NGS00052 Patch Notification: Apple Mac OS X Image RAW Multiple Buffer Overflows

["Research@NGSSecure" <research@xxxxxxxxxxxxx>]

Apple Mac OS X Image RAW Multiple Buffer Overflows

22/03/2011

Paul Harrington of NGS Secure has discovered a High risk vulnerability in Mac 
OS X Image RAW. Multiple buffer overflow issues existed in Image RAW's handling 
of Canon RAW images. Viewing a maliciously crafted Canon RAW image may result 
in an unexpected application termination or arbitrary code execution.

Versions affected include:

Mac OS X v10.6 through v10.6.6, Mac OS X Server v10.6 through v10.6.6 with 
RawCamera.bundle < 3.6

Apple has released a patches that addresses the issue. The announcement of the 
patches can be found here:

http://support.apple.com/kb/DL1357
http://support.apple.com/kb/HT4581

NGS Secure is going to withhold details of this flaw for three months. This 
three month window will allow users the time needed to apply the patch before 
the details are released to the general public. This reflects the NGS Secure 
approach to responsible disclosure.

NGS Secure Research
http://www.ngssecure.com
________________________________

Research@NGSSecure

NGS Secure

,

Telephone:
Mobile:
Fax:
Website: www.ngssecure.com<http://www.ngssecure.com>
Email:  research@xxxxxxxxxxxxx<mailto:research@xxxxxxxxxxxxx>
        [http://www.nccgroup.com/_client/images/global/NGS%20Secure.jpg]  
<http://www.ngssecure.com/>
________________________________

This email is sent for and on behalf of NGS Secure Limited (Registered in 
England CRN: 04474600). The ultimate holding company is NCC Group plc 
(Registered in England CRN: 4627044). Registered Office: Manchester Technology 
Centre, Oxford Road, Manchester, M1 7EF

Confidentiality: This e-mail contains proprietary information, some or all of 
which may be confidential and/or legally privileged. It is for the intended 
recipient only. If an addressing or transmission error has misdirected this 
e-mail, please notify the author by replying to this e-mail and then delete the 
original. If you are not the intended recipient you may not use, disclose, 
distribute, copy, print or rely on any information contained in this e-mail. 
You must not inform any other person other than NCC Group or the sender of its 
existence.

For more information about NGS Secure please visit 
www.ngssecure.com<http://www.ngssecure.com>

P Before you print think about the ENVIRONMENT