[Full-disclosure] Advisories for 4 vulnerabilities addressed by Apple SU 2005-005

From: David Remahl (vuln_at_remahl.se)
Date: 05/03/05

  • Next message: KF (lists): "[Full-disclosure] Sprint telco service?" 
    To: full-disclosure@lists.grok.org.uk, vulnwatch@vulnwatch.org, BugTraq <bugtraq@securityfocus.com>, security@lists.seifried.org
Date: Tue, 3 May 2005 22:05:22 +0200

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    I have published advisories for 4 security vulnerabilities in Mac OS
    X that were addressed by Apple Security Update 2005-005, released
    today. <http://docs.info.apple.com/article.html?artnum=301528>.

    This email contains brief summaries of the problems. Full details can
    be found on my web site <http://remahl.se/david/vuln/>.

    Description: help: URI handler execution of JavaScripts with known
    paths vulnerability
    My name: DR004 <http://remahl.se/david/vuln/004/>
    CVE: CAN-2005-1337 [yes, cool, isn't it ;-)]
    Summary: The Help Viewer application allows JavaScript and is thus
    vulnerable to having scripts with arbitrary paths run with the
    privileges granted to file: protocol URIs. The files can be started
    with a URI on the form of help:///path/to/file.html. Combined with
    XMLHttpRequest's ability to disclose arbitrary files, this security
    bug becomes critcal.

    Description: Invisible characters in applescript: URL protocol
    messaging vulnerability
    My name: DR010 <http://remahl.se/david/vuln/010/>
    CVE: CAN-2005-1331
    Summary: URL Protocol Messaging is a technique used by Script Editor
    to facilitate sharing of AppleScripts between users. By clicking a
    link (for example in a web forum), a user can create a new Script
    Editor document automatically, with text from the query string of the
    URI. This avoids problems with copying text from the web or manually
    typing code snippets. However, the technique can be used to trick
    users into running dangerous code (with embedded control characters),
    since insufficient input validation is performed.

    Description: Apple Terminal insufficient input sanitation of x-man-
    path: URIs vulnerability
    My name: DR011 <http://remahl.se/david/vuln/011/>
    CVE: CAN-2005-1342
    Summary: Apple Terminal fails to properly sanitize the contents of x-
    man-path: URIs passed to it. This can lead to execution of arbitrary
    commands, aided by some of the escape sequences that Terminal supports.

    Description: Mac OS X terminal emulators allow reading and writing of
    window title through escape sequences
    My name: DR012 <http://remahl.se/david/vuln/012/>
    CVE: CAN-2005-1341
    Summary: Apple Terminal (often referred to as Terminal.app) and xterm
    which both ship with current versions of Mac OS X are vulnerable to a
    well-known type of attack when displaying untrusted content. Using
    escape sequences and social engineering attacks it is in some cases
    possible to trick the user into performing arbitrary commands.

    I would like to acknowledge the willingness of Apple's Product
    Security team to cooperate with me in resolving these issues. CERT's
    assistance has also been helpful.

    / Regards, David Remahl
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.1 (Darwin)

    iD8DBQFCd9mHFlFiDoclYIURAjgqAJ9mLbjrfJr17eenCK6qp5S6HXKzgACeIH+a
    PJwheHWkjnBAG4kNnAa/6QE=
    =iJNj
    -----END PGP SIGNATURE-----
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: KF (lists): "[Full-disclosure] Sprint telco service?"

    Relevant Pages
    • Quantcast