ID

VAR-200512-0623

CVE

CVE-2005-1726

TITLE

Apple Mac OS X Illegal access vulnerability

DESCRIPTION

The CoreGraphics Window Server in Mac OS X 10.4.1 allows local users with console access to gain privileges by "launching commands into root sessions.". Apple has released Security Update 2005-006 to address multiple local and remote Mac OS X vulnerabilities. The following new vulnerabilities were addressed by the security update: - A buffer overflow (CAN-2005-1721) in the AFP (Apple File Protocol) Server. - A vulnerability (CAN-2005-1720) in AFP Server related to temporary ACLs. - A denial of service vulnerability (CAN-2005-1722) in the CoreGraphics component. - A local privilege escalation (CAN-2005-1726) in the CoreGraphics component. - A local race condition vulnerability (CAN-2005-1727) related to permissions on the system cache and Dashboard folders. - A local privilege escalation vulnerability (CAN-2005-1725) in the launch daemon (launchd). - A vulnerability in Launch Services (CAN-2005-1723) could allow files to bypass "safe download" checks. - A vulnerability (CAN-2005-1728) in the MCX Client that may allow local attackers to gain access to Portable Home Directory credentials. - A vulnerability in NFS (CAN-2005-1724) could allow unauthorized access to exported filesystems. These vulnerabilities will be separated into individual BIDs upon further analysis of the issues. Successful exploitation allows execution of arbitrary code. 2) A bug in AFP Server when using an ACL-enabled storage volume may in certain situations result in an ACL remaining attached when a file with POSIX-only permissions is copied. 3) An input validation error can be exploited to access arbitrary files on a Bluetooth-enabled system using directory traversal attacks via the Bluetooth file and object exchange services. 4) A weakness in CoreGraphics can be exploited via a specially crafted PDF document to crash an application using either PDFKit or CoreGraphics to rendor PDF documents. 7) A race condition in the temporary file creation of launchd can be exploited by malicious, local users to take ownership of arbitrary files on the system. 8) An error in LaunchServices can result in file extensions and MIME types marked as unsafe to bypass download safety checks if they're not mapped to an Apple UTI (Uniform Type Identifier). 10) A security issue in NFS causes a NFS export restricted using "-network" and "-mask" to be exported to "everyone". 11) Multiple vulnerabilities in PHP can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system. For more information: SA14792 12) A boundary error in vpnd can be exploited by malicious, local users to cause a buffer overflow via an overly long Server_id parameter and execute arbitrary code with escalated privileges on systems configured as a VPN server. SOLUTION: Apply Security Update 2005-006. Mac OS X 10.3.9: http://www.apple.com/support/downloads/securityupdate2005006macosx1039.html Mac OS X 10.4.1: http://www.apple.com/support/downloads/securityupdate2005006macosx1041.html PROVIDED AND/OR DISCOVERED BY: 3) Kevin Finisterre, digitalmunition.com. 4) Chris Evans 6) Michael Haller 7) Neil Archibald 12) Pieter de Boer ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=301742 OTHER REFERENCES: SA14792: http://secunia.com/advisories/14792/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

lack of information

EXTERNAL IDS

REFERENCES

CREDITS

Discovery of the CoreGraphics issue is credited to Chris Evans. Discovery of the folder permissions issue is credited to Michael Haller. Discovery of the launchd issue is credited to Neil Archibald and Ilja Van Sprundel. Other issues were announced by

SOURCES

LAST UPDATE DATE

2024-08-14T12:38:33.391000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE