Brief Hands-On Report--Apple's Security Update 2006-001

The update was issued for Mac OS X 10.4 (PPC and Intel versions) and 10.3.9 (Client and Server versions): It is available via the Software Update application or as a stand-alone file from this Apple Web page. According to the Read Me File with the 10.4.5(PPC) update,

Security Update 2006-001 is recommended for all users and improves the security of the following components:

apache_mod_php
automount
Bom
Directory Services
iChat
IPSec
LaunchServices
LibSystem
loginwindow
Mail
rsync
Safari
Syndication

Here are the details:

apache_mod_php--PHP 4.4.1 fixes several security issues in the Apache module and scripting environment. Details of the fixes are available via the PHP web site (www.php.net). PHP ships with Mac OS X but is disabled by default.

automount--File servers on the local network may be able to cause Mac OS X systems to mount file systems with reserved names. This could cause the systems to become unresponsive, or possibly allow arbitrary code delivered from the file servers to run on the target system.

BOM--The BOM framework handles the unpacking of certain types of archives. This framework is vulnerable to a directory traversal attack that can allow archived files to be unpacked into
arbitrary locations that are writable by the current user. This update addresses the issue by properly sanitizing those paths. Credit to Stephane Kardas of CERTA for reporting this issue.

Directory Services--The passwd program is vulnerable to temporary file attacks. This could lead to privilege elevation. This update addresses the issue by anticipating a hostile environment and by
creating temporary files securely. Credit to Ilja van Sprundel of Suresec LTD, vade79, and iDefense (idefense.com) for reporting this issue.

FileVault--User directories are mounted in an unsafe fashion when a FileVault image is created. This update secures the method in which a FileVault image is created.

IPSec--Remote denial of service against VPN connections Description: Incorrect handling of error conditions for virtual private networks based on IPSec may allow a remote attacker to cause a service interruption. This update addresses the issues by correctly handling the conditions that may cause crashes. Credit to OUSPG from the University of Oulu, NISCC, and CERT-FI for coordinating and reporting this issue.

LibSystem--An attacker able to cause an application to make requests for large amounts of memory may also be able to trigger a heap buffer overflow. This could cause the targeted application to crash or execute arbitrary code. This update addresses the issue by correctly handling these memory requests. This issue does not affect systems prior to Mac OS X v10.4. Credit to Neil Archibald of Suresec LTD for reporting this issue.

Mail--In Mac OS X v10.4 Tiger, when an email attachment is double-clicked in Mail, Download Validation is used to warn the user if the file type is not "safe". Certain techniques can be used
to disguise the file's type so that Download Validation is bypassed. This update addresses the issue by presenting Download Validation with the entire file, providing more information for Download Validation to detect unknown or unsafe file types in attachments.

perl--When a perl program running as root attempts to switch to another user ID, the operation may fail without notification to the program. This may cause a program to continue to run with root
privileges, assuming they have been dropped. This can cause security issues in third-party tools. This update addresses the issue by preventing such applications from continuing if the operation fails. This issue does not affect Mac OS X v10.4 or later systems. Credit to Jason Self for reporting this issue.

rsync--A heap-based buffer overflow may be triggered when the rsync server is used with the flag that allows extended attributes to be transferred. It may be possible for a malicious user with
access to an rsync server to cause denial of service or code execution. This update addresses the problem by ensuring that the destination buffer is large enough to hold the extended attributes.
This issue does not affect systems prior to Mac OS X v10.4. Credit to Jan-Derk Bakker for reporting this issue.

Safari--A heap-based buffer overflow in WebKit's handling of certain HTML could allow a malicious web site to cause a crash or execute arbitrary code as the user viewing the site. This update addresses the issue by preventing the condition causing the overflow. Credit to Suresec LTD for reporting this issue.

Safari--By preparing a web page including specially-crafted JavaScript, an attacker may trigger a stack buffer overflow that could lead to arbitrary code execution with the privileges of the user. This update addresses the issue by performing additional bounds checking.

Safari--Safari's security model prevents remote resources from causing redirection to local resources. An issue involving HTTP redirection can cause the browser to access a local file, bypassing certain restrictions. This update addresses the issue by preventing cross-domain HTTP redirects.

Safari, LaunchServices--It is possible to construct a file which appears to be a safe file type, such as an image or movie, but is actually an application. When the "Open `safe' files after downloading" option is enabled in Safari's General preferences, visiting a malicious web site may result in the automatic download and execution of such a file. A proof-of-concept has been detected on public web sites that demonstrates the automatic execution of shell scripts. This update addresses the issue by performing additional download validation so that the user is warned (in Mac OS X v10.4.5) or the download is not automatically opened (in Mac OS X v10.3.9).

Syndication--Syndication (Safari RSS) may allow JavaScript code embedded in feeds to run within the context of the RSS reader document, allowing malicious feeds to circumvent Safari's security
model. This update addresses the issue by properly removing JavaScript code from feeds. Syndication is only available in Mac OS X v10.4 and later.

Further details of these details are provided on this Apple Web page.

It fixes a large number of vulnerabilities including the Safari Automatic Script Execution Vulnerability that we warned about and recommended Paranoid Android 1.3 as a solution. There is another solution called Safe Terminal that works explicitly on the Terminal application that looks promising.

We downloaded and installed Security Update 2006-001 on Power PC PowerBook G4s, Power Mac G5s, G4 Cubes, iMac G5 and a Mac mini plus an iMac Core Duo. We encountered only one problem--it was on a Power Mac G5 Quad that refused to shutdown after installation but after a forced shutdown and restart it functioned normally again. A few hours use has turned up no problems.

We tried the Secunia.com demo after installing the new security update. First, during the download Safari warned us that the demo file may contain an application and asked us if we wanted to finish downloading it or cancel it. When we clicked "Download" it failed to execute automatically when automatically unzipped. While Apple has fixed this explicit aspect of the general LaunServices vulnerability and a similar issue with Mail attachments, it may have fixed other aspects but we know of no demo to try.

One should remember that Mac OS X is not perfect. Nothing is. Even Mac users should adopt safe practices such as opening files only from trusted sources. [Bill Fox & Dana Baggett]