Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2013.0117
Apple TV 5.2
29 January 2013
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Apple TV
Publisher: Apple
Operating System: Apple iOS
Impact/Access: Access Privileged Data -- Remote with User Interaction
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2013-0964 CVE-2012-2619
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-01-28-2 Apple TV 5.2
Apple TV 5.2 is now available and addresses the following:
Apple TV
Available for: Apple TV 2nd generation and later
Impact: A user-mode process may be able to access the first page of
kernel memory
Description: The kernel has checks to validate that the user-mode
pointer and length passed to the copyin and copyout functions would
not result in a user-mode process being able to directly access
kernel memory. The checks were not being used if the length was
smaller than one page. This issue was addressed through additional
validation of the arguments to copyin and copyout.
CVE-ID
CVE-2013-0964 : Mark Dowd of Azimuth Security
Apple TV
Available for: Apple TV 2nd generation
Impact: A remote attacker on the same WiFi network may be able to
cause an unexpected system termination
Description: An out of bounds read issue exists in Broadcom's
BCM4325 and BCM4329 firmware's handling of 802.11i information
elements. This issue was addressed through additional validation of
802.11i information elements.
CVE-ID
CVE-2012-2619 : Andres Blanco and Matias Eissler of Core Security
Installation note:
Apple TV will periodically check for software updates. Alternatively,
you may manually check for software updates by selecting
"Settings -> General -> Update Software".
To check the current version of software, select
"Settings -> General -> About".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRBfhmAAoJEPefwLHPlZEwNmIP/R3GjFNdGg5UJ6cmb2eC8Ayz
3qzNZqVpjKdABZ3ra8TpZpR2Lh6Z6iKa4ZFecFqLIZXXcYiC3154zOZOQHcY5n/9
yw+mHL/UaKbwpT4rexD16WNiixha5+TQffd7gSyjeYah5g6uDz03prU8wrpM3mWv
7wRuNWuRJu5ndB7yt4zCRnfDrkLBxoarEX6YNo5aIjFfP3fFZYXrXgeaUeyZnhXY
FeO/Cu0TWgUOJgZnBeyTmWsNpt1IuFB0M+6zNUAEyWYBUjtdiGK0tmmFOQ5YjmV+
pBHDTyec+W589igwnXZs4Y27/7LHRd4jfYwA1ZhuwDdRmKvDWSsEVlApaH8nmMFs
jV8d2p5le1IdZaED9mBtkt26VCHYYowtSN05LKiKjLfSChNCtQo0ndaC7Z9Uosh7
8PE1yIC6698h4/SaNS+bmwjUI7Q/6EoQkgXQP2xUMjaPdx2Z6I9/AiIR65jCupZr
txvcg2nNxzexGsavGvALwFoRJiKdp0IHqU+Vyasept8jwHqC9ZuB8gQXP5yQSHGG
lPTKutwk3/bCaYrXhNADFtOXSsAWw0v4GtOQphfJEdZNO0JCR+gYfq0o2oVp9UG8
7w+BgEJX5uzJekQ/sSM2BCbR1kJV/j00W2n+O3SncwoEOK+UDpoYcRWcCEBRXoTf
K/prxlVAFp+wzvcT6GVP
=fPxD
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUQdBZO4yVqjM2NGpAQLAmQ/9FiV+ahpXltRf1lY1IGomobLN34JCxJHl
DJUWlYApntpdPqQo3OPbYzaOg0qVRzpmKtwjkZqC1khh8fuap+h4GITQwS18SKXB
SXb6CT2PLkb++sL5O1D2/fUc511VXi1WKYC0UgZEx/+aLzLrvZZI7rM0PjanRdY1
q2/xISKDyu84DTNrnmIuugHgVyJe4oP4dxc/Uadvh+uz1WNIC4p52jMB0F86VQh4
xcPrg9bIEum1kchGZUXPIeQZe3YdnxnuVlGy5eM3hwYZm+Ga5mvHJ71wztyQPix2
UGNFbMebutMo2Xqc9hmTTldVccGEpKGwcKZWAItKJhv5080ew4/7PosyvNKIE5wG
2PevNViPjOH7XmVdygj1SERBHEdV3BfDRhZzLikPdBHRIuCjxQaohMsp7CdnXEVu
7s7Zip4fbLFBJdNkvh8D4LVttaOfXKJM60n/NsB3JIp//HxFNVzNger5b9F6noVo
naAfQPwkpOBKxKlh9TcA/3ftULQxI7YW7cc+Jqc0PgYQQVmfSVeyDD2Nn9B5dZV6
wPDgbh0uL8jDGx1o93sTmNZduJn7i8/WtysgI9W/ihkQLM7w8IoYUrn9xIDlZyJC
E/2VCsSOUA5KLDc+dhfk65dVWBjPa4L+OmXSNZBqHNGYzFPdu3jXUWmSwR3YCD+u
yGHRAAlrurU=
=lO0K
-----END PGP SIGNATURE-----