Apple releases Security Update for Mac OS X

Apple has released Security Update 2010-001 for its Leopard (Mac OS X 10.5.8 client and server) and Snow Leopard (Mac OS X 10.6.2 client and server) operating systems, closing a total of 12 vulnerabilities. Security Update 2010-001 addresses seven vulnerabilities in the Adobe Flash Player plug-in which can be exploited by an attacker to execute arbitrary code when a victim visits a specially crafted malicious web site. The issues were addressed by Adobe in its December updates with the release of version 10.0.42.34 of the Flash Player plug-in. Buffer overflow vulnerabilities in CoreAudio, ImageIO and Image RAW have also been closed which could have allowed an attacker to run malicious code on a victims system. For an attack to be successful, a victim must first open a malicious MP4, TIFF or DNG file. The ImageIO vulnerability, however, only applies to Apple's Leopard OS.

In addition, the security update eliminates a denial of service (DoS) vulnerability in the CUPS printing service and disables Transport Layer Security (TLS) renegotiation in OpenSSL as a preventative security measure to reduce the risk of a known man-in-the-middle attack. The flawed implementation of the dtoa (double to ascii) C function for converting floating point numbers into strings, however, still remains unpatched. Using the vulnerability, an attacker could provoke a heap overflow, inject arbitrary code into a system, and execute it there. So far, a proof-of-concept exploit for Mac OS X has yet to be released.

The update is available on Apple's Software Update service. Alternatively, Security Update 2010-001 for Leopard (client, server) and Snow Leopard (client) is available to download from Apple's Support Downloads page. All users are advised to update.

See also:

• About Security Update 2010-001, security advisory from Apple.
• Solution for SSL/TLS design weakness in sight, a report from The H.
• Mac OS X vulnerability left unpatched for months, a report from The H.
• Several holes closed in Adobe Flash Player, a report from The H.

(crve)