Apple security updates (August, 2003 and earlier)

This document outlines security updates for Apple products. Note: For the protection of its customers, Apple does not disclose, discuss or confirm security issues until a full investigation has occurred and any necessary patches or releases are available.

Important: This document describes updates and releases from August 2003 (2003-08) and earlier, such as Mac OS X 10.1, 10.2, 10.2.6 and Security Update 2003-08-14. For information about newer security updates, see one of these documents:

• Apple security updates (25-Jan-2005 and later)

• Apple security updates (03-Oct-2003 to 11-Jan-2005)

Obtaining Mac OS X

Information about obtaining Mac OS X can be found on the Mac OS X website (http://www.apple.com/macosx/).

Information about obtaining Mac OS X Server can be found on the Mac OS X Server website (http://www.apple.com/macosx/server/).

Information about the Apple Product Security PGP Key is available in technical document 25314, "How To Use The Apple Product Security PGP Key".

Software updates are available via:

• The Software Update preference

• Apple Downloads (http://www.apple.com/swupdates/)

Security updates: 2003-08 and earlier

Security updates are listed below according to the software release in which they first appeared. Where possible, CVE IDs (http://cve.mitre.org/cve/) are used to reference the vulnerabilities for further information.

For information about newer security updates, see technical document 61798, "Apple Security Updates".

Security Update 2003-08-14

• fb_realpath(): Addresses CAN-2003-0466, a potential vulnerability in the fb_realpath() function, specifically in the FTPServer and Libc projects, which could allow a local or remote user to gain unauthorized root privileges to a system.

Security Update 2003-07-23

• Fixes CAN-2003-0601 to improve the security of your system by assigning a "disabled" password to a new account created by Workgroup Manager until that account has been saved for the first time. This ensures the new account cannot be accessed by an unauthorized individual.

Security Update 2003-07-14

• Screen Effects Password: Fixes CAN-2003-0518, a potential vulnerability when a password is required upon waking from the Screen Effects feature, which could allow an unauthorized user access to the desktop of the logged in user. Credit to Denis Ahrens for reporting this issue.

Security Update 2003-06-12 (Mac OS X Server only)

• Apache 2.0: Fixes CAN-2003-0245 by updating Apache 2.0.45 to 2.0.46 to address a security hole in the mod_dav module that could be exploited remotely causing an Apache Web server process to crash. Apache 1.3 is unaffected and is the primary web server on Mac OS X Server. Apache 2.0 is installed with Mac OS X Server, but off by default.

• dsimportexport: Fixes CAN-2003-0420 in which a logged-in user could potentially view the name and password of the account running the dsimportexport tool

Security Update 2003-06-09 (version 2.0)

• AFP: Fixes CAN-2003-0379. When Apple File Service (AFP Server) in Mac OS X Server is serving files on a UFS or re-shared NFS volume, there is a potential vulnerability that can allow a remote user to overwrite arbitrary files.

• Directory Services: Fixes CAN-2003-0378. When logging in via Kerberos on an LDAPv3 server, the account password may be sent in cleartext format when Login Window falls back to trying a simple bind on the server.

Safari 1.0 Beta 2 (v74)

• Fixes CAN-2003-0355 in which Safari does not validate the Common Name field on X.509 certificates. Details are available from (http://www.securityfocus.com/archive/1/320707).

• The latest Safari version is available from (http://www.apple.com/safari/).

Mac OS X 10.2.6

• IPSec: Fixes CAN-2003-0242, where incoming security policies that match by port would fail to match the correct traffic.

Mac OS X 10.2.5

• Apache 2.0: Fixes CAN-2003-0132, a denial of service vulnerability in Apache 2.0 versions through 2.0.44. Apache 2.0 is distributed only with Mac OS X Server, and is not enabled by default.

• Directory Services: Fixes CAN-2003-0171 DirectoryServices Privilege Escalation and DoS Attack. DirectoryServices is part of the Mac OS X and Mac OS X Server information services subsystem. It is launched at startup, setuid root and installed by default. It is possible for a local attacker to modify an environment variable that would allow the execution of arbitrary commands as root. Credit to Dave G. from @stake, Inc. for the discovery of this vulnerability.

• File Sharing/Service: Fixes CAN-2003-0198 where the contents of the write-only DropBox folder can be revealed. When enabled, Personal File Sharing on Mac OS X or Apple File Service on Mac OS X Server, a "DropBox" folder is available by default to allow people to deposit files. This update no longer allows the permissions of the "DropBox" folder to be changed by a guest.

• OpenSSL: Fixes CAN-2003-0131 Klima-Pokorny-Rosa attack on PKCS #1 v1.5 padding. The patch from the OpenSSL team, which addresses this vulnerability, is applied to Mac OS X and Mac OS X Server.

• Samba: Fixes CAN-2003-0201 which could allow an anonymous user to gain remote root access due to a buffer overflow. The built-in Windows file sharing is based on the open source technology called Samba and is off by default in Mac OS X.

• sendmail: Fixes CAN-2003-0161 where address parsing code in sendmail does not adequately check the length of email addresses. Only the patch from the sendmail team is applied to the currently-shipping version of sendmail in Mac OS X and Mac OS X Server.

QuickTime 6.1 for Windows

• Fixes CAN-2003-0168, a potential vulnerability in QuickTime Player for Windows that could allow a remote attacker to compromise a target system. This exploit is only possible if the attacker can convince a user to load a specially crafted QuickTime URL. Upon successful exploitation, arbitrary code can be executed under the privileges of the QuickTime user.

Security Update 2003-03-24

• Samba: Fixes CAN-2003-0085 and CAN-2003-0086 which could allow unauthorized remote access to the host system. The built-in Windows file sharing is based on the open source technology called Samba and is off by default in Mac OS X. This update only applies the security fixes to the currently-shipping 2.2.3 version of Samba on Mac OS X 10.2.4, and the Samba version is otherwise unchanged.

• OpenSSL: Fixes CAN-2003-0147, to address an issue in which RSA private keys can be compromised when communicating over LANs, Internet2/Abilene, and interprocess communication on local machine.

Security Update 2003-03-03

• Sendmail: Fixes CAN-2002-1337 in which a remote attacker could gain elevated privileges on affected hosts. Sendmail is not enabled by default on Mac OS X, so only those systems which have explicitly enabled sendmail are vulnerable. All Mac OS X users, however, are encouraged to apply this update. The sendmail fix is available in Security Update 2003-03-03.

• OpenSSL: Fixes CAN-2003-0078, in which it is theoretically possible for a third-party to extract the original plaintext of encrypted messages sent over a network. Security Update 2003-03-03 applies this fix for Mac OS X 10.2.4; customers of earlier Mac OS X versions may obtain the latest openssl version directly from the OpenSSL Web site: http://www.openssl.org/

Mac OS X 10.2.4 (client)

• Sendmail: Fixes CAN-2002-0906 Buffer overflow in Sendmail before 8.12.5, when configured to use a custom DNS map to query TXT records, could permit a denial of service attack and possibly allow execution of arbitrary code. Mac OS X 10.2.4 contains Sendmail 8.12.6 with the SMRSH fix applied to also address CAN-2002-1165.

• AFP: Fixes CAN-2003-0049 "AFP login permissions for the system administrator". Provides an option whereby a system administrator may or may not be allowed to log in as a user, authenticating via their admin password. Previously, administrators could always log in as a user, authenticating via their own admin password.

• Classic: Fixes CAN-2003-0088, where an attacker may change an environment variable to create arbitrary files or overwrite existing files, which could lead to obtaining elevated privileges. Credit to Dave G. from @stake, Inc. for discovering this issue.

• Samba: Previous releases of Mac OS X are not vulnerable to CAN-2002-1318, an issue in Samba's length checking for encrypted password changes. Mac OS X currently uses Directory Services for authentication, and does not call the vulnerable Samba function. However, to prevent a potential future exploit via this function, the patch from Samba 2.2.7 was applied although the version of Samba was not changed for this update release. Further information is available from: http://samba.org/

Mac OS X 10.2.4 Server

• QuickTime Streaming Server: Fixes CAN-2003-0050 QTSS Arbitrary command execution. The QuickTime Streaming Administration Server relies on the parse_xml.cgi application to authenticate and interface with the user. This CGI can pass unvalidated input which could allow a remote attacker to execute arbitrary code on the server and to gain root privileges. Credit to Dave G. from @stake, Inc. for finding this vulnerability.

• QuickTime Streaming Server: Fixes CAN-2003-0051 QTSS Physical path revelation. The QuickTime Streaming Administration Server relies on the parse_xml.cgi application to authenticate and interface with the user. This CGI could be used to reveal the physical path upon which the Darwin/Quicktime Administration Servers are installed within. Credit to @stake, Inc. for finding this vulnerability.

• QuickTime Streaming Server: Fixes CAN-2003-0052 QTSS Directory listings. The QuickTime Streaming Administration Server relies on the parse_xml.cgi application to authenticate and interface with the user. This CGI could be used to reveal arbitrary directory listings due to the lack of user input validation within the application. Credit to Ollie Whitehouse from @stake, Inc. for finding this vulnerability.

• QuickTime Streaming Server: Fixes CAN-2003-0053 QTSS Login credentials. The QuickTime Streaming Administration Server relies on the parse_xml.cgi application to authenticate and interface with the user. A vulnerability in the handling of error messages from this CGI could be used in a cross-site scripting attack to gain valid login credentials. Credit to Ollie Whitehouse from @stake, Inc. for finding this vulnerability.

• QuickTime Streaming Server: Fixes CAN-2003-0054 Arbitrary command execution when viewing QTSS logs. If an unauthenticated user of QuickTime Streaming Server makes a request to the streaming port, the request is then written to the log file. It is possible to craft the request such that arbitrary code can be executed when the logs are viewed by the system administrator via a browser. Credit to Ollie Whitehouse from @stake, Inc. for finding this vulnerability.

• QuickTime Streaming Server: Fixes CAN-2003-0055 Buffer overflow in MP3 Broadcasting application. There is a buffer overflow in the stand-alone MP3Broadcaster application. An MP3 file which has a filename of over 256 bytes will cause a buffer overflow to occur. This could be used by local/ftp users to obtain elevated privileges. Credit to Ollie Whitehouse from @stake, Inc. for finding this vulnerability.

• Sendmail: Fixes CAN-2002-0906 Buffer overflow in Sendmail before 8.12.5, when configured to use a custom DNS map to query TXT records, could permit a denial of service attack and possibly allow execution of arbitrary code. Mac OS X 10.2.4 contains Sendmail 8.12.6 with the SMRSH fix applied to also address CAN-2002-1165 .

• AFP: Fixes CAN-2003-0049 "AFP login permissions for the system administrator". Provides an option whereby a system administrator may or may not be allowed to log in as a user, authenticating via their admin password. Previously, administrators could always log in as a user, authenticating via their own admin password.

• Classic: Fixes CAN-2003-0088 , where an attacker may change an environment variable to create arbitrary files or overwrite existing files, which could lead to obtaining elevated privileges. Credit to Dave G. from @stake, Inc. for discovering this issue.

• Samba: Previous releases of Mac OS X are not vulnerable to CAN-2002-1318 , an issue in Samba's length checking for encrypted password changes. Mac OS X currently uses Directory Services for authentication, and does not call the vulnerable Samba function. However, to prevent a potential future exploit via this function, the patch from Samba 2.2.7 was applied although the version of Samba was not changed for this update release. Further information is available from: http://samba.org/

• Integrated WebDAV Digest Authentication: The mod_digest_apple Apache module has been added to more easily enable digest authentication for an existing WebDAV realm. This eliminates the need to maintain a separate digest file containing the list of authorized users, passwords, and realms. mod_digest_apple works in coordination with Open Directory for user authentication. For further details, open the Help Viewer after installing Mac OS X Server version 10.2.4, select Mac OS X Server Help in the drawer, and search for "New: Enabling Integrated WebDAV Digest Authentication."

Mac OS X 10.2.3

• fetchmail: Fixes CAN-2002-1174 and CAN-2002-1175 that could lead to a potential denial of service when using the fetchmail command-line tool. fetchmail is updated to version 6.1.2+IMAP-GSS+SSL+INET6

• CUPS: Provides fixes for the following potential issues that could be exploited remotely when Printer Sharing is enabled. Printer Sharing is not enabled by default on Mac OS X or Mac OS X Server.

• CAN-2002-1383: Multiple Integer Overflows

• CAN-2002-1366: /etc/cups/certs/ Race Condition

• CAN-2002-1367: Adding Printers with UDP Packets

• CAN-2002-1368: Negative Length Memcpy() Calls

• CAN-2002-1384: Integer Overflows in pdftops Filter and Xpdf

• CAN-2002-1369: Unsafe Strncat Function Call in jobs.c

• CAN-2002-1370: Root Certificate Design Flaw

• CAN-2002-1371: Zero Width Images in filters/image-gif.c

• CAN-2002-1372: File Descriptor Resource Leaks

Security Update 2002-11-21

BIND: Updated to version 8.3.4 to fix potential vulnerabilities in the domain server and client library from Internet Software Consortium (ISC) that comes with Mac OS X and Mac OS X Server. BIND is not turned on by default on Mac OS X or Mac OS X Server.

CVE IDs: CAN-2002-1219, CAN-2002-1220, CAN-2002-1221, CAN-2002-0029

Further information is available at:http://www.cert.org/advisories/CA-2002-31.htmlhttp://www.kb.cert.org/vuls/id/457875

Mac OS X 10.2.2This update addresses the following potential security issues:

• CAN-2002-1266: Local User Privilege Elevation via Disk Image File It is possible for a local user to obtain elevated privileges on a system by opening a disk image file that was created on another computer with administrator level privileges.

• CAN-2002-0830: This is FreeBSD-SA-02:36.nfs, a potential vulnerability in the Network File System (NFS) where a remote attacker could cause a denial of service.

• IP Firewall: Under certain circumstances, the ipfw firewall built into Mac OS X may block packets that are explicitly allowed by the firewall rules. This does not meet the formal requirements of a security vulnerability and does not obtain a CVE ID.

• CAN-2002-1267: CUPS Printing Web Administration is Remotely Accessible A malicious user could access the port to run the CUPS Printing Web Administration utility. It would then be possible to cause a denial of service to a printer.

• CAN-2002-1268: User Privilege Elevation via Mounting an ISO 9600 CD Users could gain elevated privileges when logged into a system that has an ISO 9600 CD available to the file system.

• CAN-2002-1269: NetInfo Manager Application could allow filesystem access A security vulnerability in the NetInfo Manager application could allow a malicious user to navigate the file system.

• CAN-2002-1270: map_fd() Mach system call can allow a file to be read The map_fd() Mach system call can allow a caller to read a file for which they only have write access.

• CAN-2002-1265: TCP issue in RPC The RPC-based libc implementation could fail to properly read data from TCP connections. As a result, a remote attacker could deny service to system daemons. Further information is available in CERT VU#266817 at: http://www.kb.cert.org/vuls/id/266817

• CAN-2002-0839, CAN-2002-0840, CAN-2002-0843: Apache Apache is updated to version 1.3.27 to address a number of issues.

Mac OS X Server 10.2.2

• Includes all security fixes noted in Mac OS X 10.2.2, plus CAN-2002-0661, CAN-2002-0654, CAN-2002-0654: Apache 2 Apache 2 is provided with Mac OS X Server, but not enabled by default. The version is updated to Apache 2.0.42 to address a number of issues.

StuffIt Expander Security Update 2002-10-15

• Stuffit Expander: CAN-2002-0370. This update resolves a potential security vulnerability in versions 6.5.2 and earlier of Stuffit Expander. Further information is available at: http://www.kb.cert.org/vuls/id/383779 .

Security Update 2002-09-20

• Terminal: This update fixes a potential vulnerability introduced in Terminal version 1.3 (v81) that shipped with Mac OS X 10.2 that could allow an attacker to remotely execute arbitrary commands on the user's system. Terminal is updated to version 1.3.1 (v82) with this Security Update.

Security Update 2002-08-23

• This security update is for Mac OS X 10.2 and applies the fixes contained in Security Update 2002-08-02 which was for Mac OS X 10.1.5.

Security Update 2002-08-20

• Secure Transport: This update enhances the certificate verification in OS X and is now in full compliance with the Internet X.509 Public Key Infrastructure Certificate and CRL Profile (RFC2459).

Security Update 2002-08-02

This update addresses the following security vulnerabilities, which affect current shipping versions of Mac OS X Server. These services are turned off by default in Mac OS X client, however if these services are turned on then the client becomes vulnerable. Users of Mac OS X client should also install this update.

• OpenSSL: Fixes security vulnerabilities CAN-2002-0656, CAN-2002-0657, CAN-2002-0655, and CAN-2002-0659. Details are available via: http://www.cert.org/advisories/CA-2002-23.html

• mod_ssl: Fixes CAN-2002-0653, an off-by-one buffer overflow in mod_ssl Apache module. Details are available via: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0653

• Sun RPC: Fixes CAN-2002-039, a buffer overflow in the Sun RPC XDR decoder. Details are available via: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20823

Security Update 7-18-02 (2002-07-18)

• Software Update: Contains Software Update client 1.4.7 which adds cryptographic signature verification to the softwareupdate command line tool. This provides an additional means to perform software updates in a secure manner, along with the existing Software Update capability contained in System Preferences.

Security Update 7-12-02 (2002-07-12)

• Software Update: Fixes CVE ID CAN-2002-0676 to increase the security of the Software Update process for systems with Software Update client 1.4.5 or earlier. Packages presented via the Software Update mechanism are now cryptographically signed, and the new Software Update client 1.4.6 checks for a valid signature before installing new packages.

Security Update July 2002 (2002-07)

• Apache: Fixes CVE ID CAN-2002-0392 which allows remote attackers to cause a denial of service and possibly execute arbitrary code. Further details are available from: http://www.cert.org/advisories/CA-2002-17.html

• OpenSSH: Fixes two vulnerabilities, CAN-2002-0639 and CAN-2002-0640, where a remote intruder may be able to execute arbitrary code on the local system. Further details are available from: http://www.cert.org/advisories/CA-2002-18.html

Mac OS X 10.1.5

• sudo - Fixes CAN-2002-0184, where a heap overflow in sudo may allow local users to gain root privileges via special characters in the -p (prompt) argument.

• sendmail - Fixes CVE-2001-0653, where an input validation error exists in Sendmail's debugging functionality which could lead to a system compromise.

Internet Explorer 5.1 Security Update (2002-04)

• This addresses a vulnerability that could allow an attacker to take over your computer. Microsoft has since discontinued support and development on Internet Explorer for Mac, please consider upgrading to Safari instead.

Mac OS X 10.1.4

• TCP/IP broadcast: Addresses CAN-2002-0381 such that TCP/IP connections now check and block broadcast or multicast IP destination addresses. Further details at: http://www.FreeBSD.org/cgi/query-pr.cgi?pr=35022

Security Update - April 2002 (2002-04)

• Apache - updated to version 1.3.23 in order to incorporate the mod_ssl security fix.

• Apache Mod_SSL - updated to version 2.8.7-1.3.23 to address the buffer overflow vulnerability CAN-2002-0082 which could potentially be used to run arbitrary code. Further Details at: http://archives.neohapsis.com/archives/bugtraq/2002-02/0313.html

• groff - updated to version 1.17.2 to address the vulnerability CAN-2002-0003, where an attacker could gain rights as the 'lp' user remotely. Further details at: http://online.securityfocus.com/advisories/3859

• mail_cmds - updated to fix a vulnerability where users could be added to the mail group

• OpenSSH — updated to version 3.1p1 to address the vulnerability CAN-2002-0083, where an attacker could influence the contents of the memory. Further details at: http://www.pine.nl/advisories/pine-cert-20020301.html

• PHP - updated to version 4.1.2 to address the vulnerability CAN-2002-0081, which could allow an intruder to execute arbitrary code with the privileges of the web server. Further details at: http://www.cert.org/advisories/CA-2002-05.html

• rsync - updated to version 2.5.2 to address the vulnerability CAN-2002-0048 which could lead to corruption of the stack and possibly to execution of arbitrary code as the root user. Further details at: ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:10.rsync.asc

• sudo - updated to version 1.6.5p2 to address the vulnerability CAN-2002-0043, where a local user may obtain superuser privileges. Further details at: ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:06.sudo.asc

Mac OS X 10.1.3

• openssh - Updated to version 3.0.2p1 to address several vulnerabilities in the previous version. For details, please refer to: http://www.openssh.com/security.html

• WebDAV - Extended the Digest Authentication mode to work with additional servers

Mac OS X 10.1 Security Update 10-19-01 (2001-10-19)

• Fixes the vulnerability described in http://www.stepwise.com/Articles/Admin/2001-10-15.01.html where an application can be granted root access privileges.

Internet Explorer 5.1.1

• IE 5.1.1 - Fixes a problem with IE 5.1 bundled with Mac OS X v10.1 where Internet Explorer executes downloaded software automatically, which could result in data loss or other harm. More information is available in technical document 106503, "Mac OS X 10.1: Internet Explorer Executes Downloaded Software Automatically".

Mac OS X 10.1

• crontab - Fixes the vulnerability described in FreeBSD-SA-01:09 (ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:09.crontab.v1.1.asc) where local users can read arbitrary local files that conform to a valid crontab file syntax.

• fetchmail

• Fixes the buffer overflow vulnerability described in FreeBSD-SA-01:43 (ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:43.fetchmail.asc)

• Fixes the large header problem described in BugTraq MDKSA-2001:063: fetchmail (http://www.securityfocus.com/advisories/3426)

• Fixes the memory overwrite vulnerability described in BugTraq ESA-20010816-01: fetchmail-ssl (http://www.securityfocus.com/advisories/3502)

• ipfw - Fixes the vulnerability described in FreeBSD-SA-01:08.ipfw (ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:08.ipfw.asc) where a remote attack may be constructed with TCP packets with the ECE flag set.

• java - Fixes the vulnerability described in:http://sunsolve.Sun.COM/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/216&type=0&nav=sec.sbl&ttl=sec.sbl where an untrusted applet may monitor requests to and responses from an HTTP proxy server.

• open() syscall - Fixes the vulnerability described in FreeBSD-SA-97:05.open (ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/old/FreeBSD-SA-97:05.open.asc) where another user on the system could do unauthorized I/O instructions

• OpenSSL - Included version 0.9.6b which contains a number of fixes from the previous version. See http://www.openssl.org/ for details.

• procmail - Fixed the vulnerability described in Red Hat RHSA-2001:093-03 (http://www.redhat.com/support/errata/RHSA-2001-093.html) where signals are not handled correctly.

• rwhod - Fixes the vulnerability described in FreeBSD-SA-01:29.rwhod (ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:29.rwhod.asc) where remote users can cause the rwhod daemon to crash, denying service to clients.

• setlocale() string overflow - Fixes the vulnerability described in FreeBSD-SA-97:01.setlocale (ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/old/FreeBSD-SA-97:01.setlocale) where the setlocale() call contains a number of potential exploits through string overflows during environment variable expansion

• sort - Fixes the vulnerability described in CERT Vulnerability Note VU#417216 (http://www.kb.cert.org/vuls/id/417216) where an intruder may be able to block the operation of system administration programs by crashing the sort utility.

• system clipboard / J2SE - Fixes a security issue that permitted unauthorized applets access to the system clipboard.

• tcpdump - Fixes the vulnerability described in FreeBSD-SA-01:48 (ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:48.tcpdump.asc) where remote users can cause the local tcpdump process to crash, and may be able to cause arbitrary code to be executed.

• TCP Initial Sequence Numbers - Fixes the potential vulnerability described in FreeBSD-SA-00:52 (ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:52.tcp-iss.asc) where the algorithm to generate the number the system will use for the next incoming TCP connection was not sufficiently random

• tcsh '>>' operator - Fixes the vulnerability described in FreeBSD-SA-00:76 (ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:76.tcsh-csh.asc) where unprivileged local users can cause an arbitrary file to be overwritten when another person invokes the '<<' operator in tcsh (e.g. from within a shell script)

• telnetd - Fixes the vulnerability described in FreeBSD-SA-01:49 (ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:49.telnetd.v1.1.asc) where remote users can cause arbitrary code to be executed as the user running telnetd.

• timed - Fixes the vulnerability described in FreeBSD-SA-01:28 (ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:28.timed.asc) where remote users can cause the timed daemon to crash, denying service to clients.

Mac OS X Server 10.1

• MySQL 3.23.42 - Contains a number of fixes from the previous version. See the 3.23.42 section on the MySQL site (http://www.mysql.com/downloads/mysql-3.23.html) for details.

• Tomcat 3.2.3 - Contains a number of fixes from the previous version. See the Tomcat site (http://jakarta.apache.org/tomcat/) for details.

• Apache - Fixed the .DS_Store file vulnerability described in http://securityfocus.com/bid/3324

• Apache - Fixed the potential vulnerability where .htaccess files might be visible to web browsers if created on HFS+ volumes. The files directive in the http.conf file was modified to block from visibility to web browsers all files whose names begin with .ht, regardless of case.

Mac OS X Web Sharing Update 1.0

• Apache 1.3.19 - Fixes security issues with sites use of the mass virtual hosting module mod_vhost_alias or mod_rewrite.

• mod_hfs_apple - Addresses Apache case-insensitivity problems on Mac OS Extended (HFS+) volumes.

• OpenSSH 2.9p2 - Fixes SSH1 vulnerability described in http://www.openwall.com/advisories/OW-003-ssh-traffic-analysis.txt.

• sudo - Fixes the buffer overflow vulnerability described in FreeBSD-SA-01:38 (ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:38.sudo.asc)

Mac OS X 10.0.4 Server Update

• Samba 2.0.9 - Addresses the macro vulnerability described in us1.samba.org/samba/whatsnew/macroexploit.html

• sudo - Fixes the buffer overflow vulnerability described in FreeBSD-SA-01:38 (ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:38.sudo.asc)

Mac OS X 10.0.2

• FTP - Fixes the File Globbing vulnerability described in CERT(R) Advisory CA-2001-07 (http://www.cert.org/advisories/CA-2001-07.html)

• NTP - Fixes the buffer overflow vulnerability described in FreeBSD-SA-01:31 (ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:31.ntpd.asc)

Mac OS X 10.0.1

• OpenSSH-2.3.0p1 - SSH services are enabled via the Sharing pane in System Preferences

Mac OS Runtime for Java (MRJ) 2.2.5

• MRJ 2.2.5 - Fixes a security issue that permitted unauthorized applets access to the system clipboard.