=====================================================================
                                    CERT-Renater

                         Note d'Information No. 2008/VULN092
_____________________________________________________________________

DATE                      : 21/03/2008

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running AirPort Extreme Base
                              Station, Digital Camera RAW Compatibility.

======================================================================
Message: 1

APPLE-SA-2008-03-19 AirPort Extreme Base Station Firmware 7.3.1

Firmware version 7.3.1 is now available for AirPort Extreme 802.11n*
base stations. (* Based on an IEEE 802.11n draft specification)
Further information on the base station is available via:
http://www.apple.com/airportextreme/

Firmware version 7.3.1 fixes the following security issue:

AirPort Extreme Base Station with 802.11n*
CVE-ID:  CVE-2008-1012
Available for:  AirPort Extreme Base Station with 802.11n*
Impact:  A maliciously crafted AFP request may lead to a denial of
service
Description:  An input validation issue exists in the AirPort Extreme
Base Station's handling of AFP requests, which may cause file sharing
to become unresponsive. This update addresses the issue by performing
additional validation of AFP requests. This issue does not affect
Time Capsule or AirPort Express. The fix for this issue is available
in the following separate updates:
- - AirPort Extreme with 802.11n (Fast Ethernet) 7.3.1
- - AirPort Extreme with 802.11n (Gigabit Ethernet) 7.3.1
Credit to Alex deVries for reporting this issue.

Installation note for Firmware version 7.3.1

Firmware version 7.3.1 is installed into an AirPort Extreme Base
Station with 802.11n* by running the AirPort Utility which is
provided with the Base Station.

Information will also be posted to the Apple Security Updates
web site:  http://support.apple.com/kb/HT1222

This message is signed with Apple's Product Security PGP key,
and details are available at:
http://www.apple.com/support/security/pgp/


------------------------------

Message: 2


APPLE-SA-2008-03-20 Digital Camera RAW Compatibility Update 2.0

Digital Camera RAW Compatibility Update 2.0 is now available and
addresses the following issue:

Camera Support
CVE-ID:  CVE-2008-0987
Available for:  Aperture 2 or iPhoto 7.1.2 with iLife Support 8.2
Impact:  Viewing a maliciously crafted image may lead to an
unexpected application termination or arbitrary code execution
Description:  A stack based buffer overflow exists in the handling of
Adobe Digital Negative (DNG) image files. By enticing a user to open
a maliciously crafted image file, an attacker may cause an unexpected
application termination or arbitrary code execution. This update
addresses the issue through improved validation of DNG image files.
Credit to Clint Ruoho of Laconic Security for reporting this issue.

Digital Camera RAW Compatibility Update 2.0 may be obtained from the
Software Update pane in System Preferences, or Apple's Software
Downloads web site:
http://www.apple.com/support/downloads/

The download file is named:  "RAWCamera.dmg"
Its SHA-1 digest is:  9a09365a32ab0387cd82362e8a2c42024d4cb1ea

This message is signed with Apple's Product Security PGP key,
and details are available at:
http://www.apple.com/support/security/pgp/

======================================================================

           =========================================================
           Les serveurs de référence du CERT-Renater
           http://www.urec.fr/securite
           http://www.cru.fr/securite
           http://www.renater.fr
           =========================================================
           + CERT-RENATER          | tel : 01-53-94-20-44          +
           + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
           + 75013 Paris           | email: certsvp@renater.fr     +
           =========================================================