iChat Lets Remote Users on the Local Network Initiate Unauthorized Video Chats
|
|
SecurityTracker Alert ID: 1019109
|
|
SecurityTracker URL: http://securitytracker.com/id?1019109
|
|
CVE Reference: CVE-2007-5851
(Links to External Site)
|
Updated: Dec 22 2007
|
Original Entry Date: Dec 18 2007
|
Impact: Host/resource access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Apple Security Advisory
|
Description: A vulnerability was reported in iChat. A user can initiate an unauthorized video chat.
A remote user on the local network can initiate a video conference with the target user without the target user's approval.
Mac OS X versions 10.5 and later are not affected.
|
Impact: A remote user on the local network can initiate a video conference with the target user without the target user's approval.
|
Solution: The vendor has issued a fix (APPLE-SA-2007-12-17 Security Update 2007-009 v1.1), available from from the Software Update pane in
System Preferences, or Apple's Software Downloads web site at:
http://www.apple.com/support/downloads/
For Mac OS X v10.5.1
The
download file is named: "SecUpd2007-009.dmg"
Its SHA-1 digest is: 0ba35ef30a525792f1d4015395997b42f524dd38
For Mac OS X v10.4.11
(Universal)
The download file is named: "SecUpd2007-009Univ.dmg"
Its SHA-1 digest is: 49f52d4f647ea4a1fabef34cccac263bfd03791a
For
Mac OS X v10.4.11 (PPC)
The download file is named: "SecUpd2007-009Ti.dmg"
Its SHA-1 digest is: d1c5c4bc23267dd846bb96e7be69b084579c1bba
The
Apple advisories are available at:
http://docs.info.apple.com/article.html?artnum=307179
http://docs.info.apple.com/article.html?artnum=307224
[Editor's
note: The original security update 2007-009 issued on December 17, 2007 contained a performance issue that may cause Safari to
crash. On December 21, 2007, Apple issued the revised security update 2007-009 v1.1. Customers should apply the new update.]
|
Vendor URL: docs.info.apple.com/article.html?artnum=307179 (Links to External Site)
|
Cause: Access control error
|
Underlying OS: UNIX (OS X)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 18 Dec 2007 00:59:21 -0500
Subject: Apple iChat
|
APPLE-SA-2007-12-17 Security Update 2007-009
iChat
CVE-ID: CVE-2007-5851
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11
Impact: A person on the local network may initiate a video
connection without the user's approval
Description: An attacker on the local network may initiate a video
conference with a user without the user's approval. This update
addresses the issue by requiring user interaction to initiate a video
conference. This issue does not affect systems running Mac OS X 10.5
or later.
|
|
