Studio Press

Apple has released six patches for Mac OS X and Mac OS X Server, including one for a zero-day flaw that could allow a hacker to hijack a web-browsing session.

The zero-day vulnerability, which was made public in November 2009, lies in an authentication gap in TLS (Transport Layer Security) and SSL (Secure Sockets Layer) encryption protocols, Apple said in an advisory on Tuesday.

TLS and SSL protocols, commonly used by banks and online retailers to protect transactions, use a series of 'handshakes' to negotiate the session between the server and the client. As the protocols allow renegotiation of the session, an intruder can insert code undetected. The protocol-level breach could allow the attacker to take over a browser session and successfully impersonate the user, in what is known as a man-in-the-middle, or MITM, attack.

Another fix addresses an buffer-overflow issue in CoreAudio. If a user plays a malicious MP4 audio file, it could crash the application or allow an outsider to run code on the affected machine, according to the advisory.

The patch bundle, which is available via Apple's software updates or its download site, also includes a fix for an issue in component-level Cupsd that could be used to create a denial-of-service attack.