News 

The update fixes vulnerabilities that could result in arbitrary code execution, system crashes or privilege elevation.

The first flaw (CVE-ID: CVE-2006-3507) results from two separate stack buffer overflows that exist in the AirPort wireless driver's handling of malformed frames. An attacker in local proximity may be able to trigger an overflow by injecting a maliciously-crafted frame into a wireless network. When the AirPort is on, this could lead to arbitrary code execution with system privileges. There is no known exploit for this issue. The update makes AirPort perform additional validation of wireless frames.

The second flaw (CVE-2006-3508) is a result of a heap buffer overflow that exists in the AirPort wireless driver's handling of scan cache updates. An attacker in local proximity may be able to trigger the overflow by injecting a maliciously-crafted frame into the wireless network. This could lead to a system crash, privilege elevation,

ADVERTISEMENT

or arbitrary code execution with system privileges. As above, there is no known exploit for this issue.

The third flaw (CVE-2006-3509) is caused by an integer overflow in the Airport wireless driver's API for third-party wireless software. This could lead to a buffer overflow in such applications dependent upon API usage. No applications are known to be affected at this time. If an application is affected, then an attacker in local proximity may be able to trigger an overflow by injecting a maliciously-crafted frame into the wireless network. This may cause crashes or lead to arbitrary code execution with the privileges of the user running the application. Again there is no known exploit for this issue.

The first vulnerability affects Mac OS X 10.3.9 Panther and 10.4.7 Tiger server and client versions. The other two only affect Tiger.

Security Update 2006-005 is available via Software Update or from apple.com/support/downloads. It is also available as a standalone AirPort update. For more information on the update see About the security content of AirPort Update 2006-001 and Security Update 2006-005.