ImageIO in Apple Safari before 4.0.5 and iTunes before 9.1 on Windows does not ensure that memory access is associated with initialized memory, which allows remote attackers to obtain potentially sensitive information from process memory via a crafted BMP image.

The remote mobile host is a using a version of Apple iOS earlier than 4.0. Such versions are potentially affected by multiple vulnerabilities. Apple iOS 4.0 contains security fixes for the following components :

  - Application Sandbox

  - CFNetwork

  - ImageIO

  - LibSystem

  - libxml

  - Passcode Lock

  - Safari

  - Settings

  - WebKit

The remote version of iTunes is older than 9.1.  Such versions may be affected by multiple vulnerabilities : 

  - A buffer underflow in ImageIO's handling of TIFF images may lead to an application crash or arbitrary code execution. (CVE-2009-2285)

  - An integer overflow in the application's handling of images with an embedded color profile may lead to an application crash or arbitrary code execution. (CVE-2010-0040)

  - An uninitialized memory access issue in ImageIO's handling of BMP images may result in sending data from Safari's memory to a website under an attacker's control. (CVE-2010-0041)

  - An uninitialized memory access issue in ImageIO's handling of TIFF images may result in sending data from Safari's memory to a website under an attacker's control. (CVE-2010-0042)

  - A memory corruption issue in the application's handling of TIFF images may lead to an application crash or arbitrary code execution. (CVE-2010-0043)

  - An infinite loop in the application's handling of imported MP4 podcast files may lead to an application crash and prevent subsequent operation. (CVE-2010-0531)

  - A race condition during the installation process may allow a local user modify a file that is then executed with SYSTEM privileges. (CVE-2010-0532)

  - A path searching issue may allow code execution if an attacker can place a specially crafted DLL in a directory and have a user open anothe file using iTunes in that directory. (CVE-2010-1795)

  - Syncing a mobile device may allow a local user to gain the priviliges of the console user due to an insecure file operation in the handling of log files. (CVE-2010-1768)

The version of Apple iTunes on the remote host is prior to version 9.1. It is, therefore, affected by multiple vulnerabilities :

  - A buffer underflow in ImageIO's handling of TIFF images     can lead to a denial of service or arbitrary code     execution. (CVE-2009-2285)

  - An integer overflow in the application's handling of     images with an embedded color profile can lead to a     denial of service or arbitrary code execution.
    (CVE-2010-0040)

  - An uninitialized memory access vulnerability in     ImageIO's handling of BMP images can result in the     sending of sensitive data from Safari's memory to     a website under an attacker's control. (CVE-2010-0041)

  - An uninitialized memory access vulnerability in     ImageIO's handling of TIFF images can result in the     sending of sensitive data from Safari's memory to     a website under an attacker's control. (CVE-2010-0042)

  - A memory corruption vulnerability in the ImageIO's     handling of TIFF images can lead to a denial of     service or arbitrary code execution. (CVE-2010-0043)

  - An infinite loop vulnerability in the application's     handling of imported MP4 podcast files can lead to a     denial of service or arbitrary code execution.
    (CVE-2010-0531)

  - A race condition during the installation process     allows a local attacker to modify an unspecified file     which can then be executed with SYSTEM privileges.
    (CVE-2010-0532)

  - A path searching vulnerability exists that allows code     execution if an attacker places a specially crafted DLL     in a directory and has a user open another file using     iTunes in that directory. (CVE-2010-1795)

  - Syncing a mobile device can allow a local attacker to     gain the privileges of the console user due to an     insecure file operation in the handling of log files.
    (CVE-2010-1768)

The version of Apple iTunes installed on the remote Windows host is older than 9.1. Such versions may be affected by multiple vulnerabilities :

  - A buffer underflow in ImageIO's handling of TIFF images     may lead to an application crash or arbitrary code     execution. (CVE-2009-2285)

  - An integer overflow in the applications's handling of     images with an embedded color profile may lead to an     application crash or arbitrary code execution.
    (CVE-2010-0040)

  - An uninitialized memory access issue in ImageIO's     handling of BMP images may result in sending data from     Safari's memory to a website under an attacker's     control. (CVE-2010-0041)

  - An uninitialized memory access issue in ImageIO's     handling of TIFF images may result in sending data from     Safari's memory to a website under an attacker's     control. (CVE-2010-0042)

  - A memory corruption issue in the application's handling     of TIFF images may lead to an application crash or     arbitrary code execution. (CVE-2010-0043)

  - A race condition during the installation process may     allow a local user modify a file that is then executed     with SYSTEM privileges. (CVE-2010-0532)

  - A path searching issue may allow code execution if an     attacker can place a specially crafted DLL in a     directory and have a user open another file using     iTunes in that directory. (CVE-2010-1795)

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.3.  Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server

  - Apache

  - CoreAudio

  - CoreMedia

  - CoreTypes

  - CUPS

  - DesktopServices

  - Disk Images

  - Directory Services

  - Dovecot

  - Event Monitor

  - FreeRADIUS

  - FTP Server

  - iChat Server

  - ImageIO

  - Image RAW

  - Libsystem

  - Mail

  - MySQL

  - OS Services

  - Password Server

  - PHP

  - Podcast Producer

  - Preferences

  - PS Normalizer

  - QuickTime

  - Ruby

  - Server Admin

  - SMB

  - Tomcat

  - Wiki Server

  - X11

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied.

This security update contains fixes for the following products :

  - AppKit
  - Application Firewall
  - AFP Server
  - Apache
  - ClamAV
  - CoreTypes
  - CUPS
  - curl
  - Cyrus IMAP
  - Cyrus SASL
  - Disk Images
  - Directory Services
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - Image RAW
  - Libsystem
  - Mail
  - Mailman
  - OS Services
  - Password Server
  - perl
  - PHP
  - PS Normalizer
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - unzip
  - vim
  - Wiki Server
  - X11
  - xar

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3.

Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server
  - Apache
  - CoreAudio
  - CoreMedia
  - CoreTypes
  - CUPS
  - DesktopServices
  - Disk Images
  - Directory Services
  - Dovecot
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - ImageIO
  - Image RAW
  - Libsystem
  - Mail
  - MySQL
  - OS Services
  - Password Server
  - PHP
  - Podcast Producer
  - Preferences
  - PS Normalizer
  - QuickTime
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - Wiki Server
  - X11

The version of Safari installed on the remote host is earlier than 4.0.5.  Such versions are potentially affected by several issues : 

  A buffer underflow in ImageIO's handling of TIFF images could lead to a crash or arbitrary code execution. (CVE-2009-2285)

  - An integer overflow in the handling of images with an embedded color profile could lead to a crash or arbitrary code execution. (CVE-2010-0040)

  - An uninitialized memory access issue in ImageIO's handling of BMP images could result in sending of data from Safari's memory to a website. (CVE-2010-0041)

  - An uninitialized memory access issue in ImageIO's handling of TIFF images could result in sending of data from Safari's memory to a website. (CVE-2010-0042)

  - A memory corruption issue in the handling of TIFF images could lead to a crash or arbitrary code execution. (CVE-2010-0043)

  - An implementation issue in the handling of cookies set by RSS and Atom feeds could result in a cookie being set when visiting or updating a feed even if Safari is configured to block cookies via the 'Accept Cookies' preference. (CVE-2010-0044)

  - An issue in Safari's handling of external URL schemes could cause a local file to be opened in response to a URL encountered on a web page, which could allow  a malicious web server to execute arbitrary code. (CVE-2010-0045)

  - A memory corruption issue in WebKit's handling of CSS format() arguments could lead to a crash or arbitrary code execution. (CVE-2010-0046)

  - A use-after-free issue in the handling of HTML object element fallback content could lead to a crash or arbitrary code execution. (CVE-2010-0047)

  - A use-after-free issue in WebKit's parsing of XML documents could lead to a crash or arbitrary code execution. (CVE-2010-0048)

  - A use-after-free issue in the handling of HTML elements containing right-to-left displayed text could lead to a crash or arbitrary code execution. (CVE-2010-0049)

  - A use-after-free issue in WebKit's handling of incorrectly nested  HTML tags could lead to a crash or arbitrary code execution. (CVE-2010-0050)

  - An implementation issue in WebKit''s handling of cross-origin stylesheet requests when visiting a malicious website could result in disclosure of the content of protected resources on another website. (CVE-2010-0051)

  - A use-after-free issue in WebKit's handling of callbacks for HTML elements could lead to a crash or arbitrary code execution. (CVE-2010-0052)

  - A use-after-free issue in the rendering of content with a CSS display property set to 'run-in' could lead to a crash or arbitrary code execution. (CVE-2010-0053)

  - A use-after-free issue in WebKit's handling of HTML image elements could lead to a crash or arbitrary code execution. (CVE-2010-0054)

The version of Safari installed on the remote Windows host is earlier than 4.0.5.  It thus is potentially affected by several issues :

  - A buffer underflow in ImageIO's handling of TIFF images     could lead to a crash or arbitrary code execution.
    (CVE-2009-2285)

  - An integer overflow in the handling of images with an     embedded color profile could lead to a crash or     arbitrary code execution. (CVE-2010-0040)

  - An uninitialized memory access issue in ImageIO's     handling of BMP images could result in sending of data     from Safari's memory to a website. (CVE-2010-0041)

  - An uninitialized memory access issue in ImageIO's     handling of TIFF images could result in the sending of     data from Safari's memory to a website. (CVE-2010-0042)

  - A memory corruption issue in the handling of TIFF     images could lead to a crash or arbitrary code     execution. (CVE-2010-0043)

  - An implementation issue in the handling of cookies set     by RSS and Atom feeds could result in a cookie being     set when visiting or updating a feed even if Safari is     configured to block cookies via the 'Accept Cookies'     preference. (CVE-2010-0044)

  - An issue in Safari's handling of external URL schemes     could cause a local file to be opened in response to a     URL encountered on a web page, which could allow a     malicious web server to execute arbitrary code.
    (CVE-2010-0045)

  - A memory corruption issue in WebKit's handling of CSS     format() arguments could lead to a crash or arbitrary     code execution. (CVE-2010-0046)

  - A use-after-free issue in the handling of HTML object     element fallback content could lead to a crash or     arbitrary code execution. (CVE-2010-0047)

  - A use-after-free issue in WebKit's parsing of XML     documents could lead to a crash or arbitrary code     execution. (CVE-2010-0048)

  - A use-after-free issue in the handling of HTML elements     containing right-to-left displayed text could lead to a     crash or arbitrary code execution. (CVE-2010-0049)

  - A use-after-free issue in WebKit's handling of     incorrectly nested HTML tags could lead to a crash or     arbitrary code execution. (CVE-2010-0050)

  - An implementation issue in WebKit's handling of cross-     origin stylesheet requests when visiting a malicious     website could result in disclosure of the content of     protected resources on another website. (CVE-2010-0051)

  - A use-after-free issue in WebKit's handling of     callbacks for HTML elements could lead to a crash or     arbitrary code execution. (CVE-2010-0052)

  - A use-after-free issue in the rendering of content with     a CSS display property set to 'run-in' could lead to a     crash or arbitrary code execution. (CVE-2010-0053)

  - A use-after-free issue in WebKit's handling of HTML     image elements could lead to a crash or arbitrary code     execution. (CVE-2010-0054)

ID	Name	Product	Family	Severity
5578	Apple iOS < 4.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	critical
5491	iTunes < 9.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
45391	Apple iTunes < 9.1 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	high
45390	Apple iTunes < 9.1 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	high
5489	Mac OS X < 10.6.3 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
45373	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)	Nessus	MacOS X Local Security Checks	critical
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
5361	Safari < 4.0.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
45045	Safari < 4.0.5 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2010-0041

medium

Tenable Plugins

critical

high

high

high

critical

critical

critical

high

high