VARIoT IoT vulnerabilities database
| VAR-201306-0266 | CVE-2013-2783 | IOServer of DNP3 Service disruption in drivers (DoS) Vulnerabilities |
CVSS V2: 7.1 CVSS V3: - Severity: HIGH |
The DNP3 driver in IOServer drivers 1.0.19.0 allows remote attackers to cause a denial of service (infinite loop) or obtain unspecified control via crafted data to TCP port 20000. IOServer is an industrial control software running on windows. IOServer is prone to a remote denial-of-service vulnerability because it fails to properly handle user-supplied input.
Attackers can exploit this issue to force the application to enter into an infinite loop, causing it to consume large amounts of system resources. This can result in denial-of-service conditions.
IOServer 1.0.19.0 is vulnerable; other versions may also be affected
| VAR-201306-0467 | No CVE | NetGear DGN1000 'currentsetting.htm' Secure Bypass Vulnerability |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
The NetGear DGN1000 is a wireless DSL router. The NetGear DGN1000 has a security bypass vulnerability. After setting the \"currentsetting.htm\" GET parameter, the application device incorrectly restricts access to the setup.cgi script, allowing an attacker to exploit the vulnerability for unauthorized operations, such as executing arbitrary OS commands.
| VAR-201404-0120 | CVE-2013-5948 | ASUS RT-N56U Router Remote Command Injection Vulnerability |
CVSS V2: 8.5 CVSS V3: - Severity: HIGH |
The Network Analysis tab (Main_Analysis_Content.asp) in the ASUS RT-AC68U and other RT series routers with firmware before 3.0.0.4.374.5047 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the Target field (destIP parameter). ASUS RT-N56U is a wireless router product from ASUS Taiwan.
A remote command injection vulnerability exists in the ASUS RT-N56U router, which originated from the program's incorrect filtering of user-submitted input. An attacker could use this vulnerability to execute arbitrary commands in the context of an affected device. This vulnerability exists in ASUS RT-N56U routers running version 3.0.0.4.360 firmware. This may facilitate a complete compromise of an affected device
| VAR-201306-0137 | CVE-2013-1205 | Cisco WebEx Meetings Server of Event Center Vulnerability to break host key and event password in module |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
The Event Center module in Cisco WebEx Meetings Server does not perform request authentication in all intended circumstances, which allows remote attackers to discover host keys and event passwords via crafted URLs, aka Bug ID CSCue62485. Vendors have confirmed this vulnerability Bug ID CSCue62485 It is released as.Skillfully crafted by a third party URL The host key and event password may be broken through. Cisco WebEx Meetings Server is prone to an information-disclosure vulnerability.
Successfully exploiting this issue may allow an attacker to obtain sensitive information that may aid in further attacks.
Cisco WebEx Meetings Server 1.0 is vulnerable. Cisco WebEx is a set of Web conferencing tools developed by American Cisco (Cisco), which can assist office workers in different places to coordinate and cooperate. WebEx services include Web conferencing, telepresence video conferencing and enterprise instant messaging (IM)
| VAR-201306-0374 | No CVE | Parallels Plesk Panel Arbitrary PHP Code injection vulnerability |
CVSS V2: 7.5 CVSS V3: - Severity: HIGH |
Parallels Plesk Panel has an incorrect configuration that incorrectly references '/usr/bin' when calling the PHP path, allowing remote attackers to exploit the vulnerability to submit special requests to execute arbitrary OS commands with WEB privileges. Parallels Plesk Panel is a host control panel solution from Parallels, USA. The solution supports web tools, built-in virtualization, customer experience, and more.
An arbitrary PHP code injection vulnerability exists in Parallels Plesk Panel, which stems from the program's insufficient filtering of user-submitted input. An attacker could use this vulnerability to execute arbitrary PHP code in the context of an affected application. Vulnerabilities exist in the following versions: Parallels Plesk Panel 9.5.4, Parallels Plesk Panel 9.3, Parallels Plesk Panel 9.2, Parallels Plesk Panel 9.0, and Parallels Plesk Panel 8.6
| VAR-201306-0224 | CVE-2013-1009 | Apple Safari Used in products such as WebKit Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
WebKit, as used in Apple Safari before 6.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2013-1023. This vulnerability CVE-2013-1023 Is a different vulnerability. Apple Safari is prone to a memory-corruption vulnerability.
Attackers can exploit this issue to execute arbitrary code within the context of the user running the affected application. Failed exploit attempts will likely cause denial-of-service conditions.
Versions prior to Safari 6.0.5 are vulnerable.
Note: This issue was previously covered in BID 60330 (Apple Safari Prior to 6.0.5 Multiple Security Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-06-04-2 Safari 6.0.5
Safari 6.0.5 is now available and addresses the following:
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2013-0879 : Atte Kettunen of OUSPG
CVE-2013-0991 : Jay Civelli of the Chromium development community
CVE-2013-0992 : Google Chrome Security Team (Martin Barbella)
CVE-2013-0993 : Google Chrome Security Team (Inferno)
CVE-2013-0994 : David German of Google
CVE-2013-0995 : Google Chrome Security Team (Inferno)
CVE-2013-0996 : Google Chrome Security Team (Inferno)
CVE-2013-0997 : Vitaliy Toropov working with HP's Zero Day Initiative
CVE-2013-0998 : pa_kt working with HP's Zero Day Initiative
CVE-2013-0999 : pa_kt working with HP's Zero Day Initiative
CVE-2013-1000 : Fermin J. Serna of the Google Security Team
CVE-2013-1001 : Ryan Humenick
CVE-2013-1002 : Sergey Glazunov
CVE-2013-1003 : Google Chrome Security Team (Inferno)
CVE-2013-1004 : Google Chrome Security Team (Martin Barbella)
CVE-2013-1005 : Google Chrome Security Team (Martin Barbella)
CVE-2013-1006 : Google Chrome Security Team (Martin Barbella)
CVE-2013-1007 : Google Chrome Security Team (Inferno)
CVE-2013-1008 : Sergey Glazunov
CVE-2013-1009 : Apple
CVE-2013-1010 : miaubiz
CVE-2013-1011 : Google Chrome Security Team (Inferno)
CVE-2013-1023 : Google Chrome Security Team (Inferno)
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A cross-site scripting issue existed in the handling of
iframes. This issue was addressed through improved origin tracking.
CVE-ID
CVE-2013-1012 : Subodh Iyengar and Erling Ellingsen of Facebook
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Copying and pasting a malicious HTML snippet may lead to a
cross-site scripting attack
Description: A cross-site scripting issue existed in the handling of
copied and pasted data in HTML documents. This issue was addressed
through additional validation of pasted content.
CVE-ID
CVE-2013-0926 : Aditya Gupta, Subho Halder, and Dev Kar of xys3c
(xysec.com)
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Following a maliciously crafted link could lead to
unexpected behavior on the target site
Description: XSS Auditor may rewrite URLs to prevent cross-site
scripting attacks. This may lead to a malicious alteration of the
behavior of a form submission. This issue was addressed through
improved validation of URLs.
CVE-ID
CVE-2013-1013 : Sam Power of Pentest Limited
For OS X Lion systems Safari 6.0.5 is available via
the Apple Software Update application.
For OS X Mountain Lion systems Safari 6.0.5 is included with
OS X v10.8.4.
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRrjeeAAoJEPefwLHPlZEwCm4P/3WseW2DFgYieiAHghpGQ07e
/XuNWzqld4CpXyFUQDkw55DU1Y9dVIIl663rSR0VyXJDB5dMh6iHEBRHX4tarGym
beZS0cDuakospFtX4MZgcKXu/8cV7b8lq9tzqH0pL419a61Fjhm1eRfDeM3snXkO
kNCRi3nqOCmMroUiY+cJlKHi1x/t+2whISSM3QsIgpU5yyjEU3neMy2TPjuxC48h
XZr9XaDX5cztv0MWCX+jkv+OpYPxVtPxBVw6rPLaX2eg7iwBM6yDbLF5i/4oY06t
HzF2uCk8TlbFdk05Cr7HxmYV2qBei8VkcO1Mc4Ij3v3Q9iiKBRkr+d0CYQ1HSkrY
igfCmfDiEpaKZfzCgwRsVFZ/UhuXTDipTFIzKrZSlbsglVyIQJtKVyyWEZDOKcYL
kKCAS+ep0UyFIyeCCjFknd2hMneMR7a4u2XGJm1VtfRCA+ed3Cr0ROS+O9viGjYi
Qcm+2yzlWg9vpfojv+uX+aqh6IsprhfqXuF4ypM6D98IQ3fJqx9a0tVIPniFaLuP
O39M+UGtPLAw7BMiKkb4XyEajKFwJt1pfddWkC1YjKjtyRGf62BDOtY2KqEsyzpF
5nOzM3Vc+3urbur+69oqJLwRwC/PHkh1ym3LjrmqUW7+okckIGCQGt3iUwIWNKhp
2YgKISKdQYxVSfkzkqYY
=jk2e
-----END PGP SIGNATURE-----
| VAR-201306-0223 | CVE-2013-1013 | Apple Safari Used in products such as WebKit of XSS Auditor Vulnerabilities triggered by unintended form submission |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
XSS Auditor in WebKit in Apple Safari before 6.0.5 does not properly rewrite URLs, which allows remote attackers to trigger unintended form submissions via unspecified vectors. This vulnerability Webkit Vulnerability in Webkit Other products that use may also be affected.An unintended form submission may be triggered by a third party. WebKit is prone to an unspecified cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Note: This issue was previously covered in BID 60330 (Apple Safari Prior to 6.0.5 Multiple Security Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. A remote attacker could exploit this vulnerability to trigger unscheduled form submissions. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-06-04-2 Safari 6.0.5
Safari 6.0.5 is now available and addresses the following:
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2013-0879 : Atte Kettunen of OUSPG
CVE-2013-0991 : Jay Civelli of the Chromium development community
CVE-2013-0992 : Google Chrome Security Team (Martin Barbella)
CVE-2013-0993 : Google Chrome Security Team (Inferno)
CVE-2013-0994 : David German of Google
CVE-2013-0995 : Google Chrome Security Team (Inferno)
CVE-2013-0996 : Google Chrome Security Team (Inferno)
CVE-2013-0997 : Vitaliy Toropov working with HP's Zero Day Initiative
CVE-2013-0998 : pa_kt working with HP's Zero Day Initiative
CVE-2013-0999 : pa_kt working with HP's Zero Day Initiative
CVE-2013-1000 : Fermin J. Serna of the Google Security Team
CVE-2013-1001 : Ryan Humenick
CVE-2013-1002 : Sergey Glazunov
CVE-2013-1003 : Google Chrome Security Team (Inferno)
CVE-2013-1004 : Google Chrome Security Team (Martin Barbella)
CVE-2013-1005 : Google Chrome Security Team (Martin Barbella)
CVE-2013-1006 : Google Chrome Security Team (Martin Barbella)
CVE-2013-1007 : Google Chrome Security Team (Inferno)
CVE-2013-1008 : Sergey Glazunov
CVE-2013-1009 : Apple
CVE-2013-1010 : miaubiz
CVE-2013-1011 : Google Chrome Security Team (Inferno)
CVE-2013-1023 : Google Chrome Security Team (Inferno)
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A cross-site scripting issue existed in the handling of
iframes. This issue was addressed through improved origin tracking.
CVE-ID
CVE-2013-1012 : Subodh Iyengar and Erling Ellingsen of Facebook
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Copying and pasting a malicious HTML snippet may lead to a
cross-site scripting attack
Description: A cross-site scripting issue existed in the handling of
copied and pasted data in HTML documents. This issue was addressed
through additional validation of pasted content.
CVE-ID
CVE-2013-0926 : Aditya Gupta, Subho Halder, and Dev Kar of xys3c
(xysec.com)
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Following a maliciously crafted link could lead to
unexpected behavior on the target site
Description: XSS Auditor may rewrite URLs to prevent cross-site
scripting attacks. This may lead to a malicious alteration of the
behavior of a form submission. This issue was addressed through
improved validation of URLs.
CVE-ID
CVE-2013-1013 : Sam Power of Pentest Limited
For OS X Lion systems Safari 6.0.5 is available via
the Apple Software Update application.
For OS X Mountain Lion systems Safari 6.0.5 is included with
OS X v10.8.4.
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRrjeeAAoJEPefwLHPlZEwCm4P/3WseW2DFgYieiAHghpGQ07e
/XuNWzqld4CpXyFUQDkw55DU1Y9dVIIl663rSR0VyXJDB5dMh6iHEBRHX4tarGym
beZS0cDuakospFtX4MZgcKXu/8cV7b8lq9tzqH0pL419a61Fjhm1eRfDeM3snXkO
kNCRi3nqOCmMroUiY+cJlKHi1x/t+2whISSM3QsIgpU5yyjEU3neMy2TPjuxC48h
XZr9XaDX5cztv0MWCX+jkv+OpYPxVtPxBVw6rPLaX2eg7iwBM6yDbLF5i/4oY06t
HzF2uCk8TlbFdk05Cr7HxmYV2qBei8VkcO1Mc4Ij3v3Q9iiKBRkr+d0CYQ1HSkrY
igfCmfDiEpaKZfzCgwRsVFZ/UhuXTDipTFIzKrZSlbsglVyIQJtKVyyWEZDOKcYL
kKCAS+ep0UyFIyeCCjFknd2hMneMR7a4u2XGJm1VtfRCA+ed3Cr0ROS+O9viGjYi
Qcm+2yzlWg9vpfojv+uX+aqh6IsprhfqXuF4ypM6D98IQ3fJqx9a0tVIPniFaLuP
O39M+UGtPLAw7BMiKkb4XyEajKFwJt1pfddWkC1YjKjtyRGf62BDOtY2KqEsyzpF
5nOzM3Vc+3urbur+69oqJLwRwC/PHkh1ym3LjrmqUW7+okckIGCQGt3iUwIWNKhp
2YgKISKdQYxVSfkzkqYY
=jk2e
-----END PGP SIGNATURE-----
| VAR-201306-0222 | CVE-2013-1012 | Apple Safari Used in products such as WebKit Vulnerable to cross-site scripting |
CVSS V2: 4.3 CVSS V3: - Severity: MEDIUM |
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 6.0.5 allows remote attackers to inject arbitrary web script or HTML via vectors involving IFRAME elements.
An attacker may leverage this issue to execute arbitrary script code in an unsuspecting user's browser in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Note: This issue was previously covered in BID 60330 (Apple Safari Prior to 6.0.5 Multiple Security Vulnerabilities), but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-06-04-2 Safari 6.0.5
Safari 6.0.5 is now available and addresses the following:
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2013-0879 : Atte Kettunen of OUSPG
CVE-2013-0991 : Jay Civelli of the Chromium development community
CVE-2013-0992 : Google Chrome Security Team (Martin Barbella)
CVE-2013-0993 : Google Chrome Security Team (Inferno)
CVE-2013-0994 : David German of Google
CVE-2013-0995 : Google Chrome Security Team (Inferno)
CVE-2013-0996 : Google Chrome Security Team (Inferno)
CVE-2013-0997 : Vitaliy Toropov working with HP's Zero Day Initiative
CVE-2013-0998 : pa_kt working with HP's Zero Day Initiative
CVE-2013-0999 : pa_kt working with HP's Zero Day Initiative
CVE-2013-1000 : Fermin J. Serna of the Google Security Team
CVE-2013-1001 : Ryan Humenick
CVE-2013-1002 : Sergey Glazunov
CVE-2013-1003 : Google Chrome Security Team (Inferno)
CVE-2013-1004 : Google Chrome Security Team (Martin Barbella)
CVE-2013-1005 : Google Chrome Security Team (Martin Barbella)
CVE-2013-1006 : Google Chrome Security Team (Martin Barbella)
CVE-2013-1007 : Google Chrome Security Team (Inferno)
CVE-2013-1008 : Sergey Glazunov
CVE-2013-1009 : Apple
CVE-2013-1010 : miaubiz
CVE-2013-1011 : Google Chrome Security Team (Inferno)
CVE-2013-1023 : Google Chrome Security Team (Inferno)
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A cross-site scripting issue existed in the handling of
iframes. This issue was addressed through improved origin tracking.
CVE-ID
CVE-2013-1012 : Subodh Iyengar and Erling Ellingsen of Facebook
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Copying and pasting a malicious HTML snippet may lead to a
cross-site scripting attack
Description: A cross-site scripting issue existed in the handling of
copied and pasted data in HTML documents. This issue was addressed
through additional validation of pasted content.
CVE-ID
CVE-2013-0926 : Aditya Gupta, Subho Halder, and Dev Kar of xys3c
(xysec.com)
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Following a maliciously crafted link could lead to
unexpected behavior on the target site
Description: XSS Auditor may rewrite URLs to prevent cross-site
scripting attacks. This may lead to a malicious alteration of the
behavior of a form submission. This issue was addressed through
improved validation of URLs.
CVE-ID
CVE-2013-1013 : Sam Power of Pentest Limited
For OS X Lion systems Safari 6.0.5 is available via
the Apple Software Update application.
For OS X Mountain Lion systems Safari 6.0.5 is included with
OS X v10.8.4.
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRrjeeAAoJEPefwLHPlZEwCm4P/3WseW2DFgYieiAHghpGQ07e
/XuNWzqld4CpXyFUQDkw55DU1Y9dVIIl663rSR0VyXJDB5dMh6iHEBRHX4tarGym
beZS0cDuakospFtX4MZgcKXu/8cV7b8lq9tzqH0pL419a61Fjhm1eRfDeM3snXkO
kNCRi3nqOCmMroUiY+cJlKHi1x/t+2whISSM3QsIgpU5yyjEU3neMy2TPjuxC48h
XZr9XaDX5cztv0MWCX+jkv+OpYPxVtPxBVw6rPLaX2eg7iwBM6yDbLF5i/4oY06t
HzF2uCk8TlbFdk05Cr7HxmYV2qBei8VkcO1Mc4Ij3v3Q9iiKBRkr+d0CYQ1HSkrY
igfCmfDiEpaKZfzCgwRsVFZ/UhuXTDipTFIzKrZSlbsglVyIQJtKVyyWEZDOKcYL
kKCAS+ep0UyFIyeCCjFknd2hMneMR7a4u2XGJm1VtfRCA+ed3Cr0ROS+O9viGjYi
Qcm+2yzlWg9vpfojv+uX+aqh6IsprhfqXuF4ypM6D98IQ3fJqx9a0tVIPniFaLuP
O39M+UGtPLAw7BMiKkb4XyEajKFwJt1pfddWkC1YjKjtyRGf62BDOtY2KqEsyzpF
5nOzM3Vc+3urbur+69oqJLwRwC/PHkh1ym3LjrmqUW7+okckIGCQGt3iUwIWNKhp
2YgKISKdQYxVSfkzkqYY
=jk2e
-----END PGP SIGNATURE-----
| VAR-201306-0035 | CVE-2013-1023 | Apple Safari Used in products such as WebKit Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
WebKit, as used in Apple Safari before 6.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2013-1009. This vulnerability CVE-2013-1009 Is a different vulnerability. Apple Safari is prone to a memory-corruption vulnerability.
Attackers can exploit this issue to execute arbitrary code within the context of the user running the affected application. Failed exploit attempts will likely cause denial-of-service conditions.
Versions prior to Safari 6.0.5 are vulnerable.
Note: This issue was previously covered in BID 60330 (Apple Safari Prior to 6.0.5 Multiple Security Vulnerabilities) but has been given its own record to better document it. WebKit is a set of open source web browser engines jointly developed by companies such as KDE, Apple (Apple), and Google (Google), and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-06-04-2 Safari 6.0.5
Safari 6.0.5 is now available and addresses the following:
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: Multiple memory corruption issues existed in WebKit.
These issues were addressed through improved memory handling.
CVE-ID
CVE-2013-0879 : Atte Kettunen of OUSPG
CVE-2013-0991 : Jay Civelli of the Chromium development community
CVE-2013-0992 : Google Chrome Security Team (Martin Barbella)
CVE-2013-0993 : Google Chrome Security Team (Inferno)
CVE-2013-0994 : David German of Google
CVE-2013-0995 : Google Chrome Security Team (Inferno)
CVE-2013-0996 : Google Chrome Security Team (Inferno)
CVE-2013-0997 : Vitaliy Toropov working with HP's Zero Day Initiative
CVE-2013-0998 : pa_kt working with HP's Zero Day Initiative
CVE-2013-0999 : pa_kt working with HP's Zero Day Initiative
CVE-2013-1000 : Fermin J. Serna of the Google Security Team
CVE-2013-1001 : Ryan Humenick
CVE-2013-1002 : Sergey Glazunov
CVE-2013-1003 : Google Chrome Security Team (Inferno)
CVE-2013-1004 : Google Chrome Security Team (Martin Barbella)
CVE-2013-1005 : Google Chrome Security Team (Martin Barbella)
CVE-2013-1006 : Google Chrome Security Team (Martin Barbella)
CVE-2013-1007 : Google Chrome Security Team (Inferno)
CVE-2013-1008 : Sergey Glazunov
CVE-2013-1009 : Apple
CVE-2013-1010 : miaubiz
CVE-2013-1011 : Google Chrome Security Team (Inferno)
CVE-2013-1023 : Google Chrome Security Team (Inferno)
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Visiting a maliciously crafted website may lead to a cross-
site scripting attack
Description: A cross-site scripting issue existed in the handling of
iframes. This issue was addressed through improved origin tracking.
CVE-ID
CVE-2013-1012 : Subodh Iyengar and Erling Ellingsen of Facebook
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Copying and pasting a malicious HTML snippet may lead to a
cross-site scripting attack
Description: A cross-site scripting issue existed in the handling of
copied and pasted data in HTML documents. This issue was addressed
through additional validation of pasted content.
CVE-ID
CVE-2013-0926 : Aditya Gupta, Subho Halder, and Dev Kar of xys3c
(xysec.com)
WebKit
Available for: OS X Lion v10.7.5, OS X Lion Server v10.7.5,
OS X Mountain Lion v10.8.3
Impact: Following a maliciously crafted link could lead to
unexpected behavior on the target site
Description: XSS Auditor may rewrite URLs to prevent cross-site
scripting attacks. This may lead to a malicious alteration of the
behavior of a form submission. This issue was addressed through
improved validation of URLs.
CVE-ID
CVE-2013-1013 : Sam Power of Pentest Limited
For OS X Lion systems Safari 6.0.5 is available via
the Apple Software Update application.
For OS X Mountain Lion systems Safari 6.0.5 is included with
OS X v10.8.4.
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRrjeeAAoJEPefwLHPlZEwCm4P/3WseW2DFgYieiAHghpGQ07e
/XuNWzqld4CpXyFUQDkw55DU1Y9dVIIl663rSR0VyXJDB5dMh6iHEBRHX4tarGym
beZS0cDuakospFtX4MZgcKXu/8cV7b8lq9tzqH0pL419a61Fjhm1eRfDeM3snXkO
kNCRi3nqOCmMroUiY+cJlKHi1x/t+2whISSM3QsIgpU5yyjEU3neMy2TPjuxC48h
XZr9XaDX5cztv0MWCX+jkv+OpYPxVtPxBVw6rPLaX2eg7iwBM6yDbLF5i/4oY06t
HzF2uCk8TlbFdk05Cr7HxmYV2qBei8VkcO1Mc4Ij3v3Q9iiKBRkr+d0CYQ1HSkrY
igfCmfDiEpaKZfzCgwRsVFZ/UhuXTDipTFIzKrZSlbsglVyIQJtKVyyWEZDOKcYL
kKCAS+ep0UyFIyeCCjFknd2hMneMR7a4u2XGJm1VtfRCA+ed3Cr0ROS+O9viGjYi
Qcm+2yzlWg9vpfojv+uX+aqh6IsprhfqXuF4ypM6D98IQ3fJqx9a0tVIPniFaLuP
O39M+UGtPLAw7BMiKkb4XyEajKFwJt1pfddWkC1YjKjtyRGf62BDOtY2KqEsyzpF
5nOzM3Vc+3urbur+69oqJLwRwC/PHkh1ym3LjrmqUW7+okckIGCQGt3iUwIWNKhp
2YgKISKdQYxVSfkzkqYY
=jk2e
-----END PGP SIGNATURE-----
| VAR-201401-0088 | CVE-2013-2139 | SRTP of Libsrtp of srtp.c Vulnerable to buffer overflow |
CVSS V2: 2.6 CVSS V3: - Severity: LOW |
Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions. libsrtp is prone to a buffer-overflow vulnerability.
Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will result in denial-of-service conditions. RTP is used for Voice over IP (VoIP) and audio and video streaming. SRTP adds privacy and authentication. There are buffer overflow vulnerabilities in the 'crypto_policy_set_from_profile_for_rtp' and 'srtp_protect' functions in the srtp.c file of the libsrtp library in srtp 1.4.5 and earlier versions.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2139
http://advisories.mageia.org/MGASA-2014-0465.html
_______________________________________________________________________
Updated Packages:
Mandriva Business Server 1/X86_64:
e0447c9fa33ab8edce9657a5dce43fc7 mbs1/x86_64/srtp-1.4.4-3.1.mbs1.x86_64.rpm
745fcb1bd29913e979132a27511dd807 mbs1/SRPMS/srtp-1.4.4-3.1.mbs1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-2840-1 security@debian.org
http://www.debian.org/security/ Salvatore Bonaccorso
January 10, 2014 http://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : srtp
Vulnerability : buffer overflow
Problem type : remote
Debian-specific: no
CVE ID : CVE-2013-2139
Debian Bug : 711163
Fernando Russ from Groundworks Technologies reported a buffer overflow
flaw in srtp, Cisco's reference implementation of the Secure Real-time
Transport Protocol (SRTP), in how the
crypto_policy_set_from_profile_for_rtp() function applies
cryptographic profiles to an srtp_policy.
For the oldstable distribution (squeeze), this problem has been fixed in
version 1.4.4~dfsg-6+deb6u1.
For the stable distribution (wheezy), this problem has been fixed in
version 1.4.4+20100615~dfsg-2+deb7u1.
For the testing distribution (jessie), this problem has been fixed in
version 1.4.5~20130609~dfsg-1.
For the unstable distribution (sid), this problem has been fixed in
version 1.4.5~20130609~dfsg-1.
We recommend that you upgrade your srtp packages. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: libsrtp security and bug fix update
Advisory ID: RHSA-2020:3873-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:3873
Issue date: 2020-09-29
CVE Names: CVE-2013-2139 CVE-2015-6360
====================================================================
1. Summary:
An update for libsrtp is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64
3. Description:
The libsrtp package provides an implementation of the Secure Real-time
Transport Protocol (SRTP), the Universal Security Transform (UST), and a
supporting cryptographic kernel.
Security Fix(es):
* libsrtp: improper handling of CSRC count and extension header length in
RTP header (CVE-2015-6360)
* libsrtp: buffer overflow in application of crypto profiles
(CVE-2013-2139)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.9 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
970697 - CVE-2013-2139 libsrtp: buffer overflow in application of crypto profiles
1301202 - libsrtp global-buffer-overflow
1323702 - CVE-2015-6360 libsrtp: improper handling of CSRC count and extension header length in RTP header
1323705 - CVE-2015-6360 libsrtp: improper handling of CSRC count and extension header length in RTP header [rhel-7]
6. Package List:
Red Hat Enterprise Linux Client (v. 7):
Source:
libsrtp-1.4.4-11.20101004cvs.el7.src.rpm
x86_64:
libsrtp-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-1.4.4-11.20101004cvs.el7.x86_64.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
x86_64:
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.x86_64.rpm
libsrtp-devel-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-devel-1.4.4-11.20101004cvs.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source:
libsrtp-1.4.4-11.20101004cvs.el7.src.rpm
x86_64:
libsrtp-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-1.4.4-11.20101004cvs.el7.x86_64.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
x86_64:
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.x86_64.rpm
libsrtp-devel-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-devel-1.4.4-11.20101004cvs.el7.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source:
libsrtp-1.4.4-11.20101004cvs.el7.src.rpm
ppc64:
libsrtp-1.4.4-11.20101004cvs.el7.ppc.rpm
libsrtp-1.4.4-11.20101004cvs.el7.ppc64.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.ppc.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.ppc64.rpm
ppc64le:
libsrtp-1.4.4-11.20101004cvs.el7.ppc64le.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.ppc64le.rpm
s390x:
libsrtp-1.4.4-11.20101004cvs.el7.s390.rpm
libsrtp-1.4.4-11.20101004cvs.el7.s390x.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.s390.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.s390x.rpm
x86_64:
libsrtp-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-1.4.4-11.20101004cvs.el7.x86_64.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
ppc64:
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.ppc.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.ppc64.rpm
libsrtp-devel-1.4.4-11.20101004cvs.el7.ppc.rpm
libsrtp-devel-1.4.4-11.20101004cvs.el7.ppc64.rpm
ppc64le:
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.ppc64le.rpm
libsrtp-devel-1.4.4-11.20101004cvs.el7.ppc64le.rpm
s390x:
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.s390.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.s390x.rpm
libsrtp-devel-1.4.4-11.20101004cvs.el7.s390.rpm
libsrtp-devel-1.4.4-11.20101004cvs.el7.s390x.rpm
x86_64:
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.x86_64.rpm
libsrtp-devel-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-devel-1.4.4-11.20101004cvs.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source:
libsrtp-1.4.4-11.20101004cvs.el7.src.rpm
x86_64:
libsrtp-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-1.4.4-11.20101004cvs.el7.x86_64.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64:
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-debuginfo-1.4.4-11.20101004cvs.el7.x86_64.rpm
libsrtp-devel-1.4.4-11.20101004cvs.el7.i686.rpm
libsrtp-devel-1.4.4-11.20101004cvs.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2013-2139
https://access.redhat.com/security/cve/CVE-2015-6360
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBX3OeoNzjgjWX9erEAQiDzQ/+IXUAdmMRlgeg/t8Z+ApQ4ur4BxO/WRBl
5Nd8anDnQzl3uduHgXz7AcsbON2M/jWq5xUfgdydHT8fEQ7g814QbTeNMsbEQ1zS
Cuv1XztiGKy5fY5my3P80+kM+tL5uFfZ22oJqpSfS7sqGFzWEl1j+TldgURSva1G
XbNudX77Gp975wMDVPJlA9S9Puf59Cz6DQaoYu5Fqzwka8z1RWOdR1IfFlAcBGrO
NODvSxOZB+FDzvwikgoVTNay+e7ct+Yb1Ygg1nsGjyexinkchiuKDX2Mnv1Sc/JP
vaHARZmpN6llZ8Vo++hd8WGFhsIzocqF0dposlj/PmtuoFydu7x5zpluEFc2mVaM
pNCwzggc8BforUdoo6z27qqpiU0o/eTmVR97Jtbzm5BTs+28IGwg6iz374VdoAeP
wy1XTj2WBw0ys+0UVkAxwiSWit6RuPRhRf85B7IPsW1BwkvPm4nAi45+50cTUQ5S
PldnrWd9VILcfmj1ThdevaiFjkHrAZE4HFRxd1V3uIdIwZyvtP7w4wrt8ma51CyZ
isP53JER/PhJY4du3deCo4qqca5SyecLTj/gbqXoPQFn6ppUbNacWPwadjDRA5Nu
qPQVoSW8Z+L91vtqM+SGapuxNN0OuqiPFcWOlMyrM8R8MqKIhTQaTLQZE1vCJx5e
AhxrRaOeyWw=X+yJ
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201405-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: libSRTP: Denial of Service
Date: May 03, 2014
Bugs: #472302
ID: 201405-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
A vulnerability in libSRTP can result in a Denial of Service condition.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/libsrtp < 1.4.4_p20121108-r1>= 1.4.4_p20121108-r1
Description
===========
A flaw was found in how the crypto_policy_set_from_profile_for_rtp()
function applies cryptographic profiles to an srtp_policy in libSRTP.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All libSRTP users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot -v ">=net-libs/libsrtp-1.4.4_p20121108-r1"
References
==========
[ 1 ] CVE-2013-2139
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2139
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201405-02.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2014 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
| VAR-201308-0077 | CVE-2013-2576 | Artweaver Vulnerable to buffer overflow |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Buffer overflow in Artweaver before 3.1.6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted AWD file. Zavio IP Cameras are webcam products. In the Boa web server used by Zavio IP Cameras, there is an account in the configuration file 'boa.conf' which cannot be seen from the user web interface, but can access two files in '/cgi-bin/mft/' through this account. ('manufacture.cgi', 'wireless_mft.cgi'), one of the files has an OS command injection vulnerability. Can lead to illegal access to affected products. Artweaver is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.
Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed exploit attempts may result in a denial-of-service condition.
Artweaver 3.1.5 is vulnerable; other versions may also be affected. Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/
Artweaver Buffer Overflow Vulnerability
1. *Advisory Information*
Title: Artweaver Buffer Overflow Vulnerability
Advisory ID: CORE-2013-0701
Advisory URL:
http://www.coresecurity.com/advisories/artweaver-buffer-overflow-vulnerability
Date published: 2013-07-22
Date of last update: 2013-07-22
Vendors contacted: Artweaver
Release mode: Coordinated release
2. *Vulnerability Information*
Class: Buffer overflow [CWE-119]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2013-2576
3. *Vulnerability Description*
Artweaver [1], [2] is prone to a security vulnerability when processing
AWD files.
4. Artweaver v3.1.5.
5. *Non-Vulnerable Packages*
. Artweaver v3.1.6. Artweaver v4.0.
6. *Vendor Information, Solutions and Workarounds*
Vendor notifies that Artweaver v3.1.6 and v4.0 are available and fix the
reported vulnerability. Vendor encourages all Artweaver users to update
to the latest version:
1. http://www.artweaver.de/en/help/68
2. Artweaver Plus - http://www.artweaver.de/en/help/80
3. Artweaver Free - http://www.artweaver.de/en/help/81
7. *Credits*
This vulnerability was discovered and researched by Daniel Kazimirow
from Core Exploit Writers Team. The publication of this advisory was
coordinated by Fernando Miranda from Core Advisories Team.
8. *Technical Description / Proof of Concept Code*
Below is shown the result of opening the maliciously crafted file
'CORE-2013-0701-artweaver-poc-28ab190b137f3.AWD'[3], which means the
normal execution flow can be altered in order to execute arbitrary code.
/-----
004F3265 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004F3268 8B40 28 MOV EAX,DWORD PTR DS:[EAX+28]
004F326B 8B10 MOV EDX,DWORD PTR DS:[EAX]
004F326D FF12 CALL DWORD PTR DS:[EDX] ;
<--- crash
DS:[45454545]=???
EAX 030F9C48 ASCII
"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
ECX 019983F0
EDX 45454545
EBX 019983F0
ESP 0012FB7C
EBP 0012FB90
ESI 00000000
EDI 00000013
EIP 004F326D Artweave.004F326D
C 0 ES 0023 32bit 0(FFFFFFFF)
P 1 CS 001B 32bit 0(FFFFFFFF)
A 0 SS 0023 32bit 0(FFFFFFFF)
Z 0 DS 0023 32bit 0(FFFFFFFF)
S 0 FS 003B 32bit 7FFDF000(FFF)
T 0 GS 0000 NULL
D 0
O 0 LastErr ERROR_SUCCESS (00000000)
EFL 00010206 (NO,NB,NE,A,NS,PE,GE,G)
ST0 empty -??? FFFF 00005FEE 0F0566FB
ST1 empty -??? FFFF 00000000 0F05070D
ST2 empty -??? FFFF 00000000 00060010
ST3 empty -??? FFFF 00000000 002C006F
ST4 empty -NAN FFFF 8F669BF5 EFE5EDFD
ST5 empty 6.0925232094539560960e+16
ST6 empty -7.8331661972355807100e+18
ST7 empty 5.8691123250627328000e+16
3 2 1 0 E S P U O Z D I
FST 0020 Cond 0 0 0 0 Err 0 0 1 0 0 0 0 0 (GT)
FCW 1372 Prec NEAR,64 Mask 1 1 0 0 1 0
-----/
9. *Report Timeline*
. 2013-07-04:
Core Security Technologies notifies the Artweaver team of the
vulnerability. 2013-07-05:
Vendor asks for a report with technical information. 2013-07-05:
Technical details sent to Artweaver team. Core notifies that the
publication date is scheduled for the end of July. 2013-07-06:
Vendor reproduces the buffer overrun and notifies that they are looking
for the cause of the problem. 2013-07-10:
Vendor notifies that this vulnerability will be fixed with the next
Artweaver update v3.1.6, scheduled for July 20th. 2013-07-10:
Core re-schedules the advisory publication for Monday 22nd. 2013-07-20:
Vendor notifies patched versions were released and aditional information
for Artweaver users. [Sec. 6]
. 2013-07-22:
Advisory CORE-2013-0701 released.
10. *References*
[1] http://www.artweaver.de.
[2] http://www.b-e-soft.com/products#artweaver.
[3]
http://www.coresecurity.com/system/files/attachments/2013/07/CORE-2013-0701-artweaver-poc-28ab190b137f3.zip
11. *About CoreLabs*
CoreLabs, the research center of Core Security Technologies, is charged
with anticipating the future needs and requirements for information
security technologies. We conduct our research in several important
areas of computer security including system vulnerabilities, cyber
attack planning and simulation, source code auditing, and cryptography.
Our results include problem formalization, identification of
vulnerabilities, novel solutions and prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:
http://corelabs.coresecurity.com.
12. *About Core Security Technologies*
Core Security Technologies enables organizations to get ahead of threats
with security test and measurement solutions that continuously identify
and demonstrate real-world exposures to their most critical assets. Our
customers can gain real visibility into their security standing, real
validation of their security controls, and real metrics to more
effectively secure their organizations.
Core Security's software solutions build on over a decade of trusted
research and leading-edge threat expertise from the company's Security
Consulting Services, CoreLabs and Engineering groups. Core Security
Technologies can be reached at +1 (617) 399-6980 or on the Web at:
http://www.coresecurity.com.
13. *Disclaimer*
The contents of this advisory are copyright (c) 2013 Core Security
Technologies and (c) 2013 CoreLabs, and are licensed under a Creative
Commons Attribution Non-Commercial Share-Alike 3.0 (United States)
License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
14. *PGP/GPG Keys*
This advisory has been signed with the GPG key of Core Security
Technologies advisories team, which is available for download at
http://www.coresecurity.com/files/attachments/core_security_advisories.asc
| VAR-201306-0030 | CVE-2013-0985 | Apple Mac OS X of Disk Management Service disruption in (DoS) Vulnerabilities |
CVSS V2: 2.1 CVSS V3: - Severity: LOW |
Disk Management in Apple Mac OS X before 10.8.4 does not properly authenticate attempts to disable FileVault, which allows local users to cause a denial of service (loss of encryption functionality) via an unspecified command line.
Attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-06-04-1 OS X Mountain Lion v10.8.4 and Security Update
2013-002
OS X Mountain Lion v10.8.4 and Security Update 2013-002 is now
available and addresses the following:
CFNetwork
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: An attacker with access to a user's session may be able to
log into previously accessed sites, even if Private Browsing was used
Description: Permanent cookies were saved after quitting Safari,
even when Private Browsing was enabled. This issue was addressed by
improved handling of cookies.
CVE-ID
CVE-2013-0982 : Alexander Traud of www.traud.de
CoreAnimation
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: Visiting a maliciously crafted site may lead to an
unexpected application termination or arbitrary code execution
Description: An unbounded stack allocation issue existed in the
handling of text glyphs. This could be triggered by maliciously
crafted URLs in Safari. The issue was addressed through improved
bounds checking.
CVE-ID
CVE-2013-0983 : David Fifield of Stanford University, Ben Syverson
CoreMedia Playback
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: An uninitialized memory access issue existed in the
handling of text tracks. This issue was addressed by additional
validation of text tracks.
CVE-ID
CVE-2013-1024 : Richard Kuo and Billy Suguitan of Triemt Corporation
CUPS
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: A local user in the lpadmin group may be able to read or
write arbitrary files with system privileges
Description: A privilege escalation issue existed in the handling of
CUPS configuration via the CUPS web interface. A local user in the
lpadmin group may be able to read or write arbitrary files with
system privileges. This issue was addressed by moving certain
configuration directives to cups-files.conf, which can not be
modified from the CUPS web interface.
CVE-ID
CVE-2012-5519
Directory Service
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8
Impact: A remote attacker may execute arbitrary code with system
privileges on systems with Directory Service enabled
Description: An issue existed in the directory server's handling of
messages from the network. By sending a maliciously crafted message,
a remote attacker could cause the directory server to terminate or
execute arbitrary code with system privileges. This issue was
addressed through improved bounds checking. This issue does not
affect OS X Lion or OS X Mountain Lion systems. This issue was addressed by adding
additional authentication.
CVE-ID
CVE-2013-0985
OpenSSL
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: An attacker may be able to decrypt data protected by SSL
Description: There were known attacks on the confidentiality of TLS
1.0 when compression was enabled. This issue was addressed by
disabling compression in OpenSSL.
CVE-ID
CVE-2012-4929 : Juliano Rizzo and Thai Duong
OpenSSL
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Multiple vulnerabilities in OpenSSL
Description: OpenSSL was updated to version 0.9.8x to address
multiple vulnerabilities, which may lead to denial of service or
disclosure of a private key. Further information is available via the
OpenSSL website at http://www.openssl.org/news/
CVE-ID
CVE-2011-1945
CVE-2011-3207
CVE-2011-3210
CVE-2011-4108
CVE-2011-4109
CVE-2011-4576
CVE-2011-4577
CVE-2011-4619
CVE-2012-0050
CVE-2012-2110
CVE-2012-2131
CVE-2012-2333
QuickDraw Manager
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Opening a maliciously crafted PICT image may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of PICT
images. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0975 : Tobias Klein working with HP's Zero Day Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of 'enof'
atoms. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0986 : Tom Gallagher (Microsoft) & Paul Bates (Microsoft)
working with HP's Zero Day Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted QTIF file may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of
QTIF files. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2013-0987 : roob working with iDefense VCP
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted FPX file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of FPX files.
This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0988 : G. Geshev working with HP's Zero Day Initiative
QuickTime
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: Playing a maliciously crafted MP3 file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of MP3 files.
This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0989 : G. Geshev working with HP's Zero Day Initiative
Ruby
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8
Impact: Multiple vulnerabilities in Ruby on Rails
Description: Multiple vulnerabilities existed in Ruby on Rails, the
most serious of which may lead to arbitrary code execution on systems
running Ruby on Rails applications. These issues were addressed by
updating Ruby on Rails to version 2.3.18. This issue may affect OS X
Lion or OS X Mountain Lion systems that were upgraded from Mac OS X
10.6.8 or earlier. Users can update affected gems on such systems by
using the /usr/bin/gem utility.
CVE-ID
CVE-2013-0155
CVE-2013-0276
CVE-2013-0277
CVE-2013-0333
CVE-2013-1854
CVE-2013-1855
CVE-2013-1856
CVE-2013-1857
SMB
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: An authenticated user may be able to write files outside the
shared directory
Description: If SMB file sharing is enabled, an authenticated user
may be able to write files outside the shared directory. This issue
was addressed through improved access control.
CVE-ID
CVE-2013-0990 : Ward van Wanrooij
Note: Starting with OS X 10.8.4, Java Web Start (i.e. JNLP)
applications downloaded from the Internet need to be signed with
a Developer ID certificate. Gatekeeper will check downloaded
Java Web Start applications for a signature and block such
applications from launching if they are not properly signed.
Note: OS X Mountain Lion v10.8.4 includes the content of
Safari 6.0.5. For further details see "About the security content
of Safari 6.0.5" at http://http//support.apple.com/kb/HT5785
OS X Mountain Lion v10.8.4 and Security Update 2013-002 may be
obtained from the Software Update pane in System Preferences,
or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
The Software Update utility will present the update that applies
to your system configuration. Only one is needed, either
OS X Mountain Lion v10.8.4, or Security Update
2013-002.
For OS X Mountain Lion v10.8.3
The download file is named: OSXUpd10.8.4.dmg
Its SHA-1 digest is: 9cf99aa1293cefdac0fb9a24ea133c80f8237b5e
For OS X Mountain Lion v10.8 and v10.8.2
The download file is named: OSXUpdCombo10.8.4.dmg
Its SHA-1 digest is: 3c95d0c8d0c7f43339a5f4e137e386dd5fe409c3
For OS X Lion v10.7.5
The download file is named: SecUpd2013-002.dmg
Its SHA-1 digest is: cfc3bd0941d7c5838aee9e92ee087d78abff3ce7
For OS X Lion Server v10.7.5
The download file is named: SecUpdSrvr2013-002.dmg
Its SHA-1 digest is: 34dff575a145e13404e7a2ee8a390d3e7c56fb5e
For Mac OS X v10.6.8
The download file is named: SecUpd2013-002.dmg
Its SHA-1 digest is: 5da54b38ffb8c147925c3018a8f5bf30ad4ac5b1
For Mac OS X Server v10.6.8
The download file is named: SecUpdSrvr2013-002.dmg
Its SHA-1 digest is: b20271f019930fe894c2247a6d5e05f00568b583
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRrjkiAAoJEPefwLHPlZEwW+AP/0x/cHS3VPY0/a98Xpmdfkdb
eo9Ns5FKw6mIkUftrN6qwNAgFXWqQXNIbJ3q8ZnoxcFPakhYyPSp4XowpR79l7kG
B2ZrdTx9aIn2bfHZ+h4cE8XnVL8qUDz2RxFopOGbb+wpJxl8/fehDmWokC5wCeF5
N7mnwW2s37QL73BmAMRdi6CYcJCKwhZWGFWmqiNvpFlUP+kcjU/UM1MAzOu0xsiA
PD6NrWeUOWfFrcQgx/pspWGvrFyV4FLu+0wQBl9f/DiQNrwVXIr85rHtah+b1NCU
pteSxQwb4kRojXdPm4+I3LKoghzGR8xD6+Xl6KdYgReSW89Di4bKM3WpbRLqhRuq
8kv38Gk3/vZDfAnuNQX09dE6EgJ0DVu86SoRQZ1iYRQoLrizVsOvyVQUojZhT47t
6l44L/5cNJd7EcaC8hdmr44cCZdMPDEqoKzn2BavH62WYXbZMPlHBDo/H2ujUUec
i7XU7LA1Upw57X4wmIUU4QrlBhNBh39yRKh3katAklayFBjOMEyyL57gURvd6O77
gFOQpUQ6kgqwgQCrtNT6R96igfyu7cVxYW7XchZDHgA3n/YWOAVvXkVeeQ5OUGzC
O0UYLMBpPka31yfWP23QaXpV+LW462raI6LnMvRP1245RhokTTThZw6/9xochK2V
+VoeoamqaQqZGyOiObbU
=vG2v
-----END PGP SIGNATURE-----
| VAR-201306-0029 | CVE-2013-0984 | Apple Mac OS X Directory service vulnerable to arbitrary code execution |
CVSS V2: 9.3 CVSS V3: - Severity: HIGH |
Directory Service in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted message. Apple Mac OS X is prone to a remote buffer-overflow vulnerability.
An attacker can leverage this issue to execute arbitrary code within the context of the application. Failed exploit attempts will likely result in a denial-of-service condition.
The following versions are affected:
Mac OS X 10.6.8 Server
Mac OS X 10.6.7 Server
Mac OS X 10.6.6 Server
Mac OS X 10.6.5 Server
Mac OS X 10.6.4 Server
Mac OS X 10.6.3 Server
Mac OS X 10.6.2 Server
Mac OS X 10.6.1 Server
Mac OS X 10.6.0 Server. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-06-04-1 OS X Mountain Lion v10.8.4 and Security Update
2013-002
OS X Mountain Lion v10.8.4 and Security Update 2013-002 is now
available and addresses the following:
CFNetwork
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: An attacker with access to a user's session may be able to
log into previously accessed sites, even if Private Browsing was used
Description: Permanent cookies were saved after quitting Safari,
even when Private Browsing was enabled. This issue was addressed by
improved handling of cookies.
CVE-ID
CVE-2013-0982 : Alexander Traud of www.traud.de
CoreAnimation
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: Visiting a maliciously crafted site may lead to an
unexpected application termination or arbitrary code execution
Description: An unbounded stack allocation issue existed in the
handling of text glyphs. This could be triggered by maliciously
crafted URLs in Safari. The issue was addressed through improved
bounds checking.
CVE-ID
CVE-2013-0983 : David Fifield of Stanford University, Ben Syverson
CoreMedia Playback
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: An uninitialized memory access issue existed in the
handling of text tracks. This issue was addressed by additional
validation of text tracks.
CVE-ID
CVE-2013-1024 : Richard Kuo and Billy Suguitan of Triemt Corporation
CUPS
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: A local user in the lpadmin group may be able to read or
write arbitrary files with system privileges
Description: A privilege escalation issue existed in the handling of
CUPS configuration via the CUPS web interface. A local user in the
lpadmin group may be able to read or write arbitrary files with
system privileges. This issue was addressed by moving certain
configuration directives to cups-files.conf, which can not be
modified from the CUPS web interface. This issue was
addressed through improved bounds checking.
CVE-ID
CVE-2013-0984 : Nicolas Economou of Core Security
Disk Management
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: A local user may disable FileVault
Description: A local user who is not an administrator may disable
FileVault using the command-line. This issue was addressed by adding
additional authentication. This issue was addressed by
disabling compression in OpenSSL. Further information is available via the
OpenSSL website at http://www.openssl.org/news/
CVE-ID
CVE-2011-1945
CVE-2011-3207
CVE-2011-3210
CVE-2011-4108
CVE-2011-4109
CVE-2011-4576
CVE-2011-4577
CVE-2011-4619
CVE-2012-0050
CVE-2012-2110
CVE-2012-2131
CVE-2012-2333
QuickDraw Manager
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Opening a maliciously crafted PICT image may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of PICT
images. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0975 : Tobias Klein working with HP's Zero Day Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of 'enof'
atoms. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0986 : Tom Gallagher (Microsoft) & Paul Bates (Microsoft)
working with HP's Zero Day Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted QTIF file may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of
QTIF files. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2013-0987 : roob working with iDefense VCP
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted FPX file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of FPX files.
This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0988 : G. Geshev working with HP's Zero Day Initiative
QuickTime
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: Playing a maliciously crafted MP3 file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of MP3 files.
This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0989 : G. Geshev working with HP's Zero Day Initiative
Ruby
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8
Impact: Multiple vulnerabilities in Ruby on Rails
Description: Multiple vulnerabilities existed in Ruby on Rails, the
most serious of which may lead to arbitrary code execution on systems
running Ruby on Rails applications. These issues were addressed by
updating Ruby on Rails to version 2.3.18. Users can update affected gems on such systems by
using the /usr/bin/gem utility.
CVE-ID
CVE-2013-0155
CVE-2013-0276
CVE-2013-0277
CVE-2013-0333
CVE-2013-1854
CVE-2013-1855
CVE-2013-1856
CVE-2013-1857
SMB
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: An authenticated user may be able to write files outside the
shared directory
Description: If SMB file sharing is enabled, an authenticated user
may be able to write files outside the shared directory. This issue
was addressed through improved access control.
CVE-ID
CVE-2013-0990 : Ward van Wanrooij
Note: Starting with OS X 10.8.4, Java Web Start (i.e. JNLP)
applications downloaded from the Internet need to be signed with
a Developer ID certificate. Gatekeeper will check downloaded
Java Web Start applications for a signature and block such
applications from launching if they are not properly signed.
Note: OS X Mountain Lion v10.8.4 includes the content of
Safari 6.0.5. For further details see "About the security content
of Safari 6.0.5" at http://http//support.apple.com/kb/HT5785
OS X Mountain Lion v10.8.4 and Security Update 2013-002 may be
obtained from the Software Update pane in System Preferences,
or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
The Software Update utility will present the update that applies
to your system configuration. Only one is needed, either
OS X Mountain Lion v10.8.4, or Security Update
2013-002.
For OS X Mountain Lion v10.8.3
The download file is named: OSXUpd10.8.4.dmg
Its SHA-1 digest is: 9cf99aa1293cefdac0fb9a24ea133c80f8237b5e
For OS X Mountain Lion v10.8 and v10.8.2
The download file is named: OSXUpdCombo10.8.4.dmg
Its SHA-1 digest is: 3c95d0c8d0c7f43339a5f4e137e386dd5fe409c3
For OS X Lion v10.7.5
The download file is named: SecUpd2013-002.dmg
Its SHA-1 digest is: cfc3bd0941d7c5838aee9e92ee087d78abff3ce7
For OS X Lion Server v10.7.5
The download file is named: SecUpdSrvr2013-002.dmg
Its SHA-1 digest is: 34dff575a145e13404e7a2ee8a390d3e7c56fb5e
For Mac OS X v10.6.8
The download file is named: SecUpd2013-002.dmg
Its SHA-1 digest is: 5da54b38ffb8c147925c3018a8f5bf30ad4ac5b1
For Mac OS X Server v10.6.8
The download file is named: SecUpdSrvr2013-002.dmg
Its SHA-1 digest is: b20271f019930fe894c2247a6d5e05f00568b583
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRrjkiAAoJEPefwLHPlZEwW+AP/0x/cHS3VPY0/a98Xpmdfkdb
eo9Ns5FKw6mIkUftrN6qwNAgFXWqQXNIbJ3q8ZnoxcFPakhYyPSp4XowpR79l7kG
B2ZrdTx9aIn2bfHZ+h4cE8XnVL8qUDz2RxFopOGbb+wpJxl8/fehDmWokC5wCeF5
N7mnwW2s37QL73BmAMRdi6CYcJCKwhZWGFWmqiNvpFlUP+kcjU/UM1MAzOu0xsiA
PD6NrWeUOWfFrcQgx/pspWGvrFyV4FLu+0wQBl9f/DiQNrwVXIr85rHtah+b1NCU
pteSxQwb4kRojXdPm4+I3LKoghzGR8xD6+Xl6KdYgReSW89Di4bKM3WpbRLqhRuq
8kv38Gk3/vZDfAnuNQX09dE6EgJ0DVu86SoRQZ1iYRQoLrizVsOvyVQUojZhT47t
6l44L/5cNJd7EcaC8hdmr44cCZdMPDEqoKzn2BavH62WYXbZMPlHBDo/H2ujUUec
i7XU7LA1Upw57X4wmIUU4QrlBhNBh39yRKh3katAklayFBjOMEyyL57gURvd6O77
gFOQpUQ6kgqwgQCrtNT6R96igfyu7cVxYW7XchZDHgA3n/YWOAVvXkVeeQ5OUGzC
O0UYLMBpPka31yfWP23QaXpV+LW462raI6LnMvRP1245RhokTTThZw6/9xochK2V
+VoeoamqaQqZGyOiObbU
=vG2v
-----END PGP SIGNATURE-----
| VAR-201306-0036 | CVE-2013-1024 | Apple Mac OS X of CoreMedia Playback Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
CoreMedia Playback in Apple Mac OS X before 10.8.4 does not properly initialize memory during the processing of text tracks, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.
These issues affect OS X prior to 10.8.4. Apple Mac OS X is prone to a remote code execution vulnerability.
Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
Note: This issue was previously covered in BID 60329 (Apple Mac OS X Security Update 2013-002 Multiple Security Vulnerabilities), but has been given its own record to better document it. An
attacker with a privileged network position may inject arbitrary
contents. This issue was addressed by using an encrypted HTTPS
connection to retrieve tutorials.
CVE-ID
CVE-2013-1037 : Google Chrome Security Team
CVE-2013-1038 : Google Chrome Security Team
CVE-2013-1039 : own-hero Research working with iDefense VCP
CVE-2013-1040 : Google Chrome Security Team
CVE-2013-1041 : Google Chrome Security Team
CVE-2013-1042 : Google Chrome Security Team
CVE-2013-1043 : Google Chrome Security Team
CVE-2013-1044 : Apple
CVE-2013-1045 : Google Chrome Security Team
CVE-2013-1046 : Google Chrome Security Team
CVE-2013-1047 : miaubiz
CVE-2013-2842 : Cyril Cattiaux
CVE-2013-5125 : Google Chrome Security Team
CVE-2013-5126 : Apple
CVE-2013-5127 : Google Chrome Security Team
CVE-2013-5128 : Apple
libxml
Available for: Windows 8, Windows 7, Vista, XP SP2 or later
Impact: A man-in-the-middle attack while browsing the iTunes Store
via iTunes may lead to an unexpected application termination or
arbitrary code executionn
Description: Multiple memory corruption issues existed in libxml. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-06-04-1 OS X Mountain Lion v10.8.4 and Security Update
2013-002
OS X Mountain Lion v10.8.4 and Security Update 2013-002 is now
available and addresses the following:
CFNetwork
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: An attacker with access to a user's session may be able to
log into previously accessed sites, even if Private Browsing was used
Description: Permanent cookies were saved after quitting Safari,
even when Private Browsing was enabled. This issue was addressed by
improved handling of cookies.
CVE-ID
CVE-2013-0982 : Alexander Traud of www.traud.de
CoreAnimation
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: Visiting a maliciously crafted site may lead to an
unexpected application termination or arbitrary code execution
Description: An unbounded stack allocation issue existed in the
handling of text glyphs. This could be triggered by maliciously
crafted URLs in Safari. The issue was addressed through improved
bounds checking. This issue was addressed by additional
validation of text tracks.
CVE-ID
CVE-2013-1024 : Richard Kuo and Billy Suguitan of Triemt Corporation
CUPS
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: A local user in the lpadmin group may be able to read or
write arbitrary files with system privileges
Description: A privilege escalation issue existed in the handling of
CUPS configuration via the CUPS web interface. A local user in the
lpadmin group may be able to read or write arbitrary files with
system privileges. This issue was addressed by moving certain
configuration directives to cups-files.conf, which can not be
modified from the CUPS web interface. By sending a maliciously crafted message,
a remote attacker could cause the directory server to terminate or
execute arbitrary code with system privileges. This issue was
addressed through improved bounds checking.
CVE-ID
CVE-2013-0984 : Nicolas Economou of Core Security
Disk Management
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: A local user may disable FileVault
Description: A local user who is not an administrator may disable
FileVault using the command-line. This issue was addressed by adding
additional authentication. This issue was addressed by
disabling compression in OpenSSL. Further information is available via the
OpenSSL website at http://www.openssl.org/news/
CVE-ID
CVE-2011-1945
CVE-2011-3207
CVE-2011-3210
CVE-2011-4108
CVE-2011-4109
CVE-2011-4576
CVE-2011-4577
CVE-2011-4619
CVE-2012-0050
CVE-2012-2110
CVE-2012-2131
CVE-2012-2333
QuickDraw Manager
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Opening a maliciously crafted PICT image may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of PICT
images. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0975 : Tobias Klein working with HP's Zero Day Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of 'enof'
atoms. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0986 : Tom Gallagher (Microsoft) & Paul Bates (Microsoft)
working with HP's Zero Day Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted QTIF file may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of
QTIF files. This issue was addressed through improved bounds
checking.
This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0988 : G. Geshev working with HP's Zero Day Initiative
QuickTime
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: Playing a maliciously crafted MP3 file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of MP3 files.
This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0989 : G. Geshev working with HP's Zero Day Initiative
Ruby
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8
Impact: Multiple vulnerabilities in Ruby on Rails
Description: Multiple vulnerabilities existed in Ruby on Rails, the
most serious of which may lead to arbitrary code execution on systems
running Ruby on Rails applications. These issues were addressed by
updating Ruby on Rails to version 2.3.18. Users can update affected gems on such systems by
using the /usr/bin/gem utility.
CVE-ID
CVE-2013-0155
CVE-2013-0276
CVE-2013-0277
CVE-2013-0333
CVE-2013-1854
CVE-2013-1855
CVE-2013-1856
CVE-2013-1857
SMB
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: An authenticated user may be able to write files outside the
shared directory
Description: If SMB file sharing is enabled, an authenticated user
may be able to write files outside the shared directory. This issue
was addressed through improved access control.
CVE-ID
CVE-2013-0990 : Ward van Wanrooij
Note: Starting with OS X 10.8.4, Java Web Start (i.e. JNLP)
applications downloaded from the Internet need to be signed with
a Developer ID certificate. Gatekeeper will check downloaded
Java Web Start applications for a signature and block such
applications from launching if they are not properly signed.
Note: OS X Mountain Lion v10.8.4 includes the content of
Safari 6.0.5. For further details see "About the security content
of Safari 6.0.5" at http://http//support.apple.com/kb/HT5785
OS X Mountain Lion v10.8.4 and Security Update 2013-002 may be
obtained from the Software Update pane in System Preferences,
or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
The Software Update utility will present the update that applies
to your system configuration. Only one is needed, either
OS X Mountain Lion v10.8.4, or Security Update
2013-002.
For OS X Mountain Lion v10.8.3
The download file is named: OSXUpd10.8.4.dmg
Its SHA-1 digest is: 9cf99aa1293cefdac0fb9a24ea133c80f8237b5e
For OS X Mountain Lion v10.8 and v10.8.2
The download file is named: OSXUpdCombo10.8.4.dmg
Its SHA-1 digest is: 3c95d0c8d0c7f43339a5f4e137e386dd5fe409c3
For OS X Lion v10.7.5
The download file is named: SecUpd2013-002.dmg
Its SHA-1 digest is: cfc3bd0941d7c5838aee9e92ee087d78abff3ce7
For OS X Lion Server v10.7.5
The download file is named: SecUpdSrvr2013-002.dmg
Its SHA-1 digest is: 34dff575a145e13404e7a2ee8a390d3e7c56fb5e
For Mac OS X v10.6.8
The download file is named: SecUpd2013-002.dmg
Its SHA-1 digest is: 5da54b38ffb8c147925c3018a8f5bf30ad4ac5b1
For Mac OS X Server v10.6.8
The download file is named: SecUpdSrvr2013-002.dmg
Its SHA-1 digest is: b20271f019930fe894c2247a6d5e05f00568b583
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRrjkiAAoJEPefwLHPlZEwW+AP/0x/cHS3VPY0/a98Xpmdfkdb
eo9Ns5FKw6mIkUftrN6qwNAgFXWqQXNIbJ3q8ZnoxcFPakhYyPSp4XowpR79l7kG
B2ZrdTx9aIn2bfHZ+h4cE8XnVL8qUDz2RxFopOGbb+wpJxl8/fehDmWokC5wCeF5
N7mnwW2s37QL73BmAMRdi6CYcJCKwhZWGFWmqiNvpFlUP+kcjU/UM1MAzOu0xsiA
PD6NrWeUOWfFrcQgx/pspWGvrFyV4FLu+0wQBl9f/DiQNrwVXIr85rHtah+b1NCU
pteSxQwb4kRojXdPm4+I3LKoghzGR8xD6+Xl6KdYgReSW89Di4bKM3WpbRLqhRuq
8kv38Gk3/vZDfAnuNQX09dE6EgJ0DVu86SoRQZ1iYRQoLrizVsOvyVQUojZhT47t
6l44L/5cNJd7EcaC8hdmr44cCZdMPDEqoKzn2BavH62WYXbZMPlHBDo/H2ujUUec
i7XU7LA1Upw57X4wmIUU4QrlBhNBh39yRKh3katAklayFBjOMEyyL57gURvd6O77
gFOQpUQ6kgqwgQCrtNT6R96igfyu7cVxYW7XchZDHgA3n/YWOAVvXkVeeQ5OUGzC
O0UYLMBpPka31yfWP23QaXpV+LW462raI6LnMvRP1245RhokTTThZw6/9xochK2V
+VoeoamqaQqZGyOiObbU
=vG2v
-----END PGP SIGNATURE-----
| VAR-201306-0027 | CVE-2013-0982 | Apple Mac OS X of CFNetwork In Cookie Vulnerability that bypasses authentication |
CVSS V2: 1.7 CVSS V3: - Severity: LOW |
The Private Browsing feature in CFNetwork in Apple Mac OS X before 10.8.4 does not prevent storage of permanent cookies upon exit from Safari, which might allow physically proximate attackers to bypass cookie-based authentication by leveraging an unattended workstation. Apple Mac OS X is prone to multiple vulnerabilities.
Attackers can exploit these issues to execute arbitrary code, cause denial-of-service conditions, gain unauthorized access, obtain sensitive information, bypass security restrictions, and perform other attacks.
These issues affect OS X prior to 10.8.4.
Note: This issue was previously covered in BID 60329 (Apple Mac OS X Security Update 2013-002 Multiple Security Vulnerabilities) but has been given its own record to better document it. Attackers in physical proximity can use unattended workstations to bypass cookie-based authentication. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-06-04-1 OS X Mountain Lion v10.8.4 and Security Update
2013-002
OS X Mountain Lion v10.8.4 and Security Update 2013-002 is now
available and addresses the following:
CFNetwork
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: An attacker with access to a user's session may be able to
log into previously accessed sites, even if Private Browsing was used
Description: Permanent cookies were saved after quitting Safari,
even when Private Browsing was enabled. This issue was addressed by
improved handling of cookies.
CVE-ID
CVE-2013-0982 : Alexander Traud of www.traud.de
CoreAnimation
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: Visiting a maliciously crafted site may lead to an
unexpected application termination or arbitrary code execution
Description: An unbounded stack allocation issue existed in the
handling of text glyphs. This could be triggered by maliciously
crafted URLs in Safari. The issue was addressed through improved
bounds checking.
CVE-ID
CVE-2013-0983 : David Fifield of Stanford University, Ben Syverson
CoreMedia Playback
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: An uninitialized memory access issue existed in the
handling of text tracks. This issue was addressed by additional
validation of text tracks.
CVE-ID
CVE-2013-1024 : Richard Kuo and Billy Suguitan of Triemt Corporation
CUPS
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: A local user in the lpadmin group may be able to read or
write arbitrary files with system privileges
Description: A privilege escalation issue existed in the handling of
CUPS configuration via the CUPS web interface. A local user in the
lpadmin group may be able to read or write arbitrary files with
system privileges. This issue was addressed by moving certain
configuration directives to cups-files.conf, which can not be
modified from the CUPS web interface.
CVE-ID
CVE-2012-5519
Directory Service
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8
Impact: A remote attacker may execute arbitrary code with system
privileges on systems with Directory Service enabled
Description: An issue existed in the directory server's handling of
messages from the network. By sending a maliciously crafted message,
a remote attacker could cause the directory server to terminate or
execute arbitrary code with system privileges. This issue was
addressed through improved bounds checking.
CVE-ID
CVE-2013-0984 : Nicolas Economou of Core Security
Disk Management
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: A local user may disable FileVault
Description: A local user who is not an administrator may disable
FileVault using the command-line. This issue was addressed by adding
additional authentication. This issue was addressed by
disabling compression in OpenSSL. Further information is available via the
OpenSSL website at http://www.openssl.org/news/
CVE-ID
CVE-2011-1945
CVE-2011-3207
CVE-2011-3210
CVE-2011-4108
CVE-2011-4109
CVE-2011-4576
CVE-2011-4577
CVE-2011-4619
CVE-2012-0050
CVE-2012-2110
CVE-2012-2131
CVE-2012-2333
QuickDraw Manager
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Opening a maliciously crafted PICT image may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of PICT
images. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0975 : Tobias Klein working with HP's Zero Day Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of 'enof'
atoms. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0986 : Tom Gallagher (Microsoft) & Paul Bates (Microsoft)
working with HP's Zero Day Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted QTIF file may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of
QTIF files. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2013-0987 : roob working with iDefense VCP
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted FPX file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of FPX files.
This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0988 : G. Geshev working with HP's Zero Day Initiative
QuickTime
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: Playing a maliciously crafted MP3 file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of MP3 files.
This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0989 : G. Geshev working with HP's Zero Day Initiative
Ruby
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8
Impact: Multiple vulnerabilities in Ruby on Rails
Description: Multiple vulnerabilities existed in Ruby on Rails, the
most serious of which may lead to arbitrary code execution on systems
running Ruby on Rails applications. These issues were addressed by
updating Ruby on Rails to version 2.3.18. Users can update affected gems on such systems by
using the /usr/bin/gem utility.
CVE-ID
CVE-2013-0155
CVE-2013-0276
CVE-2013-0277
CVE-2013-0333
CVE-2013-1854
CVE-2013-1855
CVE-2013-1856
CVE-2013-1857
SMB
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: An authenticated user may be able to write files outside the
shared directory
Description: If SMB file sharing is enabled, an authenticated user
may be able to write files outside the shared directory. This issue
was addressed through improved access control.
CVE-ID
CVE-2013-0990 : Ward van Wanrooij
Note: Starting with OS X 10.8.4, Java Web Start (i.e. JNLP)
applications downloaded from the Internet need to be signed with
a Developer ID certificate. Gatekeeper will check downloaded
Java Web Start applications for a signature and block such
applications from launching if they are not properly signed.
Note: OS X Mountain Lion v10.8.4 includes the content of
Safari 6.0.5. For further details see "About the security content
of Safari 6.0.5" at http://http//support.apple.com/kb/HT5785
OS X Mountain Lion v10.8.4 and Security Update 2013-002 may be
obtained from the Software Update pane in System Preferences,
or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
The Software Update utility will present the update that applies
to your system configuration. Only one is needed, either
OS X Mountain Lion v10.8.4, or Security Update
2013-002.
For OS X Mountain Lion v10.8.3
The download file is named: OSXUpd10.8.4.dmg
Its SHA-1 digest is: 9cf99aa1293cefdac0fb9a24ea133c80f8237b5e
For OS X Mountain Lion v10.8 and v10.8.2
The download file is named: OSXUpdCombo10.8.4.dmg
Its SHA-1 digest is: 3c95d0c8d0c7f43339a5f4e137e386dd5fe409c3
For OS X Lion v10.7.5
The download file is named: SecUpd2013-002.dmg
Its SHA-1 digest is: cfc3bd0941d7c5838aee9e92ee087d78abff3ce7
For OS X Lion Server v10.7.5
The download file is named: SecUpdSrvr2013-002.dmg
Its SHA-1 digest is: 34dff575a145e13404e7a2ee8a390d3e7c56fb5e
For Mac OS X v10.6.8
The download file is named: SecUpd2013-002.dmg
Its SHA-1 digest is: 5da54b38ffb8c147925c3018a8f5bf30ad4ac5b1
For Mac OS X Server v10.6.8
The download file is named: SecUpdSrvr2013-002.dmg
Its SHA-1 digest is: b20271f019930fe894c2247a6d5e05f00568b583
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRrjkiAAoJEPefwLHPlZEwW+AP/0x/cHS3VPY0/a98Xpmdfkdb
eo9Ns5FKw6mIkUftrN6qwNAgFXWqQXNIbJ3q8ZnoxcFPakhYyPSp4XowpR79l7kG
B2ZrdTx9aIn2bfHZ+h4cE8XnVL8qUDz2RxFopOGbb+wpJxl8/fehDmWokC5wCeF5
N7mnwW2s37QL73BmAMRdi6CYcJCKwhZWGFWmqiNvpFlUP+kcjU/UM1MAzOu0xsiA
PD6NrWeUOWfFrcQgx/pspWGvrFyV4FLu+0wQBl9f/DiQNrwVXIr85rHtah+b1NCU
pteSxQwb4kRojXdPm4+I3LKoghzGR8xD6+Xl6KdYgReSW89Di4bKM3WpbRLqhRuq
8kv38Gk3/vZDfAnuNQX09dE6EgJ0DVu86SoRQZ1iYRQoLrizVsOvyVQUojZhT47t
6l44L/5cNJd7EcaC8hdmr44cCZdMPDEqoKzn2BavH62WYXbZMPlHBDo/H2ujUUec
i7XU7LA1Upw57X4wmIUU4QrlBhNBh39yRKh3katAklayFBjOMEyyL57gURvd6O77
gFOQpUQ6kgqwgQCrtNT6R96igfyu7cVxYW7XchZDHgA3n/YWOAVvXkVeeQ5OUGzC
O0UYLMBpPka31yfWP23QaXpV+LW462raI6LnMvRP1245RhokTTThZw6/9xochK2V
+VoeoamqaQqZGyOiObbU
=vG2v
-----END PGP SIGNATURE-----
| VAR-201306-0028 | CVE-2013-0983 | Apple Mac OS X of CoreAnimation Vulnerable to arbitrary code execution |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Stack consumption vulnerability in CoreAnimation in Apple Mac OS X before 10.8.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted text glyph in a URL encountered by Safari.
These issues affect OS X prior to 10.8.4. Apple Mac OS X is prone to a remote code execution vulnerability.
Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
Note: This issue was previously covered in BID 60329 (Apple Mac OS X Security Update 2013-002 Multiple Security Vulnerabilities) but has been given its own record to better document it. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-06-04-1 OS X Mountain Lion v10.8.4 and Security Update
2013-002
OS X Mountain Lion v10.8.4 and Security Update 2013-002 is now
available and addresses the following:
CFNetwork
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: An attacker with access to a user's session may be able to
log into previously accessed sites, even if Private Browsing was used
Description: Permanent cookies were saved after quitting Safari,
even when Private Browsing was enabled. This issue was addressed by
improved handling of cookies. This could be triggered by maliciously
crafted URLs in Safari. The issue was addressed through improved
bounds checking.
CVE-ID
CVE-2013-0983 : David Fifield of Stanford University, Ben Syverson
CoreMedia Playback
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: An uninitialized memory access issue existed in the
handling of text tracks. This issue was addressed by additional
validation of text tracks.
CVE-ID
CVE-2013-1024 : Richard Kuo and Billy Suguitan of Triemt Corporation
CUPS
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: A local user in the lpadmin group may be able to read or
write arbitrary files with system privileges
Description: A privilege escalation issue existed in the handling of
CUPS configuration via the CUPS web interface. A local user in the
lpadmin group may be able to read or write arbitrary files with
system privileges. This issue was addressed by moving certain
configuration directives to cups-files.conf, which can not be
modified from the CUPS web interface. By sending a maliciously crafted message,
a remote attacker could cause the directory server to terminate or
execute arbitrary code with system privileges. This issue was
addressed through improved bounds checking.
CVE-ID
CVE-2013-0984 : Nicolas Economou of Core Security
Disk Management
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: A local user may disable FileVault
Description: A local user who is not an administrator may disable
FileVault using the command-line. This issue was addressed by adding
additional authentication. This issue was addressed by
disabling compression in OpenSSL. Further information is available via the
OpenSSL website at http://www.openssl.org/news/
CVE-ID
CVE-2011-1945
CVE-2011-3207
CVE-2011-3210
CVE-2011-4108
CVE-2011-4109
CVE-2011-4576
CVE-2011-4577
CVE-2011-4619
CVE-2012-0050
CVE-2012-2110
CVE-2012-2131
CVE-2012-2333
QuickDraw Manager
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Opening a maliciously crafted PICT image may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of PICT
images. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0975 : Tobias Klein working with HP's Zero Day Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of 'enof'
atoms. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0986 : Tom Gallagher (Microsoft) & Paul Bates (Microsoft)
working with HP's Zero Day Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted QTIF file may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of
QTIF files. This issue was addressed through improved bounds
checking.
This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0988 : G. Geshev working with HP's Zero Day Initiative
QuickTime
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: Playing a maliciously crafted MP3 file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of MP3 files.
This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0989 : G. Geshev working with HP's Zero Day Initiative
Ruby
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8
Impact: Multiple vulnerabilities in Ruby on Rails
Description: Multiple vulnerabilities existed in Ruby on Rails, the
most serious of which may lead to arbitrary code execution on systems
running Ruby on Rails applications. These issues were addressed by
updating Ruby on Rails to version 2.3.18. Users can update affected gems on such systems by
using the /usr/bin/gem utility.
CVE-ID
CVE-2013-0155
CVE-2013-0276
CVE-2013-0277
CVE-2013-0333
CVE-2013-1854
CVE-2013-1855
CVE-2013-1856
CVE-2013-1857
SMB
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: An authenticated user may be able to write files outside the
shared directory
Description: If SMB file sharing is enabled, an authenticated user
may be able to write files outside the shared directory. This issue
was addressed through improved access control.
CVE-ID
CVE-2013-0990 : Ward van Wanrooij
Note: Starting with OS X 10.8.4, Java Web Start (i.e. JNLP)
applications downloaded from the Internet need to be signed with
a Developer ID certificate. Gatekeeper will check downloaded
Java Web Start applications for a signature and block such
applications from launching if they are not properly signed.
Note: OS X Mountain Lion v10.8.4 includes the content of
Safari 6.0.5. For further details see "About the security content
of Safari 6.0.5" at http://http//support.apple.com/kb/HT5785
OS X Mountain Lion v10.8.4 and Security Update 2013-002 may be
obtained from the Software Update pane in System Preferences,
or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
The Software Update utility will present the update that applies
to your system configuration. Only one is needed, either
OS X Mountain Lion v10.8.4, or Security Update
2013-002.
For OS X Mountain Lion v10.8.3
The download file is named: OSXUpd10.8.4.dmg
Its SHA-1 digest is: 9cf99aa1293cefdac0fb9a24ea133c80f8237b5e
For OS X Mountain Lion v10.8 and v10.8.2
The download file is named: OSXUpdCombo10.8.4.dmg
Its SHA-1 digest is: 3c95d0c8d0c7f43339a5f4e137e386dd5fe409c3
For OS X Lion v10.7.5
The download file is named: SecUpd2013-002.dmg
Its SHA-1 digest is: cfc3bd0941d7c5838aee9e92ee087d78abff3ce7
For OS X Lion Server v10.7.5
The download file is named: SecUpdSrvr2013-002.dmg
Its SHA-1 digest is: 34dff575a145e13404e7a2ee8a390d3e7c56fb5e
For Mac OS X v10.6.8
The download file is named: SecUpd2013-002.dmg
Its SHA-1 digest is: 5da54b38ffb8c147925c3018a8f5bf30ad4ac5b1
For Mac OS X Server v10.6.8
The download file is named: SecUpdSrvr2013-002.dmg
Its SHA-1 digest is: b20271f019930fe894c2247a6d5e05f00568b583
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRrjkiAAoJEPefwLHPlZEwW+AP/0x/cHS3VPY0/a98Xpmdfkdb
eo9Ns5FKw6mIkUftrN6qwNAgFXWqQXNIbJ3q8ZnoxcFPakhYyPSp4XowpR79l7kG
B2ZrdTx9aIn2bfHZ+h4cE8XnVL8qUDz2RxFopOGbb+wpJxl8/fehDmWokC5wCeF5
N7mnwW2s37QL73BmAMRdi6CYcJCKwhZWGFWmqiNvpFlUP+kcjU/UM1MAzOu0xsiA
PD6NrWeUOWfFrcQgx/pspWGvrFyV4FLu+0wQBl9f/DiQNrwVXIr85rHtah+b1NCU
pteSxQwb4kRojXdPm4+I3LKoghzGR8xD6+Xl6KdYgReSW89Di4bKM3WpbRLqhRuq
8kv38Gk3/vZDfAnuNQX09dE6EgJ0DVu86SoRQZ1iYRQoLrizVsOvyVQUojZhT47t
6l44L/5cNJd7EcaC8hdmr44cCZdMPDEqoKzn2BavH62WYXbZMPlHBDo/H2ujUUec
i7XU7LA1Upw57X4wmIUU4QrlBhNBh39yRKh3katAklayFBjOMEyyL57gURvd6O77
gFOQpUQ6kgqwgQCrtNT6R96igfyu7cVxYW7XchZDHgA3n/YWOAVvXkVeeQ5OUGzC
O0UYLMBpPka31yfWP23QaXpV+LW462raI6LnMvRP1245RhokTTThZw6/9xochK2V
+VoeoamqaQqZGyOiObbU
=vG2v
-----END PGP SIGNATURE-----
| VAR-201306-0026 | CVE-2013-0990 | Apple Mac OS X of SMB Vulnerabilities in creating files outside shared directories |
CVSS V2: 4.9 CVSS V3: - Severity: MEDIUM |
SMB in Apple Mac OS X before 10.8.4, when file sharing is enabled, allows remote authenticated users to create or modify files outside of a shared directory via unspecified vectors.
Note: This issue was previously covered in BID 60329 (Apple Mac OS X Security Update 2013-002 Multiple Security Vulnerabilities) but has been given its own record to better document it. Apple Mac OS X is prone to multiple vulnerabilities.
Attackers can exploit these issues to execute arbitrary code, cause denial-of-service conditions, gain unauthorized access, obtain sensitive information, bypass security restrictions, and perform other attacks.
These issues affect OS X prior to 10.8.4. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-06-04-1 OS X Mountain Lion v10.8.4 and Security Update
2013-002
OS X Mountain Lion v10.8.4 and Security Update 2013-002 is now
available and addresses the following:
CFNetwork
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: An attacker with access to a user's session may be able to
log into previously accessed sites, even if Private Browsing was used
Description: Permanent cookies were saved after quitting Safari,
even when Private Browsing was enabled. This issue was addressed by
improved handling of cookies.
CVE-ID
CVE-2013-0982 : Alexander Traud of www.traud.de
CoreAnimation
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: Visiting a maliciously crafted site may lead to an
unexpected application termination or arbitrary code execution
Description: An unbounded stack allocation issue existed in the
handling of text glyphs. This could be triggered by maliciously
crafted URLs in Safari. The issue was addressed through improved
bounds checking.
CVE-ID
CVE-2013-0983 : David Fifield of Stanford University, Ben Syverson
CoreMedia Playback
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: An uninitialized memory access issue existed in the
handling of text tracks. This issue was addressed by additional
validation of text tracks.
CVE-ID
CVE-2013-1024 : Richard Kuo and Billy Suguitan of Triemt Corporation
CUPS
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: A local user in the lpadmin group may be able to read or
write arbitrary files with system privileges
Description: A privilege escalation issue existed in the handling of
CUPS configuration via the CUPS web interface. A local user in the
lpadmin group may be able to read or write arbitrary files with
system privileges. This issue was addressed by moving certain
configuration directives to cups-files.conf, which can not be
modified from the CUPS web interface.
CVE-ID
CVE-2012-5519
Directory Service
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8
Impact: A remote attacker may execute arbitrary code with system
privileges on systems with Directory Service enabled
Description: An issue existed in the directory server's handling of
messages from the network. By sending a maliciously crafted message,
a remote attacker could cause the directory server to terminate or
execute arbitrary code with system privileges. This issue was
addressed through improved bounds checking.
CVE-ID
CVE-2013-0984 : Nicolas Economou of Core Security
Disk Management
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: A local user may disable FileVault
Description: A local user who is not an administrator may disable
FileVault using the command-line. This issue was addressed by adding
additional authentication. This issue was addressed by
disabling compression in OpenSSL. Further information is available via the
OpenSSL website at http://www.openssl.org/news/
CVE-ID
CVE-2011-1945
CVE-2011-3207
CVE-2011-3210
CVE-2011-4108
CVE-2011-4109
CVE-2011-4576
CVE-2011-4577
CVE-2011-4619
CVE-2012-0050
CVE-2012-2110
CVE-2012-2131
CVE-2012-2333
QuickDraw Manager
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.2
Impact: Opening a maliciously crafted PICT image may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of PICT
images. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0975 : Tobias Klein working with HP's Zero Day Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of 'enof'
atoms. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0986 : Tom Gallagher (Microsoft) & Paul Bates (Microsoft)
working with HP's Zero Day Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted QTIF file may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of
QTIF files. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2013-0987 : roob working with iDefense VCP
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted FPX file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of FPX files.
This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0988 : G. Geshev working with HP's Zero Day Initiative
QuickTime
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: Playing a maliciously crafted MP3 file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of MP3 files.
This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0989 : G. Geshev working with HP's Zero Day Initiative
Ruby
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8
Impact: Multiple vulnerabilities in Ruby on Rails
Description: Multiple vulnerabilities existed in Ruby on Rails, the
most serious of which may lead to arbitrary code execution on systems
running Ruby on Rails applications. These issues were addressed by
updating Ruby on Rails to version 2.3.18. Users can update affected gems on such systems by
using the /usr/bin/gem utility. This issue
was addressed through improved access control.
CVE-ID
CVE-2013-0990 : Ward van Wanrooij
Note: Starting with OS X 10.8.4, Java Web Start (i.e. JNLP)
applications downloaded from the Internet need to be signed with
a Developer ID certificate. Gatekeeper will check downloaded
Java Web Start applications for a signature and block such
applications from launching if they are not properly signed.
Note: OS X Mountain Lion v10.8.4 includes the content of
Safari 6.0.5. For further details see "About the security content
of Safari 6.0.5" at http://http//support.apple.com/kb/HT5785
OS X Mountain Lion v10.8.4 and Security Update 2013-002 may be
obtained from the Software Update pane in System Preferences,
or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
The Software Update utility will present the update that applies
to your system configuration. Only one is needed, either
OS X Mountain Lion v10.8.4, or Security Update
2013-002.
For OS X Mountain Lion v10.8.3
The download file is named: OSXUpd10.8.4.dmg
Its SHA-1 digest is: 9cf99aa1293cefdac0fb9a24ea133c80f8237b5e
For OS X Mountain Lion v10.8 and v10.8.2
The download file is named: OSXUpdCombo10.8.4.dmg
Its SHA-1 digest is: 3c95d0c8d0c7f43339a5f4e137e386dd5fe409c3
For OS X Lion v10.7.5
The download file is named: SecUpd2013-002.dmg
Its SHA-1 digest is: cfc3bd0941d7c5838aee9e92ee087d78abff3ce7
For OS X Lion Server v10.7.5
The download file is named: SecUpdSrvr2013-002.dmg
Its SHA-1 digest is: 34dff575a145e13404e7a2ee8a390d3e7c56fb5e
For Mac OS X v10.6.8
The download file is named: SecUpd2013-002.dmg
Its SHA-1 digest is: 5da54b38ffb8c147925c3018a8f5bf30ad4ac5b1
For Mac OS X Server v10.6.8
The download file is named: SecUpdSrvr2013-002.dmg
Its SHA-1 digest is: b20271f019930fe894c2247a6d5e05f00568b583
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRrjkiAAoJEPefwLHPlZEwW+AP/0x/cHS3VPY0/a98Xpmdfkdb
eo9Ns5FKw6mIkUftrN6qwNAgFXWqQXNIbJ3q8ZnoxcFPakhYyPSp4XowpR79l7kG
B2ZrdTx9aIn2bfHZ+h4cE8XnVL8qUDz2RxFopOGbb+wpJxl8/fehDmWokC5wCeF5
N7mnwW2s37QL73BmAMRdi6CYcJCKwhZWGFWmqiNvpFlUP+kcjU/UM1MAzOu0xsiA
PD6NrWeUOWfFrcQgx/pspWGvrFyV4FLu+0wQBl9f/DiQNrwVXIr85rHtah+b1NCU
pteSxQwb4kRojXdPm4+I3LKoghzGR8xD6+Xl6KdYgReSW89Di4bKM3WpbRLqhRuq
8kv38Gk3/vZDfAnuNQX09dE6EgJ0DVu86SoRQZ1iYRQoLrizVsOvyVQUojZhT47t
6l44L/5cNJd7EcaC8hdmr44cCZdMPDEqoKzn2BavH62WYXbZMPlHBDo/H2ujUUec
i7XU7LA1Upw57X4wmIUU4QrlBhNBh39yRKh3katAklayFBjOMEyyL57gURvd6O77
gFOQpUQ6kgqwgQCrtNT6R96igfyu7cVxYW7XchZDHgA3n/YWOAVvXkVeeQ5OUGzC
O0UYLMBpPka31yfWP23QaXpV+LW462raI6LnMvRP1245RhokTTThZw6/9xochK2V
+VoeoamqaQqZGyOiObbU
=vG2v
-----END PGP SIGNATURE-----
| VAR-201306-0025 | CVE-2013-0975 | Apple Mac OS X of QuickDraw Manager Vulnerable to buffer overflow |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
Buffer overflow in QuickDraw Manager in Apple Mac OS X before 10.8.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the way QuickTime handles the LongComment PICT opcode. It converts an unsigned 16 bit value into a signed 32 bit value after it performs some mathematical operations on it. This value is later used as a size parameter for a memory copy function that copies from the file onto the heap. An attacker can leverage the situation to achieve remote code execution under the context of the user currently logged in. Apple Mac OS X is prone to multiple vulnerabilities.
Attackers can exploit these issues to execute arbitrary code, cause denial-of-service conditions, gain unauthorized access, obtain sensitive information, bypass security restrictions, and perform other attacks.
These issues affect OS X prior to 10.8.4.
Note: This issue was previously covered in BID 60329 (Apple Mac OS X Security Update 2013-002 Multiple Security Vulnerabilities), but has been given its own record to better document it. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2013-06-04-1 OS X Mountain Lion v10.8.4 and Security Update
2013-002
OS X Mountain Lion v10.8.4 and Security Update 2013-002 is now
available and addresses the following:
CFNetwork
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: An attacker with access to a user's session may be able to
log into previously accessed sites, even if Private Browsing was used
Description: Permanent cookies were saved after quitting Safari,
even when Private Browsing was enabled. This issue was addressed by
improved handling of cookies.
CVE-ID
CVE-2013-0982 : Alexander Traud of www.traud.de
CoreAnimation
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: Visiting a maliciously crafted site may lead to an
unexpected application termination or arbitrary code execution
Description: An unbounded stack allocation issue existed in the
handling of text glyphs. This could be triggered by maliciously
crafted URLs in Safari. The issue was addressed through improved
bounds checking.
CVE-ID
CVE-2013-0983 : David Fifield of Stanford University, Ben Syverson
CoreMedia Playback
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: An uninitialized memory access issue existed in the
handling of text tracks. This issue was addressed by additional
validation of text tracks.
CVE-ID
CVE-2013-1024 : Richard Kuo and Billy Suguitan of Triemt Corporation
CUPS
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: A local user in the lpadmin group may be able to read or
write arbitrary files with system privileges
Description: A privilege escalation issue existed in the handling of
CUPS configuration via the CUPS web interface. A local user in the
lpadmin group may be able to read or write arbitrary files with
system privileges. This issue was addressed by moving certain
configuration directives to cups-files.conf, which can not be
modified from the CUPS web interface. This issue was
addressed through improved bounds checking.
CVE-ID
CVE-2013-0984 : Nicolas Economou of Core Security
Disk Management
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: A local user may disable FileVault
Description: A local user who is not an administrator may disable
FileVault using the command-line. This issue was addressed by adding
additional authentication. This issue was addressed by
disabling compression in OpenSSL. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0975 : Tobias Klein working with HP's Zero Day Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted movie file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of 'enof'
atoms. This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0986 : Tom Gallagher (Microsoft) & Paul Bates (Microsoft)
working with HP's Zero Day Initiative
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted QTIF file may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue existed in the handling of
QTIF files. This issue was addressed through improved bounds
checking.
CVE-ID
CVE-2013-0987 : roob working with iDefense VCP
QuickTime
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8,
OS X Lion v10.7 to v10.7.5, OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: Viewing a maliciously crafted FPX file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of FPX files.
This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0988 : G. Geshev working with HP's Zero Day Initiative
QuickTime
Available for: OS X Mountain Lion v10.8 to v10.8.3
Impact: Playing a maliciously crafted MP3 file may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer overflow existed in the handling of MP3 files.
This issue was addressed through improved bounds checking.
CVE-ID
CVE-2013-0989 : G. Geshev working with HP's Zero Day Initiative
Ruby
Available for: Mac OS X 10.6.8, Mac OS X Server 10.6.8
Impact: Multiple vulnerabilities in Ruby on Rails
Description: Multiple vulnerabilities existed in Ruby on Rails, the
most serious of which may lead to arbitrary code execution on systems
running Ruby on Rails applications. These issues were addressed by
updating Ruby on Rails to version 2.3.18. Users can update affected gems on such systems by
using the /usr/bin/gem utility.
CVE-ID
CVE-2013-0155
CVE-2013-0276
CVE-2013-0277
CVE-2013-0333
CVE-2013-1854
CVE-2013-1855
CVE-2013-1856
CVE-2013-1857
SMB
Available for: OS X Lion v10.7 to v10.7.5,
OS X Lion Server v10.7 to v10.7.5,
OS X Mountain Lion v10.8 to v10.8.3
Impact: An authenticated user may be able to write files outside the
shared directory
Description: If SMB file sharing is enabled, an authenticated user
may be able to write files outside the shared directory. This issue
was addressed through improved access control.
CVE-ID
CVE-2013-0990 : Ward van Wanrooij
Note: Starting with OS X 10.8.4, Java Web Start (i.e. JNLP)
applications downloaded from the Internet need to be signed with
a Developer ID certificate. Gatekeeper will check downloaded
Java Web Start applications for a signature and block such
applications from launching if they are not properly signed.
Note: OS X Mountain Lion v10.8.4 includes the content of
Safari 6.0.5. For further details see "About the security content
of Safari 6.0.5" at http://http//support.apple.com/kb/HT5785
OS X Mountain Lion v10.8.4 and Security Update 2013-002 may be
obtained from the Software Update pane in System Preferences,
or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
The Software Update utility will present the update that applies
to your system configuration. Only one is needed, either
OS X Mountain Lion v10.8.4, or Security Update
2013-002.
For OS X Mountain Lion v10.8.3
The download file is named: OSXUpd10.8.4.dmg
Its SHA-1 digest is: 9cf99aa1293cefdac0fb9a24ea133c80f8237b5e
For OS X Mountain Lion v10.8 and v10.8.2
The download file is named: OSXUpdCombo10.8.4.dmg
Its SHA-1 digest is: 3c95d0c8d0c7f43339a5f4e137e386dd5fe409c3
For OS X Lion v10.7.5
The download file is named: SecUpd2013-002.dmg
Its SHA-1 digest is: cfc3bd0941d7c5838aee9e92ee087d78abff3ce7
For OS X Lion Server v10.7.5
The download file is named: SecUpdSrvr2013-002.dmg
Its SHA-1 digest is: 34dff575a145e13404e7a2ee8a390d3e7c56fb5e
For Mac OS X v10.6.8
The download file is named: SecUpd2013-002.dmg
Its SHA-1 digest is: 5da54b38ffb8c147925c3018a8f5bf30ad4ac5b1
For Mac OS X Server v10.6.8
The download file is named: SecUpdSrvr2013-002.dmg
Its SHA-1 digest is: b20271f019930fe894c2247a6d5e05f00568b583
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJRrjkiAAoJEPefwLHPlZEwW+AP/0x/cHS3VPY0/a98Xpmdfkdb
eo9Ns5FKw6mIkUftrN6qwNAgFXWqQXNIbJ3q8ZnoxcFPakhYyPSp4XowpR79l7kG
B2ZrdTx9aIn2bfHZ+h4cE8XnVL8qUDz2RxFopOGbb+wpJxl8/fehDmWokC5wCeF5
N7mnwW2s37QL73BmAMRdi6CYcJCKwhZWGFWmqiNvpFlUP+kcjU/UM1MAzOu0xsiA
PD6NrWeUOWfFrcQgx/pspWGvrFyV4FLu+0wQBl9f/DiQNrwVXIr85rHtah+b1NCU
pteSxQwb4kRojXdPm4+I3LKoghzGR8xD6+Xl6KdYgReSW89Di4bKM3WpbRLqhRuq
8kv38Gk3/vZDfAnuNQX09dE6EgJ0DVu86SoRQZ1iYRQoLrizVsOvyVQUojZhT47t
6l44L/5cNJd7EcaC8hdmr44cCZdMPDEqoKzn2BavH62WYXbZMPlHBDo/H2ujUUec
i7XU7LA1Upw57X4wmIUU4QrlBhNBh39yRKh3katAklayFBjOMEyyL57gURvd6O77
gFOQpUQ6kgqwgQCrtNT6R96igfyu7cVxYW7XchZDHgA3n/YWOAVvXkVeeQ5OUGzC
O0UYLMBpPka31yfWP23QaXpV+LW462raI6LnMvRP1245RhokTTThZw6/9xochK2V
+VoeoamqaQqZGyOiObbU
=vG2v
-----END PGP SIGNATURE-----
| VAR-201306-0407 | No CVE | NetGear WPN824v3 Information Disclosure Vulnerability |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
NetGear WPN824v3 is a wireless router product from NetGear.
An information disclosure vulnerability exists in NetGear WPN824v3. Attackers can use this vulnerability to download configuration files and leak sensitive information. The acquisition of information can help further attacks
| VAR-201305-0436 | No CVE | Multiple Netgear DGN Device Remote Authentication Bypass Vulnerabilities |
CVSS V2: 6.8 CVSS V3: - Severity: MEDIUM |
NetGear DGN1000B and DGN2200 are both router products of NetGear.
A remote authentication bypass vulnerability exists in Netgear DGN1000 and DGN2200 devices. A remote attacker could use this vulnerability to bypass the authentication mechanism with elevated privileges to execute arbitrary commands in the context of the affected device. Vulnerabilities exist in the following versions: NetGear DGN1000 runs firmware versions prior to 1.1.00.48, and Netgear DGN2200 v1. Unauthenticated command execution on Netgear DGN devices
========================================================
[ADVISORY INFORMATION]
Title: Unauthenticated command execution on Netgear DGN devices
Discovery date: 01/05/2013
Release date: 31/05/2013
Credits: Roberto Paleari (roberto@greyhats.it, twitter: @rpaleari)
[VULNERABILITY INFORMATION]
Class: Authentication bypass, command execution
[AFFECTED PRODUCTS]
This security vulnerability affects the following products and firmware
versions:
* Netgear DGN1000, firmware version < 1.1.00.48
* Netgear DGN2200 v1
Other products and firmware versions are probably also vulnerable, but they
were not checked.
Briefly, the embedded web server skips authentication checks for some URLs
containing the "currentsetting.htm" substring. As an example, the following URL
can be accessed even by unauthenticated attackers:
http://<target-ip-address>/setup.cgi?currentsetting.htm=1
Then, the "setup.cgi" page can be abused to execute arbitrary commands. As an
example, to read the /www/.htpasswd local file (containing the clear-text
password for the "admin" user), an attacker can access the following URL:
http://<target-ip-address>/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=cat+/www/.htpasswd&curpath=/¤tsetting.htm=1
Basically this URL leverages the "syscmd" function of the "setup.cgi" script to
execute arbitrary commands. In the example above the command being executed is
"cat /www/.htpasswd", and the output is displayed in the resulting web
page. Slightly variations of this URL can be used to execute arbitrary
commands. According to Netgear, DGN2200 v1 is not supported anymore, while v3
and v4 should not be affected by this issue; these versions were not tested by
the author.
[DISCLAIMER]
The author is not responsible for the misuse of the information provided in
this security advisory. The advisory is a service to the professional security
community. There are NO WARRANTIES with regard to this information. Any
application or distribution of this information constitutes acceptance AS IS,
at the user's own risk. This information is subject to change without notice