Brief Hands-On Report--Apple Security Update 2005-001 for Mac OS X 10.3.7 and 10.2.8, Client and Server

Late yesterday afternoon Apple released Security Update 2005-001. Note that Apple has changed the naming convention for security updates from a complete exact date to a year-serial number.

The new update delivers a number of security enhancements and is recommended for all Macintosh users. For detailed information on this Update, please visit this Apple web page. This update includes the following components:

at commands

Available for: Mac OS X v10.3.7, Mac OS X Server v10.3.7
CVE-ID: CAN-2005-0125
Impact: Updates the "at" commands to address a local privilege escalation vulnerability
Description: The "at" family of commands did not properly drop privileges. This could allow a local user to remove files not owned by them, run programs with added privileges, or read the contents of normally unreadable files. This update patches the commands at, atrm, batch, atq, and atrun. Credit to kf_lists[at]digitalmunition[dot]com for reporting this issue.

ColorSync

Available for: Mac OS X v10.3.7, Mac OS X Server v10.3.7, Mac OS X v10.2.8, Mac OS X Server v10.2.8
CVE-ID: CAN-2005-0126
Impact: Malformed ICC color profiles could overwrite the program heap resulting in arbitrary code execution. Description: An out-of-specification or improperly embedded ICC color profile could overwrite the program heap and allow arbitrary code execution. There are no known exploits for this issue. With this update, ColorSync will reject incorrectly-formed ICC color profiles.

libxml2

Available for: Mac OS X v10.3.7, Mac OS X Server v10.3.7
CVE-ID: CAN-2004-0989
Impact: The libxml2 library contains unsafe code that may be exploited in applications linked against it.
Description: This update fixes several functions in the libxml2 library that have been identified as unsafe due to potentially exploitable buffer overflows.

Mail

Available for: Mac OS X v10.3.7 Client, Mac OS X Server v10.3.7
CVE-ID: CAN-2005-0127
Impact: Email messages sent from a single machine can be identified
Description: A GUUID containing an identifier associated with the ethernet networking hardware was used in the construction an RFC-822 required Message-ID header. Mail now hides this information by computing the Message-ID using a cryptographic hash of the GUUID concatenated with data from /dev/random. Credit to Carl Purvis for reporting this issue.

PHP

Available for: Mac OS X v10.3.7, Mac OS X Server v10.3.7, Mac OS X v10.2.8, Mac OS X Server v10.2.8
CVE-ID: CAN-2003-0860, CAN-2003-0863, CAN-2004-0594, CAN-2004-0595, CAN-2004-1018, CAN-2004-1019, CAN-2004-1020, CAN-2004-1063, CAN-2004-1064, CAN-2004-1065
Impact: Multiple vulnerabilities in PHP including remote denial of service and execution of arbitrary code
Description: PHP is updated to version 4.3.10 to address several issues. The PHP release announcement for version 4.3.10 is located here.

Safari

Available for: Mac OS X v10.3.7, Mac OS X Server v10.3.7, Mac OS X v10.2.8, Mac OS X Server v10.2.8
CVE-ID: CAN-2004-1314
Impact: When Safari's "Block Pop-Up Windows" feature is not enabled, a malicious pop-up window could appear as being from a trusted site
Description: If the "Block Pop-Up Windows" feature is enabled, then this issue does not occur. If the "Block Pop-Up Windows" feature is not enabled, a user can be misled about the content of a Pop-up window if they used an untrusted link to navigate to a site they wanted to view. This update corrects the issue regardless of the "Block Pop-Up Windows" setting. Credit to Secunia Research for reporting this issue.

SquirrelMail

Available for: Mac OS X Server 10.3.7
CVE-ID: CAN-2004-1036
Impact: SquirrelMail is updated to address a cross-site scripting vulnerability
Description: A cross-site scripting vulnerability in SquirrelMail allowed email messages to contain content that would be rendered by a users web browser. SquirrelMail is updated to address this issue. Further details are available from the SquirrelMail web site.

We were able to update most of our Macs using the System Preferences software update pane with no problems. This included our new Mac mini that we updated using Apple Remote Desktop. However, two of our Macs, a G4 Cube and a 12" PowerBook G4, could not be updated that way. We got a "could not expand and verify" error message. We repaired permissions but to no avail so we downloaded the appropriate updater from this Apple support web page. The update installed with no further drama. So far we have no operating problems on any Mac since installing the update. [Dana Baggett & Bill Fox]