Apple on Thursday released Security Update 2008-005, patching a critical DNS (Domain Name Server) flaw that other companies began fixing on July 8. The DNS fix is among 13 items updated in the security release.
First reported by Dan Kaminsky of IOActive, the DNS flaw would allow an attacker to introduce forged DNS information into the cache of a caching nameserver. The end result of the attack, known as cache poisoning, is that a visitor to a Web site is redirected to wherever the attacker choses to send them.
BIND has been updated in the security release to version 9.4.2-P1, which implements source port randomization to improve resilience against cache poisoning attacks.
Apple’s Data Detectors Engine in Mac OS X has been updated to fix a problem that caused a user viewing maliciously crafted messages with Data Detectors to experience an unexpected application termination.
Running the “Repair Permissions” could allow a local user with emacs to run commands with system privileges. The update corrects the permissions applied to emacs in the Repair Permissions tool. This issue does not affect Mac OS X 10.5 or later.
Issues with OpenLDAP and OpenSSL where a remote attacker may be able to cause an unexpected application termination have both been addressed. Rsync has been updated to fix a problem that would allow files outside the module root to be accessed or overwritten remotely.
Mac OS X 10.5 users get a new version of PHP with this security update, which fixes multiple vulnerabilities, the most serious of which may lead to arbitrary code execution, according to Apple.
QuickLook also got updated to fix a problem that happened if a user downloaded a maliciously crafted Microsoft Office file causing an unexpected application termination or arbitrary code execution.
The Open Scripting Architecture was updated so local users could not execute commands with elevated privileges.
Apple Security Update Security Update 2008-005 is available from the software update mechanism in Mac OS X or from Apple’s Web site.