Monday, November 17, 2014

Security Patches: OS X 10.10.1, iOS 8.1.1
& Apple TV 7.0.2

--
Intro: I get all conflicted about what to do when ordinary old security updates are released. I don't want to write a diatribe. But I should highlight their release. So I decided to just announce them as they show up, without munificent exposition or graphical profundity (unless I feel like it).

Today Apple released software updates with the following security patches


OS X 10.10.1 Yosemite: 

APPLE-SA-2014-11-17-2 OS X Yosemite 10.10.1

OS X 10.10.1 is now available and addresses the following:

CFNetwork
Available for:  OS X Yosemite v10.10
Impact:  Website cache may not be fully cleared after leaving private browsing
Description:  A privacy issue existed where browsing data could remain in the cache after leaving private browsing. This issue was addressed through a change in caching behavior. 
CVE-ID
CVE-2014-4460

Spotlight
Available for:  OS X Yosemite v10.10
Impact:  Unnecessary information is included as part of the initial connection between Spotlight or Safari and the Spotlight Suggestions servers
Description:  The initial connection made by Spotlight or Safari to the Spotlight Suggestions servers included a user's approximate location before a user entered a query. This issue was addressed by removing this information from the initial connection and only sending the user's approximate location as part of queries. 
CVE-ID
CVE-2014-4453 : Ashkan Soltani

System Profiler About This Mac
Available for:  OS X Yosemite v10.10
Impact:  Unnecessary information is included as part of a connection to Apple to determine the system model
Description:  The request made by About This Mac to determine the model of the system and direct users to the correct help resources included unnecessary cookies. This issue was addressed by removing cookies from the connection.
CVE-ID
CVE-2014-4458 : Landon Fuller of Plausible Labs

WebKit
Available for:  OS X Yosemite v10.10
Impact:  Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description:  A use after free issue existed in the handling of page objects. This issue was addressed through improved memory management. 
CVE-ID
CVE-2014-4459

iOS 8.1.1: 

APPLE-SA-2014-11-17-1 iOS 8.1.1
iOS 8.1.1 is now available and addresses the following:CFNetwork

Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later Impact:  Website cache may not be fully cleared after leaving private browsing
Description:  A privacy issue existed where browsing data could remain in the cache after leaving private browsing. This issue was addressed through a change in caching behavior. 
CVE-ID
CVE-2014-4460

dyld
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later Impact:  A local user may be able to execute unsigned code Description:  A state management issue existed in the handling of Mach-O executable files with overlapping segments. This issue was addressed through improved validation of segment sizes. 
CVE-ID
CVE-2014-4455 : @PanguTeam

Kernel
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later Impact:  A malicious application may be able to execute arbitrary code with system privileges
Description:  A validation issue existed in the handling of certain metadata fields of IOSharedDataQueue objects. This issue was addressed through relocation of the metadata. 
CVE-ID
CVE-2014-4461 : @PanguTeam

Lock Screen
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later Impact:  An attacker in possession of a device may exceed the maximum number of failed passcode attempts
Description:  In some circumstances, the failed passcode attempt limit was not enforced. This issue was addressed through additional enforcement of this limit.
CVE-ID
CVE-2014-4451 : Stuart Ryan of University of Technology, Sydney

Lock Screen
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later Impact:  A person with physical access to the phone may be able to access photos in the Photo Library
Description:  The Leave a Message option in FaceTime may have allowed viewing and sending photos from the device. This issue was addressed through improved state management.
CVE-ID
CVE-2014-4463

Sandbox Profiles
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later Impact:  A malicious application may be able to launch arbitrary binaries on a trusted device
Description:  A permissions issue existed with the debugging functionality for iOS that allowed the spawning of applications on trusted devices that were not being debugged. This was addressed by changes to debugserver's sandbox.
CVE-ID
CVE-2014-4457 : @PanguTeam

Spotlight
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later Impact:  Unnecessary information is included as part of the initial connection between Spotlight or Safari and the Spotlight Suggestions servers
Description:  The initial connection made by Spotlight or Safari to the Spotlight Suggestions servers included a user's approximate location before a user entered a query. This issue was addressed by removing this information from the initial connection and only sending the user's approximate location as part of queries. CVE-ID
CVE-2014-4453 : Ashkan Soltani 
WebKit
Available for:  iPhone 4s and later,
iPod touch (5th generation) and later, iPad 2 and later Impact:  Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description:  Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling.
CVE-ID
CVE-2014-4452
CVE-2014-4462

Apple TV 7.0.2: 
APPLE-SA-2014-11-17-3 Apple TV 7.0.2
Apple TV 7.0.2 is now available and addresses the following:

Apple TV
Available for:  Apple TV 3rd generation and later Impact:  An attacker with a privileged network position may cause an unexpected application termination or arbitrary code execution Description:  Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling.
CVE-ID
CVE-2014-4452
CVE-2014-4462

Apple TV
Available for:  Apple TV 3rd generation and later Impact:  A local user may be able to execute unsigned code Description:  A state management issue existed in the handling of Mach-O executable files with overlapping segments. This issue was addressed through improved validation of segment sizes.
CVE-ID
CVE-2014-4455 : @PanguTeam

Apple TV
Available for:  Apple TV 3rd generation and later Impact:  A malicious application may be able to execute arbitrary code with system privileges
Description:  A validation issue existed in the handling of certain metadata fields of IOSharedDataQueue objects. This issue was addressed through relocation of the metadata.
CVE-ID
CVE-2014-4461 : @PanguTeam

Security documents for all Apple security patches can be found (eventually) at:


https://support.apple.com/kb/HT1222


[Happy news! Apple has revamped the Apple Security Updates page. Hopefully, this means they will be taking it more seriously in the future. That would be a good thing.]




--

No comments:

Post a Comment