they used an untrusted link to navigate to a site they
wanted to view.  This update corrects the issue regardless of the
"Block Pop-Up Windows" setting.  Credit to Secunia Research for
reporting this issue.

Available for:  Mac OS X Server 10.3.7
CVE-ID:  CAN-2004-1036
Impact:  SquirrelMail is updated to address a cross-site scripting
Description:  A cross-site scripting vulnerability in SquirrelMail
allowed email messages to contain content that would be rendered by a
users web browser.  SquirrelMail is updated to address this issue.
Further details are available from the SquirrelMail website:

Security Update 2005-001 may be obtained from the Software Update
pane in System Preferences, or Apple's Software Downloads web site:

For Mac OS X v10.3.7
The download file is named: "SecUpd2005-001Pan.dmg"
Its SHA-1 digest is:  89aedac4c3824bf7a35c3100894b22fc0db47dd0

For Mac OS X Server v10.3.7
The download file is named: "SecUpSrvr2005-001Pan.dmg"
Its SHA-1 digest is:  73d0cd53be0504c10173d7dd6bb9f5fc964e3390

For Mac OS X v10.2.8
The download file is named: "SecUpd2005-001Jag.dmg"
Its SHA-1 digest is:  5c364b5f548a7fdced54de2149e79dfb3d90371d

For Mac OS X Server v10.2.8
The download file is named: "SecupdSrvr2005-001Jag.dmg"
Its SHA-1 digest is:  c999c6d2e58cea324dd91188fedf870741b296d4

Information will also be posted to the Apple Product Security
web site:

This message is signed with Apple's Product Security PGP key,
and details are available at:

Version: PGP 8.1


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:


If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:


Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.

Comment: http://www.auscert.org.au/render.html?it=1967