ServerWatch content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Apple Computer Tuesday rolled out a major security update to plug several vulnerabilities in its flagship Mac OS X server and client versions.
Apple Tuesday rolled out a patch to protect Mac OS X users from several vulnerabilities that left them at risk for system hijack, security bypass, DoS attacks, and other threats.
The patch, which is being described as “highly critical,” addresses security issues with the AFP Server, CoreFoundation, and IPSec and also integrates a previously issued patch which contained bugs, Apple said.
The latest flaws, discovered by researchers at @Stake, could lead to system hijack, security bypass, manipulation of data, privilege escalation, denial-of-service attacks and system access.
The most serious flaw was found with AppleFileServer and can be exploited to compromise a vulnerable system. The vulnerability is caused by a boundary error within the password handling and could allow attackers to cause a buffer overflow by passing an AFP “LoginExt” packet with a string in the “PathName” field.
“Successful exploitation allows execution of arbitrary code with ‘root’ privileges,” according to a separate warning issued by independent research firm Secunia.
Secunia said it tagged the flaw as “highly critical” because Apple’s advisory was vague and that the “unspecified issues are likely to be more severe than claimed by the vendor.”
“This conclusion is based on the fact that Apple merely describes vulnerability 3 as an attempt to “improve the handling of long passwords.” However, according to @stake, the vulnerability can in fact be exploited to compromise a vulnerable system,” Secunia explained.
The patch also addresses some older known vulnerabilities in Apache 2 which can be exploited by malicious attackers to inject malicious code into log files and cause a denial-of-service condition.
A fix was also issued for two vulnerabilities in the IPSec implementation that could lead to MitM attacks (man-in-the-middle), establish unauthorized connections, or cause a DoS.
Apple also confirmed the existence of an unspecified vulnerability within the CoreFoundation when handling environment variables. This may potentially be a privilege escalation vulnerability. Another flaw in RAdmin when handling large requests was also pinpointed. Secunia warned that this issue could potentially lead to system compromise problems.
Apple has posted download links for the appropriate security update on its Web site. The full @Stake advisory is availab
le here.
This article was originally published on InternetNews.com.
