Apple Plugs IDN Spoof Bug

mmarlett writes "Security Update 2005-003 updates Safari's support for International Domain Names (IDN) to prevent lookalike characters from being used to spoof the URL displayed in the address field, SSL certificate, or status bar. Opera fixed this in Feburuary while Mozilla just dropped support for IDNs, and you may recall that Internet Explorer did not suffer from this exploit because it sucks."

A good solution

[cuijian]

This seems like a much better short-term solution than other browsers have come up with. Apple managed to keep International Domain Name support for most of their customers (particularly in countries like Japan and China where they are starting to be widely used) and address the security issue.

I'm not sure what the right long-term solution is. Its not ideal to have to turn off support for Cherokee, Cyrillic and Greek. It seems like the domain registrars need to take some of the responsibility.

Re:A good solution

[gorre]

I'm not sure what the right long-term solution is. Its not ideal to have to turn off support for Cherokee, Cyrillic and Greek.

Perhaps rendering non-ASCII characters in a different colour so the user can tell the difference between a lookalike character and the "real thing" could be an option? Not perfect but it's something that springs to mind which may be better than turning off IDN support completely.

Re:A good solution

[zonx lebaam]

Or perhaps allowing the user to choose *a single* primary script which is always rendered as is, and using punyscript/colorizing/other to for other scripts.

This is similar to the roman-default solution used now, but more general.

Note that it is less general than the total solution now presented which allows the savvy user to activate multiple scripts with similar looking glyphs, but better protects said savvy users from phishing.

Re:A good solution

[cuijian]

Apple's solution is based on a user editable white list of allowed scripts so that's already there for you.

You can choose *a single* primary script (or two, or...), whatever you want. You can even turn off all IDN support.

here we go ; )

[mabu]

Internet Explorer did not suffer from this exploit because it sucks.

Microsoft sycophant whine-fest in 3..2..1..

on IE's 'immunity'

[Tumbleweed]

Internet Explorer did not suffer from this exploit because it sucks.

I guess you could call this "security through deplorability".

Patch covers a bit more ...

[Hungus]

Security Update 2005-003

AFP Server Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
CVE-ID: CAN-2005-0340
Impact: A specially crafted packet can cause a Denial of Service against the AFP Server.
Description: A specially crafted packet will terminate the operation of the AFP Server due to an incorrect memory reference.

AFP Server
Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
CVE-ID: CAN-2005-0715
Impact: The contents of a Drop Box can be discovered.
Description: Fixes the checking of file permissions for access to Drop Boxes. Credit to John M. Glenn of San Francisco for reporting this issue.

Bluetooth Setup Assistant
Available for: Mac OS X 10.3.8, Mac OS X Server 10.3.8
CVE-ID: CAN-2005-0713
Impact: Local security bypass when using a Bluetooth input device.
Description: The Bluetooth Setup Assistant may be launched on systems without a keyboard or a preconfigured Bluetooth input device. In these cases, access to certain privileged functions has been disabled within the Bluetooth Setup Assistant.

Core Foundation
Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
CVE-ID: CAN-2005-0716
Impact: Buffer overflow via an environment variable.
Description: The incorrect handling of an environment variable within Core Foundation can result in a buffer overflow that may be used to execute arbitrary code. This issue has been addressed by correctly handling the environment variable. Credit to iDEFENSE and Adriano Lima of SeedSecurity.com for reporting this issue.

Cyrus IMAP
Available for: Mac OS X Server v10.3.8
CVE-ID: CAN-2004-1011, CAN-2004-1012, CAN-2004-1013, CAN-2004-1015, CAN-2004-1067
Impact: Multiple vulnerabilities in Cyrus IMAP, including remotely exploitable denial of service and buffer overflows.
Description: Cyrus IMAP is updated to version 2.2.12, which includes fixes for buffer overflows in fetchnews, backend, proxyd, and imapd. Further information is available from http://asg.web.cmu.edu/cyrus/download/imapd/change s.html.

Cyrus SASL
Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
CVE-ID: CAN-2002-1347, CAN-2004-0884
Impact: Multiple vulnerabilities in Cyrus SASL, including remote denial of service and possible remote code execution in applications that use this library.
Description: Cyrus SASL is updated to address several security holes caused by improper data validation, memory allocation, and data handling.

Folder permissions
Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
CVE-ID: CAN-2005-0712
Impact: World-writable permissions on several directories, allowing potential file race conditions or local privilege escalation.
Description: Secure folder permissions are applied to protect the installer's receipt cache and system-level ColorSync profiles. Credit to Eric Hall of DarkArt Consulting Services, Michael Haller ([e-mail]), and (root at addcom.de) for reporting this issue.

Mailman
Available for: Mac OS X Server v10.3.8
CVE-ID: CAN-2005-0202
Impact: Directory traversal issue in Mailman that could allow access to arbitrary files.
Description: Mailman is a software package that provides mailing list management. This update addresses an exposure in Mailman's private archive handling that allowed remote access to arbitrary files on the system. Further information is available from http://www.gnu.org/software/mailman/security.html.

Safari
Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
CVE-ID: CAN-2005-0234
Impact: Maliciously registered International Domain Names (IDN) can make URLs visually appear as legitimate sites.
Description: Support for Unicode characters within domain names (International Domain Name support) can allow maliciously registered domain names to visually appear as legitimate sites. Safari has been modified so that it consults a user-customizable list of scripts that are allowed to be displayed natively. Characters based on scripts that are not in the allowed list are displayed in their Punycode equivalent. The default list of allowed scripts does not include Roman look-alike scripts. Credit to Eric Johanson ([e-mail]) for reporting this issue to us.

Re:Patch covers a bit more ...

[zonx lebaam]

Has Apple been giving this kind of credit to bugfinders for a long time, or is this new? I can't remember seeing them in their update blurbs in the past.

Re:Patch covers a bit more ...

[moof1138]

Yeah, they've been giving credit pretty much since the release of OS X. You can find the old blurbs here:

http://docs.info.apple.com/article.html?artnum=300 667 [apple.com]

Slashdot

[Anonymous Coward]

"you may recall that Internet Explorer did not suffer from this exploit because it sucks."

• News for nerds ... professionalism that ceased in '99.

Re:Slashdot

[Anonymous Coward]

This is a forum with community provided news. It is also pro-Linux.

Expect the odd joke or even rabid insult about Microsoft. Besides, IE really does suck compared to the other browsers in the market at the moment :)

As for professionalism - one glance at the effort of the editors to construct correct sentences, check for duplicates etc. would tell you that /. has never been professional. It is not that sort of site. It is a good place to get some info relatively quickly, without having to check a dozen dif

Right...

[cold wolf]

So if IE sucks because it doesn't support IDN, then Mozilla just started sucking since it dropped IDN.

I don't think I can take much more suckage. Hurry up, Archy [raskincenter.org]...

Re:Right...

[bad_fx]

Mmm, except Mozilla didn't "drop" IDN. The original /. article had that wrong, as did the submitter of this story who just regurgitated from that. In fact they set the default to disabled - but it's still there and you can turn it back on if needed (in about:config network.enableIDN I think). In addition their advisory on this had the following to say:

This is obviously an unsatisfactory solution in the long term and it is hoped that a better fix can be developed in time for Firefox 1.1.

Re:Right...

[molo]

actually, idn works in firefox 1.0.1, but the punycode URL is displayed instead of the unicode characters. This is still a temporary solution. It can be overridden by changing network.IDN_show_punycode to false.

-molo

Re:Right...

[bad_fx]

Ah, you're right - just tested this on http://www.shmoo.com/idn/ [shmoo.com]. Even better then! :)

Mozilla didn't drop it...

[Anonymous Coward]

At least Firefox already implements the same solution as Apple, to display the url in punycode form.

Re:Mozilla didn't drop it...

[ESqVIP]

Almost right. Mozilla did not drop IDN support, just shows every IDN in punycode form (meaning that it will not make punycode URLs look pretty, but if you give it a japanese domain it will convert it to punycode, so there is some support running in there).

Apple, on the other hand, only shows punycode if your URL contains characters from sets that look like latin. A much better approach IMO, since users will be able to see URLs in their language instead of some illegible "xn--pbt44a.jp" while being protect

Older version of Mac OS X need not apply...

[zx-6e]

...because they are not supported.

I'm done.

[Smilin]

I try to be an open minded person. I try and recognize both the strengths and weaknesses of Linux, Windows, Firefox, IE, you name it.

Being a Windows admin I have to put up with a lot of crap to participate at slashdot in a positive and open minded fashion. I'm done. I haven't read an article here in months that I didn't already come across on my own. I'm also fed up with the blatant bias and lack of professionalism on the part of slashdot employees and mods.

I'll go read my news elsewhere and spare myself the ration of shit that comes from you elitist snobs when reading it here.

Re:I'm done.

[mmkkbb]

Hey man, it's not just Windows admins that think this place is a ration of shit. :)

Why'd you come here anyway? Were you looking for abuse? I mean, you obviously ARE new here.