Slashdot Mirror

← Back to Stories (view on slashdot.org)

Apple Plugs IDN Spoof Bug

Posted by timothy on from the gosh! dept.

mmarlett writes "Security Update 2005-003 updates Safari's support for International Domain Names (IDN) to prevent lookalike characters from being used to spoof the URL displayed in the address field, SSL certificate, or status bar. Opera fixed this in Feburuary while Mozilla just dropped support for IDNs, and you may recall that Internet Explorer did not suffer from this exploit because it sucks."

6 of 26 comments (clear)

  1. Patch covers a bit more ... by Hungus · · Score: 5, Informative

    Security Update 2005-003

    AFP Server Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
    CVE-ID: CAN-2005-0340
    Impact: A specially crafted packet can cause a Denial of Service against the AFP Server.
    Description: A specially crafted packet will terminate the operation of the AFP Server due to an incorrect memory reference.

    AFP Server
    Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
    CVE-ID: CAN-2005-0715
    Impact: The contents of a Drop Box can be discovered.
    Description: Fixes the checking of file permissions for access to Drop Boxes. Credit to John M. Glenn of San Francisco for reporting this issue.

    Bluetooth Setup Assistant
    Available for: Mac OS X 10.3.8, Mac OS X Server 10.3.8
    CVE-ID: CAN-2005-0713
    Impact: Local security bypass when using a Bluetooth input device.
    Description: The Bluetooth Setup Assistant may be launched on systems without a keyboard or a preconfigured Bluetooth input device. In these cases, access to certain privileged functions has been disabled within the Bluetooth Setup Assistant.

    Core Foundation
    Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
    CVE-ID: CAN-2005-0716
    Impact: Buffer overflow via an environment variable.
    Description: The incorrect handling of an environment variable within Core Foundation can result in a buffer overflow that may be used to execute arbitrary code. This issue has been addressed by correctly handling the environment variable. Credit to iDEFENSE and Adriano Lima of SeedSecurity.com for reporting this issue.

    Cyrus IMAP
    Available for: Mac OS X Server v10.3.8
    CVE-ID: CAN-2004-1011, CAN-2004-1012, CAN-2004-1013, CAN-2004-1015, CAN-2004-1067
    Impact: Multiple vulnerabilities in Cyrus IMAP, including remotely exploitable denial of service and buffer overflows.
    Description: Cyrus IMAP is updated to version 2.2.12, which includes fixes for buffer overflows in fetchnews, backend, proxyd, and imapd. Further information is available from http://asg.web.cmu.edu/cyrus/download/imapd/change s.html.

    Cyrus SASL
    Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
    CVE-ID: CAN-2002-1347, CAN-2004-0884
    Impact: Multiple vulnerabilities in Cyrus SASL, including remote denial of service and possible remote code execution in applications that use this library.
    Description: Cyrus SASL is updated to address several security holes caused by improper data validation, memory allocation, and data handling.

    Folder permissions
    Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
    CVE-ID: CAN-2005-0712
    Impact: World-writable permissions on several directories, allowing potential file race conditions or local privilege escalation.
    Description: Secure folder permissions are applied to protect the installer's receipt cache and system-level ColorSync profiles. Credit to Eric Hall of DarkArt Consulting Services, Michael Haller (info@cilly.com), and (root at addcom.de) for reporting this issue.

    Mailman
    Available for: Mac OS X Server v10.3.8
    CVE-ID: CAN-2005-0202
    Impact: Directory traversal issue in Mailman that could allow access to arbitrary files.
    Description: Mailman is a software package that provides mailing list management. This update addresses an exposure in Mailman's private archive handling that allowed remote access to arbitrary files on the system. Further information is available from http://www.gnu.org/software/mailman/security.html.

    Safari
    Available for: Mac OS X v10.3.8, Mac OS X Server v10.3.8
    CVE-ID: CAN-2005-0234
    Impact: Maliciously registered International Domain Names (IDN) can make URLs visually appear as legitimate sites.
    Description: Support for Unicode characters within domain names (International Domain Name support) can allow maliciously registered domain names to visually appear as legitimate sites. Safari has been modified so that it consults a user-customizable list of scripts that are allowed to be displayed natively. Characters based on scripts that are not in the allowed list are displayed in their Punycode equivalent. The default list of allowed scripts does not include Roman look-alike scripts. Credit to Eric Johanson (ericj@shmoo.com) for reporting this issue to us.

    --
    Bad Panda! No Bamboo for you! In matters of importance ACs will not be responded to. Want to say something critical,OK
    1. Re:Patch covers a bit more ... by moof1138 · · Score: 2, Informative

      Yeah, they've been giving credit pretty much since the release of OS X. You can find the old blurbs here:

      http://docs.info.apple.com/article.html?artnum=300 667

      --

      Hyperbole is the worst thing ever.
  2. Re:Right... by bad_fx · · Score: 5, Informative

    Mmm, except Mozilla didn't "drop" IDN. The original /. article had that wrong, as did the submitter of this story who just regurgitated from that. In fact they set the default to disabled - but it's still there and you can turn it back on if needed (in about:config network.enableIDN I think). In addition their advisory on this had the following to say:

    This is obviously an unsatisfactory solution in the long term and it is hoped that a better fix can be developed in time for Firefox 1.1.

  3. Re:A good solution by cuijian · · Score: 5, Informative

    Apple's solution is based on a user editable white list of allowed scripts so that's already there for you.

    You can choose *a single* primary script (or two, or...), whatever you want. You can even turn off all IDN support.

  4. Re:Right... by molo · · Score: 4, Informative

    actually, idn works in firefox 1.0.1, but the punycode URL is displayed instead of the unicode characters. This is still a temporary solution. It can be overridden by changing network.IDN_show_punycode to false.

    -molo

    --
    Using your sig line to advertise for friends is lame.
  5. Re:Mozilla didn't drop it... by ESqVIP · · Score: 2, Informative

    Almost right. Mozilla did not drop IDN support, just shows every IDN in punycode form (meaning that it will not make punycode URLs look pretty, but if you give it a japanese domain it will convert it to punycode, so there is some support running in there).

    Apple, on the other hand, only shows punycode if your URL contains characters from sets that look like latin. A much better approach IMO, since users will be able to see URLs in their language instead of some illegible "xn--pbt44a.jp" while being protected from clones of non-IDN websites.

    My other concern: aren't there kanjis that look exactly the same? Do they have different codes (very likely)? This could lead to CJK-oriented phishing schemes. Fortunately I believe they are quite rare.

    Or maybe we should have a new term, like sushi, for oriental phishing :-)