Vulnerabilities in Mac OS X -

[andsome]

"Knowledge is the antidote to fear."

Ralph Waldo Emerson (1803-1882); US philosopher, poet, essayist.

- Vulnerabilities in Mac OS X -

Oxygen3 24h-365d, by Panda Software (http://www.pandasoftware.com)

Madrid, October 31, 2003 - @stake has reported (*) two vulnerabilities that

affect Mac OS X 10.2.8 and earlier versions. The security implications of

these flaws range from crashing the system to running commands as root.

The first of these vulnerabilities can cause the Mac OS X kernel to crash

when a long command line argument is specified. When this happens, the

system will immediately block, without generating any log files or

displaying any error messages, and users will not be able to perform any

tasks. After several minutes, the computer will restart.

A more sophisticated exploit of this vulnerability could allow an attacker

to use an overflow in the kernel to run arbitrary commands as root, with

maximum privileges in the system.

The second flaw lies in the fact that many applications are installed in Mac

OS X with insecure permissions. This could allow a malicious user to

overwrite files and directories and obtain confidential information.

Until the patches for the different versions are released, users whose

computers are affected by these vulnerabilities can upgrade to Panther (Mac

OS X 10.3). More information at: http://www.apple.com/macosx/

(*) The @stake security advisories are published at:

http://www.atstake.com/research/advisories...3/a102803-3.txt

http://www.atstake.com/research/advisories...3/a102803-2.txt

NOTE: The addresses above may not show up on your screen as single lines.

This would prevent you from using the links to access the web pages. If this

happens, just use the 'cut' and 'paste' options to join the pieces of the

URL.

------------------------------------------------------------

The 5 viruses most frequently detected by Panda ActiveScan, Panda Software's

free online scanner: 1) Bugbear.B; 2) Blaster; 3) Gibe.C; 4) Parite.B; 5)

Sober.A.

------------------------------------------------------------

To unsubscribe from Oxygen3 24h-365d, please visit:

http://www.pandasoftware.com/unsubscribe.asp

To contact with Panda Software, please visit:

http://www.pandasoftware.com/about/contact/

------------------------------------------------------------