Apple has shipped a monster security patch for Mac OS X to fix 34 flaws in the operating system and bundled third-party utilities.
The 17MB security update, available through Software Update and Apple Downloads, corrects a wide range of flaws in Mac OS X 10.3.9 (client and server).
Security alerts aggregator Secunia Inc. rated the update as “highly critical” and warned that Mac users are at risk of security bypass, cross-site scripting, data manipulation, data leakage, privilege escalation, denial-of-service and system access attacks.
The update includes two fixes for bugs in the default Safari Web browser that could allow phishing attacks.
According to Apple Computer Inc., one of the Safari flaws could lead to the execution of arbitrary commands if a user clicks on a maliciously crafted rich text file from the browser.
“Safari renders rich text content using code that allows URLs to be called directly, which bypasses the normal browser security checks,” the company said.
Another Safari flaw could allow information to be inadvertently submitted to the wrong site. “When submitting forms in Safari on an XSL-formatted page, data is sent to the next page browsed,” Apple explained, noting that the update ensures the information is submitted correctly.
Three vulnerabilities in Apples implementation of the open-source Apache server are also addressed, including a buffer overflow in the “htdigest” program that could allow remote system compromise.
Another three flaws in “AppKit” are also addressed to correct buffer overflows in the way rich text files are handled. A separate buffer overrun could also allow the execution of arbitrary code when Word documents are read.
Apple also fixed three flaws in the Kerberos network authentication protocol, including one that could lead to system compromise.
“A heap buffer overflow in password history handling code could be exploited to execute arbitrary code on a Key Distribution Center (KDC). This issue does not affect Mac OS X 10.4,” the company said.
The patch also includes fixes for multiple Kerberos buffer overflow vulnerabilities that could result in denial-of-service or remote compromise of a KDC.
The update also includes security patches for flaws in Bluetooth, CoreFoundation, CUPS, Directory Services, HItoolbox, loginwindow, Mail, MySQL, OpenSSL, ping, QuartzComposerScreenSaver, SecurityInterface, servermgrd, servermgr_ipfilter, SquirrelMail, traceroute, WebKit, Weblog Server, X11 and zlib.
