[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
UNIRAS Brief - 520/04 - Apple Security Bulletin - Security enhancement for the iChat application.
-----BEGIN PGP SIGNED MESSAGE-----
- ----------------------------------------------------------------------------------
UNIRAS (UK Govt CERT) Briefing Notice - 520/04 dated 17.09.04 Time: 11:45
UNIRAS is part of NISCC (National Infrastructure Security Co-ordination Centre)
- ----------------------------------------------------------------------------------
UNIRAS material is also available from its website at www.uniras.gov.uk and
Information about NISCC is available from www.niscc.gov.uk
- ----------------------------------------------------------------------------------
Title
=====
Apple Security Bulletin:
Security enhancement for the iChat application.
Detail
======
Security Update 2004-09-16 is now available and delivers a security enhancement for the
iChat application.
- -----------------------------------------------------------------------------------
APPLE-SA-2004-09-16 Security Update 2004-09-16
Security Update 2004-09-16 is now available and delivers a security enhancement for the
iChat application.
CVE-ID: CAN-2004-0873
Impact: Remote iChat participants can send "links" that can start local programs if clicked.
Description: A remote iChat participant can send a "link" that references a program on the
local system. If the "link" is activated by clicking on it, and the "link" points to a local
program, then the program will run. iChat has been modified so that "links" of this type will
open a Finder window that displays the program instead of running it. Credit to <aaron@xxxxxxxx>
for reporting this issue.
Security Update 2004-09-16 is available for the following iChat
versions:
* iChat AV v2.1 (Mac OS X v10.3 or later)
* iChat AV v2.0 (Mac OS X v10.2.8)
* iChat 1.0.1 (Mac OS X v10.2.8)
================================================
Security Update 2004-09-16 may be obtained from the Software Update pane in System
Preferences, or Apple's Software Downloads web site:
http://www.apple.com/support/downloads/
For iChat AV v2.1
=====================================
The download file is named: "SecUpd2004-09-16Pan.dmg"
Its SHA-1 digest is: 0ef503c5f8a655de740e50f324d7311a1be6fe70
For iChat AV v2.0
=====================================
The download file is named: "SecUpd2004-09-16JagAV.dmg"
Its SHA-1 digest is: 9175d92b2036d86be324de8fa386a781aabbe932
For iChat v1.0.1
=====================================
The download file is named: "SecUpd2004-09-16Jag.dmg"
Its SHA-1 digest is: 4b637f08b22b70bcb65a3767814c9b3826e2edb1
Information will also be posted to the Apple Product Security web site:
http://www.apple.com/support/security/security_updates.html
This message is signed with Apple's Product Security PGP key, and details are
available at: http://www.apple.com/support/security/security_pgp.html
- ----------------------------------------------------------------------------------
For additional information or assistance, please contact the HELP Desk by
telephone or Not Protectively Marked information may be sent via
EMail to: uniras@xxxxxxxxxxxx
Office Hours:
Mon - Fri: 08:30 - 17:00 Hrs
Tel: +44 (0) 870 487 0748 Ext 4511
Fax: +44 (0) 870 487 0749
Outside of Office Hours:
On Call Duty Officer:
Tel: +44 (0) 870 487 0748 and follow the prompts
- ----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of Apple for the information
contained in this Briefing.
- ----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some
of the information may have changed since it was released. If the vulnerability
affects you, it may be prudent to retrieve the advisory from the canonical site
to ensure that you receive the most current information concerning that problem.
Reference to any specific commercial product, process, or service by trade
name, trademark manufacturer, or otherwise, does not constitute or imply
its endorsement, recommendation, or favouring by UNIRAS or NISCC. The views
and opinions of authors expressed within this notice shall not be used for
advertising or product endorsement purposes.
Neither UNIRAS or NISCC shall also accept responsibility for any errors
or omissions contained within this briefing notice. In particular, they shall
not be liable for any loss or damage whatsoever, arising from or in connection
with the usage of information contained within this notice.
UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST)
and has contacts with other international Incident Response Teams (IRTs) in
order to foster cooperation and coordination in incident prevention, to prompt
rapid reaction to incidents, and to promote information sharing amongst its
members and the community at large.
- ----------------------------------------------------------------------------------
<End of UNIRAS Briefing>
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
iQCVAwUBQUrDnopao72zK539AQGtqgP/bjDnbDfrXhgTf3csOsQk6JdrMkiwstio
CXnnNbLJbYW+eVwZwjwh/XkGtDG2kO0Qabs+zShA1elX4KB+66sQfe17APmDhlYg
PBAkH/ZcZk4q9PyxmaoX41CCYInbVuNhypLbBgXUNm47Xu8+tmNJgGwXvn1qzkb7
Hbvft49HzhU=
=Ehz0
-----END PGP SIGNATURE-----