Apple Computer Inc. has released a security update for Mac OS X that fixes seven vulnerabilities in the operating system and its applications, including ColorSync, Mail and PHP.
The problems fixed range in seriousness from a ColorSync issue that could potentially allow users to create a malformed ICC profile that would then permit the execution of arbitrary code, to minor issues in the version of PHP bundled with the operating system. The bugs affect Mac OS X v10.3.7 and the same version of Mac OS X Server.
Two of Apples bundled applications also received patches in the update. Mail was patched to fix a problem where the Ethernet MAC address of the sending machine could, under certain circumstances, be sent in the header of an e-mail. Safari was also patched, to correct a problem where certain pop-up windows could be used to mislead a user about the location of the content of the window. This second problem only occurred if Safaris pop-up blocker was turned off.
The update also addresses a privilege escalation flaw in the operating systems “at” command, which did not correctly drop its privileges after certain operations. This meant that users could potentially delete files that did not belong to them, and which they should have no access to.
The bug in “at” is believed to be the same as that highlighted by security company Immunity last week. The company publicly announced it had discovered four issues in the Darwin open-source core of Mac OS X, including a similar bug in “at.” Although Apple lists the name of the issue for the Common Vulnerabilities and Exposures database, the entry is currently marked simply as under review, and no details are listed.
A posting on the Web site of security consultancy Secunia rates the issues as “highly critical,” and Apple recommends that all users upgrade their system as soon as possible. The update is available for download from Apples Web site, as well as via Mac OS Xs Software Update feature.