Mac OS X Help Viewer Bugs Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1022216 |
|
SecurityTracker URL: http://securitytracker.com/id/1022216
|
|
CVE Reference:
CVE-2009-0942, CVE-2009-0943
(Links to External Site)
|
Date: May 13 2009
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 10.5.7
|
Description:
Two vulnerabilities were reported in Mac OS X Help Viewer. A remote user can cause arbitrary code to be executed on the target user's system.
A remote user can create a specially crafted 'help:' URL that, when loaded by the target user, will run arbitrary scripting code, which may permit arbitrary code to be executed on the target system.
A specially crafted 'help:' URL may reference an external Cascading Style Sheet that is not within a registered help book and execute arbitrary AppleScript files [CVE-2009-0942].
A specially crafted 'help:' URL may reference an HTML document that is not within a registered help book and execute arbitrary AppleScript files [CVE-2009-0943].
Brian Mastenbrook reported these vulnerabilities.
|
Impact:
A remote user can create a 'help:' URL that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution:
The vendor has issued a fix (APPLE-SA-2009-05-12 Security Update 2009-002; and Mac OS X 10.5.7), available from the Software Update pane in System Preferences, or Apple's Software Downloads web site at:
http://www.apple.com/support/downloads/
The Software Update utility will present the update that applies
to your system configuration. Only one is needed, either
Security Update 2009-002 or Mac OS X v10.5.7.
For Mac OS X v10.5.6
The download file is named: MacOSXUpd10.5.7.dmg
Its SHA-1 digest is: 0173995ad572f2bc11d802671136e5e5c1afe116
For Mac OS X v10.5 - v10.5.5
The download file is named: MacOSXUpdCombo10.5.7.dmg
Its SHA-1 digest is: 646fd1ac31c679c6a5aebe8ac74f190ab774cd38
For Mac OS X Server v10.5.6
The download file is named: MacOSXServerUpd10.5.7.dmg
Its SHA-1 digest is: 476b1f7c0e91eb8974eee84d9ee0f064964dce6d
For Mac OS X Server v10.5 - v10.5.5
The download file is named: MacOSXServerUpdCombo10.5.7.dmg
Its SHA-1 digest is: 20230891a42cb78ca38019527b708ef1549f61ae
For Mac OS X v10.4.11 (Intel)
The download file is named: SecUpd2009-002Intel.dmg
Its SHA-1 digest is: fc0143380efaf4aa7f320d1e2a84528c8e41a000
For Mac OS X v10.4.11 (PowerPC)
The download file is named: SecUpd2009-002PPC.dmg
Its SHA-1 digest is: 9e9b69c18450a1fa81484d7366a67ae97cfc52c7
For Mac OS X Server v10.4.11 (Universal)
The download file is named: SecUpdSrvr2009-002Univ.dmg
Its SHA-1 digest is: f0048c912ae939c1b5c95db5e843b4ee6cf60c21
For Mac OS X Server v10.4.11 (PowerPC)
The download file is named: SecUpdSrvr2009-002PPC.dmg
Its SHA-1 digest is: 525d90cc0d5bc00edd3f9a44e8447492a962f571
The vendor's advisory is available at:
http://support.apple.com/kb/HT3549
|
Vendor URL: support.apple.com/kb/HT3549 (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
|
|
Message History:
None.
|
Source Message Contents
|
Date: Wed, 13 May 2009 01:44:54 -0400
Subject: Mac OS X Help Viewer
|
Help Viewer
CVE-ID: CVE-2009-0942
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5 through v10.5.6, Mac OS X Server v10.5 through v10.5.6
Impact: Accessing a maliciously crafted "help:" URL may lead to
arbitrary code execution
Description: Help Viewer loads Cascading Style Sheets referenced in
URL parameters without validating that the referenced style sheets
are located within a registered help book. A malicious "help:" URL
may be used to invoke arbitrary AppleScript files, which may lead to
arbitrary code execution. This update addresses the issue through
improved validation of file system paths when loading stylesheets.
Credit to Brian Mastenbrook for reporting this issue.
Help Viewer
CVE-ID: CVE-2009-0943
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5 through v10.5.6, Mac OS X Server v10.5 through v10.5.6
Impact: Accessing a maliciously crafted "help:" URL may lead to
arbitrary code execution
Description: Help Viewer does not validate that full paths to HTML
documents are within registered help books. A malicious "help:" URL
may be used to invoke arbitrary AppleScript files, which may lead to
arbitrary code execution. This update addresses the issue through
improved validation of "help:" URLs. Credit to Brian Mastenbrook for
reporting this issue.
|
|
