Alert GCSA-07127 Apple Mac OS X Security Update 2007-009

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


************************************************************************

Alert ID : GCSA-07127
Data : 20 Dicembre 2007
Titolo : Apple Mac OS X Security Update 2007-009

************************************************************************

:: Descrizione del problema

Apple ha rilasciato il Security Update 2007-009 per correggere
varie vulnerabilta' che affliggono il sistema operativo Mac OS X
ed alcune applicazioni distribuite insieme al sistema stesso.


:: Software interessato

Apple Mac OS X versione 10.4.11 (Tiger) e precedenti
Apple Mac OS X versione 10.5.1 (Leopard) e precedenti

Apple Mac OS X Server versione 10.4.11 (Tiger) e precedenti
Apple Mac OS X Server versione 10.5.1 (Leopard) e precedenti

* Address Book * python
* CFNetwork * Quick Look
* ColorSync * ruby
* Core Foundation * Safari
* CUPS * Safari RSS
* Desktop Services * Samba
* Flash Player Plug-in * Shockwave Plug-in
* GNU Tar * SMB
* iChat * Software Update
* IO Storage Family * Spin Tracer
* Launch Services * Spotlight
* Mail * tcpdump
* perl * XQuery

L'aggiornamento riguarda sia i sistemi Intel-based
sia quelli PowerPC-based.


:: Impatto

Esecuzione remota di codice arbitrario
Accesso ad informazioni sensibili
Denial of Service


:: Soluzione

Applicare l'aggiornamento attraverso lo strumento 'Software Update'
http://docs.info.apple.com/article.html?artnum=106704

o scaricandolo da Apple Downloads
http://www.apple.com/support/downloads/


:: Riferimenti

Apple - About Security Update 2007-009
http://docs.info.apple.com/article.html?artnum=307179

APPLE-SA-2007-12-17 Security Update 2007-009
http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html

Apple security updates
http://docs.info.apple.com/article.html?artnum=61798

Mitre's CVE ID
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4708
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4709
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4710
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5847
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5848
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4351
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5849
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5850
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5476
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4131
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5851
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5853
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5854
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6165
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5855
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5116
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4965
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5856
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5857
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5770
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5379
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5380
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6077
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5858
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5859
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4572
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5398
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0024
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3876
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5863
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5860
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5861
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1218
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3798
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1659
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1660
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1661
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1662
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4766
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4767
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4768

Securityfocus Bugtraq ID
http://www.securityfocus.com/bid/26910
http://www.securityfocus.com/bid/26908
http://www.securityfocus.com/bid/26510

US-CERT
http://www.us-cert.gov/cas/techalerts/TA07-352A.html
http://www.us-cert.gov:80/cas/alerts/SA07-352A.html

CIAC Advisory
http://www.ciac.org/ciac/bulletins/s-090.shtml

Secunia
http://secunia.com/advisories/28136/

FrSirt
http://www.frsirt.com/english/advisories/2007/4238

-----BEGIN PGP SIGNATURE-----

iQCVAwUBR2o5ifOB+SpikaiRAQJgjwQAlwMwh8VngI9XnsGqaARTcLgyAQuYpTis
V9T548iYVuLp52lysdJZX2a/WVH8thWiUz7H4gQR/j1Emh6fZG9DfsAe9MJuIL2w
4MCjwTn1XRYzg8u1S+9WD4jyd8Q9q9ha4+lV2+3G8o30lt9fzE8Wuj0KhsdHmvPb
uNIgcGwZDQo=
=33V0
-----END PGP SIGNATURE-----