SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   OS (UNIX)  >   Apple macOS/OS X Vendors:   Apple
(Red Hat Issues Fix) Apple OS X Multiple Flaws Let Remote Users Execute Arbitrary Code and Local Users Gain Elevated Privileges
SecurityTracker Alert ID:  1036494
SecurityTracker URL:  http://securitytracker.com/id/1036494
CVE Reference:   CVE-2014-8127, CVE-2014-8129, CVE-2014-8130   (Links to External Site)
Date:  Aug 2 2016
Impact:   Disclosure of system information, Execution of arbitrary code via local system, Execution of arbitrary code via network, Root access via local system, User access via local system, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): RHEL 7
Description:   Multiple vulnerabilities were reported in Apple OS X. A remote user can cause arbitrary code to be executed on the target user's system. A local user can obtain potentially sensitive information. A local user can obtain elevated privileges on the target system. A local user can bypass security restrictions.

A remote user can create a specially crafted file that, when processed by libtiff, will execute arbitrary code on the target system [CVE-2014-8127, CVE-2014-8128, CVE-2014-8129, CVE-2014-8130].

A local user (process) can exploit a flaw in the checking of XPC entitlements to gain administrative privileges [CVE-2015-3671]. OS X 10.9.5 and 10.10.x are affected.

Emil Kvarnhammar at TrueSec reported this vulnerability.

A local user without administrative privileges can trigger a flaw in user authentication to gain administrative privileges [CVE-2015-3672]. OS X 10.9.5 and 10.10.x are affected.

Emil Kvarnhammar at TrueSec reported this vulnerability.

A local user can move and modify Directory Utility to gain root privileges on the target system [CVE-2015-3673]. OS X 10.10.x is affected.

Patrick Wardle of Synack and Emil Kvarnhammar at TrueSec reported this vulnerability.

A remote user can trigger a memory corruption flaw in the AFP server to execute arbitrary code [CVE-2015-3674].

Dean Jerkovich of NCC Group reported this vulnerability.

The default Apache configuration does not include mod_hfs_apple. A remote can submit a specially crafted URL to access ostensibly protected directories on the target web service [CVE-2015-3675]. OS X 10.10.x is affected.

A local application can determine kernel memory layout [CVE-2015-3676, CVE-2015-3677, CVE-2015-3690, CVE-2015-3711, CVE-2015-3721].

Chen Liang of KEEN Team, an anonymous researcher (via HP's Zero Day Initiative), Peter Rutenbar (via with HP's Zero Day Initiative), and Ian Beer of Google Project Zero reported these vulnerabilities.

A local user (application) can trigger a memory corruption error and execute arbitrary code with system privileges. AppleThunderboltEDMService is affected [CVE-2015-3678]. Bluetooth HCI is affected [CVE-2015-3683]. The Monitor Control Command Set kernel extension is affected [CVE-2015-3691]. The 'Install.framework' 'runner' binary is affected [CVE-2015-3704]. IOAcceleratorFamily is affected [CVE-2015-3705, CVE-2015-3706]. The FireWire driver is affected [CVE-2015-3707]. The NVIDIA graphics driver is affected [CVE-2015-3712].

Roberto Paleari and Aristide Fattori of Emaze Networks, Ian Beer of Google Project Zero, and KEEN Team reported some of these vulnerabilities.

A remote user can create a specially crafted font file that, when loaded by the target user, will trigger a memory corruption error and execute arbitrary code on the target system [CVE-2015-3679, CVE-2015-3680, CVE-2015-3681, CVE-2015-3682]. OS X 10.10.x is affected.

Pawel Wylecial (via HP's Zero Day Initiative), John Villamil (@day6reak) of the Yahoo Pentest Team, and Nuode Wei reported these vulnerabilities.

A remote user that can conduct a man-in-the-middle attack can use a certificate signed by an incorrecly issued CNNIC certificate authority to bypass trusted certificate validation.

A remote user can create a specially crafted URL that, when loaded by the target user, will trigger a memory corruption error and execute arbitrary code [CVE-2015-3684].

A remote user can create a specially crafted text file that, when loaded by the target user, will trigger a memory corruption error and execute arbitrary code [CVE-2015-3685, CVE-2015-3686, CVE-2015-3687, CVE-2015-3688, CVE-2015-3689].

John Villamil (@day6reak) of the Yahoo Pentest Team reported some of these vulnerabilities.

A remote user can create a specially crafted font file that, when loaded by the target user, will trigger a memory corruption error and execute arbitrary code [CVE-2015-3694]. OS X 10.10.x is affected.

John Villamil (@day6reak) of the Yahoo Pentest Team reported this vulnerability.

A local user can trigger a buffer overflow in the Intel graphics driver to execute arbitrary code system privileges [CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, CVE-2015-3702].

KEEN Team and Ian Beer of Google Project Zero reported some of these vulnerabilities.

A remote user can create a specially crafted '.tiff' file that, when loaded by the target user, will trigger a memory corruption error and execute arbitrary code [CVE-2015-3703].

A local user (application) can exploit a symbolic link (symlink) flaw in kext tools to overwrite arbitrary files on the target system [CVE-2015-3708]. OS X 10.10.x is affected.

Ian Beer of Google Project Zero reported this vulnerability.

A local user can exploit a time-of-check time-of-use (TOCTOU) race condition during the validation of kernel extension paths to load unsigned kernel extensions [CVE-2015-3709]. OS X 10.10.x is affected.

Ian Beer of Google Project Zero reported this vulnerability.

A remote user can send a specially crafted email message that, when loaded by the target user, will replace the message content with an arbitrary web page [CVE-2015-3710]. OS X 10.10.x is affected.

Aaron Sigel of vtty.com and Jan Soucek reported this vulnerability.

A local user (application) that uses custom resource rules can be modified so that the system will still launch the application [CVE-2015-3714].

Joshua Pitts of Leviathan Security Group reported this vulnerability.

A local user (application) can load a library outside of the application bundle to bypass code signing protection [CVE-2015-3715].

Patrick Wardle of Synack reported this vulnerability.

A local user can create a specially crafted photo file and add the file to the local photo library and then search Spotlight for the file to execute arbitrary commands on the target system [CVE-2015-3716].

A remote user can trigger buffer overflows in SQLite to execute arbitrary code [CVE-2015-3717]. OS X 10.10.x is affected.

Peter Rutenbar (via HP's Zero Day Initiative) reported this vulnerability.

A local user (application) can send a specially crafted interprocess communication message to trigger a type confusion flaw in 'systemstatsd' and execute arbitrary code [CVE-2015-3718]. The code will run with the privileges of the target process. OS X 10.10.x is affected.

Roberto Paleari and Aristide Fattori of Emaze Networks reported this vulnerability.

A remote user can create a specially crafted font file that, when processed by the target application, will trigger a memory corruption flaw and execute arbitrary code [CVE-2015-3719]. OS X 10.10.x is affected.

John Villamil (@day6reak) of the Yahoo Pentest Team reported this vulnerability.

Impact:   A remote user can execute arbitrary code on the target system.

A local user can obtain elevated privileges on the target system.

Solution:   Red Hat has issued a fix for CVE-2014-8127, CVE-2014-8129, and CVE-2014-8130.

The Red Hat advisory is available at:

https://rhn.redhat.com/errata/RHSA-2016-1546.html

Vendor URL:  rhn.redhat.com/errata/RHSA-2016-1546.html (Links to External Site)
Cause:   Access control error, Boundary error, Input validation error, State error

Message History:   This archive entry is a follow-up to the message listed below.
Jul 1 2015 Apple OS X Multiple Flaws Let Remote Users Execute Arbitrary Code and Local Users Gain Elevated Privileges



 Source Message Contents

Subject:  [RHSA-2016:1546-01] Important: libtiff security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: libtiff security update
Advisory ID:       RHSA-2016:1546-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2016-1546.html
Issue date:        2016-08-02
CVE Names:         CVE-2014-8127 CVE-2014-8129 CVE-2014-8130 
                   CVE-2014-9330 CVE-2014-9655 CVE-2015-1547 
                   CVE-2015-7554 CVE-2015-8665 CVE-2015-8668 
                   CVE-2015-8683 CVE-2015-8781 CVE-2015-8782 
                   CVE-2015-8783 CVE-2015-8784 CVE-2016-3632 
                   CVE-2016-3945 CVE-2016-3990 CVE-2016-3991 
                   CVE-2016-5320 
=====================================================================

1. Summary:

An update for libtiff is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

3. Description:

The libtiff packages contain a library of functions for manipulating Tagged
Image File Format (TIFF) files.

Security Fix(es):

* Multiple flaws have been discovered in libtiff. A remote attacker could
exploit these flaws to cause a crash or memory corruption and, possibly,
execute arbitrary code by tricking an application linked against libtiff
into processing specially crafted files. (CVE-2014-9655, CVE-2015-1547,
CVE-2015-8784, CVE-2015-8683, CVE-2015-8665, CVE-2015-8781, CVE-2015-8782,
CVE-2015-8783, CVE-2016-3990, CVE-2016-5320)

* Multiple flaws have been discovered in various libtiff tools (bmp2tiff,
pal2rgb, thumbnail, tiff2bw, tiff2pdf, tiffcrop, tiffdither, tiffsplit,
tiff2rgba). By tricking a user into processing a specially crafted file, a
remote attacker could exploit these flaws to cause a crash or memory
corruption and, possibly, execute arbitrary code with the privileges of the
user running the libtiff tool. (CVE-2014-8127, CVE-2014-8129,
CVE-2014-8130, CVE-2014-9330, CVE-2015-7554, CVE-2015-8668, CVE-2016-3632,
CVE-2016-3945, CVE-2016-3991)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running applications linked against libtiff must be restarted for this
update to take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

1177893 - CVE-2014-9330 libtiff: Out-of-bounds reads followed by a crash in bmp2tiff
1185805 - CVE-2014-8127 libtiff: out-of-bounds read with malformed TIFF image in multiple tools
1185815 - CVE-2014-8129 libtiff: out-of-bounds read/write with malformed TIFF image in tiff2pdf
1185817 - CVE-2014-8130 libtiff: divide by zero in the tiffdither tool
1190703 - CVE-2014-9655 libtiff: use of uninitialized memory in putcontig8bitYCbCr21tile and NeXTDecode
1190709 - CVE-2015-1547 libtiff: use of uninitialized memory in NeXTDecode
1294417 - CVE-2015-7554 libtiff: Invalid-write in _TIFFVGetField() when parsing some extension tags
1294425 - CVE-2015-8668 libtiff: OOB read in bmp2tiff
1294427 - CVE-2015-8683 libtiff: Out-of-bounds when reading CIE Lab image format files
1294444 - CVE-2015-8665 libtiff: Out-of-bounds read in tif_getimage.c
1301649 - CVE-2015-8781 CVE-2015-8782 CVE-2015-8783 libtiff: invalid assertion
1301652 - CVE-2015-8784 libtiff: out-of-bound write in NeXTDecode()
1325093 - CVE-2016-3945 libtiff: out-of-bounds write in the tiff2rgba tool
1325095 - CVE-2016-3632 libtiff: out-of-bounds write in _TIFFVGetField function
1326246 - CVE-2016-3990 libtiff: out-of-bounds write in horizontalDifference8()
1326249 - CVE-2016-3991 libtiff: out-of-bounds write in loadImage() function
1346687 - CVE-2016-5320 libtiff: Out-of-bounds write in PixarLogDecode() function in tif_pixarlog.c

6. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
libtiff-4.0.3-25.el7_2.src.rpm

x86_64:
libtiff-4.0.3-25.el7_2.i686.rpm
libtiff-4.0.3-25.el7_2.x86_64.rpm
libtiff-debuginfo-4.0.3-25.el7_2.i686.rpm
libtiff-debuginfo-4.0.3-25.el7_2.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64:
libtiff-debuginfo-4.0.3-25.el7_2.i686.rpm
libtiff-debuginfo-4.0.3-25.el7_2.x86_64.rpm
libtiff-devel-4.0.3-25.el7_2.i686.rpm
libtiff-devel-4.0.3-25.el7_2.x86_64.rpm
libtiff-static-4.0.3-25.el7_2.i686.rpm
libtiff-static-4.0.3-25.el7_2.x86_64.rpm
libtiff-tools-4.0.3-25.el7_2.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:
libtiff-4.0.3-25.el7_2.src.rpm

x86_64:
libtiff-4.0.3-25.el7_2.i686.rpm
libtiff-4.0.3-25.el7_2.x86_64.rpm
libtiff-debuginfo-4.0.3-25.el7_2.i686.rpm
libtiff-debuginfo-4.0.3-25.el7_2.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

x86_64:
libtiff-debuginfo-4.0.3-25.el7_2.i686.rpm
libtiff-debuginfo-4.0.3-25.el7_2.x86_64.rpm
libtiff-devel-4.0.3-25.el7_2.i686.rpm
libtiff-devel-4.0.3-25.el7_2.x86_64.rpm
libtiff-static-4.0.3-25.el7_2.i686.rpm
libtiff-static-4.0.3-25.el7_2.x86_64.rpm
libtiff-tools-4.0.3-25.el7_2.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
libtiff-4.0.3-25.el7_2.src.rpm

ppc64:
libtiff-4.0.3-25.el7_2.ppc.rpm
libtiff-4.0.3-25.el7_2.ppc64.rpm
libtiff-debuginfo-4.0.3-25.el7_2.ppc.rpm
libtiff-debuginfo-4.0.3-25.el7_2.ppc64.rpm
libtiff-devel-4.0.3-25.el7_2.ppc.rpm
libtiff-devel-4.0.3-25.el7_2.ppc64.rpm

ppc64le:
libtiff-4.0.3-25.el7_2.ppc64le.rpm
libtiff-debuginfo-4.0.3-25.el7_2.ppc64le.rpm
libtiff-devel-4.0.3-25.el7_2.ppc64le.rpm

s390x:
libtiff-4.0.3-25.el7_2.s390.rpm
libtiff-4.0.3-25.el7_2.s390x.rpm
libtiff-debuginfo-4.0.3-25.el7_2.s390.rpm
libtiff-debuginfo-4.0.3-25.el7_2.s390x.rpm
libtiff-devel-4.0.3-25.el7_2.s390.rpm
libtiff-devel-4.0.3-25.el7_2.s390x.rpm

x86_64:
libtiff-4.0.3-25.el7_2.i686.rpm
libtiff-4.0.3-25.el7_2.x86_64.rpm
libtiff-debuginfo-4.0.3-25.el7_2.i686.rpm
libtiff-debuginfo-4.0.3-25.el7_2.x86_64.rpm
libtiff-devel-4.0.3-25.el7_2.i686.rpm
libtiff-devel-4.0.3-25.el7_2.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

ppc64:
libtiff-debuginfo-4.0.3-25.el7_2.ppc.rpm
libtiff-debuginfo-4.0.3-25.el7_2.ppc64.rpm
libtiff-static-4.0.3-25.el7_2.ppc.rpm
libtiff-static-4.0.3-25.el7_2.ppc64.rpm
libtiff-tools-4.0.3-25.el7_2.ppc64.rpm

ppc64le:
libtiff-debuginfo-4.0.3-25.el7_2.ppc64le.rpm
libtiff-static-4.0.3-25.el7_2.ppc64le.rpm
libtiff-tools-4.0.3-25.el7_2.ppc64le.rpm

s390x:
libtiff-debuginfo-4.0.3-25.el7_2.s390.rpm
libtiff-debuginfo-4.0.3-25.el7_2.s390x.rpm
libtiff-static-4.0.3-25.el7_2.s390.rpm
libtiff-static-4.0.3-25.el7_2.s390x.rpm
libtiff-tools-4.0.3-25.el7_2.s390x.rpm

x86_64:
libtiff-debuginfo-4.0.3-25.el7_2.i686.rpm
libtiff-debuginfo-4.0.3-25.el7_2.x86_64.rpm
libtiff-static-4.0.3-25.el7_2.i686.rpm
libtiff-static-4.0.3-25.el7_2.x86_64.rpm
libtiff-tools-4.0.3-25.el7_2.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
libtiff-4.0.3-25.el7_2.src.rpm

x86_64:
libtiff-4.0.3-25.el7_2.i686.rpm
libtiff-4.0.3-25.el7_2.x86_64.rpm
libtiff-debuginfo-4.0.3-25.el7_2.i686.rpm
libtiff-debuginfo-4.0.3-25.el7_2.x86_64.rpm
libtiff-devel-4.0.3-25.el7_2.i686.rpm
libtiff-devel-4.0.3-25.el7_2.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

x86_64:
libtiff-debuginfo-4.0.3-25.el7_2.i686.rpm
libtiff-debuginfo-4.0.3-25.el7_2.x86_64.rpm
libtiff-static-4.0.3-25.el7_2.i686.rpm
libtiff-static-4.0.3-25.el7_2.x86_64.rpm
libtiff-tools-4.0.3-25.el7_2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2014-8127
https://access.redhat.com/security/cve/CVE-2014-8129
https://access.redhat.com/security/cve/CVE-2014-8130
https://access.redhat.com/security/cve/CVE-2014-9330
https://access.redhat.com/security/cve/CVE-2014-9655
https://access.redhat.com/security/cve/CVE-2015-1547
https://access.redhat.com/security/cve/CVE-2015-7554
https://access.redhat.com/security/cve/CVE-2015-8665
https://access.redhat.com/security/cve/CVE-2015-8668
https://access.redhat.com/security/cve/CVE-2015-8683
https://access.redhat.com/security/cve/CVE-2015-8781
https://access.redhat.com/security/cve/CVE-2015-8782
https://access.redhat.com/security/cve/CVE-2015-8783
https://access.redhat.com/security/cve/CVE-2015-8784
https://access.redhat.com/security/cve/CVE-2016-3632
https://access.redhat.com/security/cve/CVE-2016-3945
https://access.redhat.com/security/cve/CVE-2016-3990
https://access.redhat.com/security/cve/CVE-2016-3991
https://access.redhat.com/security/cve/CVE-2016-5320
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2016 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFXoNKIXlSAg2UNWIIRAn0mAJ49V9uRtJCn4vAWPIfVZ3ptCa4NDQCbBuTb
H5YX3gD3gJu8C4EadiP+wtg=
=Z4gh
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC