iChat Lets Remote Users on the Local Network Initiate Unauthorized Video Chats
|
|
SecurityTracker Alert ID: 1019109 |
|
SecurityTracker URL: http://securitytracker.com/id/1019109
|
|
CVE Reference:
CVE-2007-5851
(Links to External Site)
|
Updated: Dec 22 2007
|
Original Entry Date: Dec 18 2007
|
Impact:
Host/resource access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
A vulnerability was reported in iChat. A user can initiate an unauthorized video chat.
A remote user on the local network can initiate a video conference with the target user without the target user's approval.
Mac OS X versions 10.5 and later are not affected.
|
Impact:
A remote user on the local network can initiate a video conference with the target user without the target user's approval.
|
Solution:
The vendor has issued a fix (APPLE-SA-2007-12-17 Security Update 2007-009 v1.1), available from from the Software Update pane in System Preferences, or Apple's Software Downloads web site at:
http://www.apple.com/support/downloads/
For Mac OS X v10.5.1
The download file is named: "SecUpd2007-009.dmg"
Its SHA-1 digest is: 0ba35ef30a525792f1d4015395997b42f524dd38
For Mac OS X v10.4.11 (Universal)
The download file is named: "SecUpd2007-009Univ.dmg"
Its SHA-1 digest is: 49f52d4f647ea4a1fabef34cccac263bfd03791a
For Mac OS X v10.4.11 (PPC)
The download file is named: "SecUpd2007-009Ti.dmg"
Its SHA-1 digest is: d1c5c4bc23267dd846bb96e7be69b084579c1bba
The Apple advisories are available at:
http://docs.info.apple.com/article.html?artnum=307179
http://docs.info.apple.com/article.html?artnum=307224
[Editor's note: The original security update 2007-009 issued on December 17, 2007 contained a performance issue that may cause Safari to crash. On December 21, 2007, Apple issued the revised security update 2007-009 v1.1. Customers should apply the new update.]
|
Vendor URL: docs.info.apple.com/article.html?artnum=307179 (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
UNIX (OS X)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 18 Dec 2007 00:59:21 -0500
Subject: Apple iChat
|
APPLE-SA-2007-12-17 Security Update 2007-009
iChat
CVE-ID: CVE-2007-5851
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11
Impact: A person on the local network may initiate a video
connection without the user's approval
Description: An attacker on the local network may initiate a video
conference with a user without the user's approval. This update
addresses the issue by requiring user interaction to initiate a video
conference. This issue does not affect systems running Mac OS X 10.5
or later.
|
|
