Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!news.glorb.com!news.linkpendium.com!news.linkpendium.com!panix!MIX!Blackbird From: billy@MIX.COM Newsgroups: comp.sys.mac.system Subject: Re: Latest IOS/OS X SSL security flaw Date: Wed, 26 Feb 2014 01:44:56 +0000 (UTC) Organization: PANIX Public Access Internet and UNIX, NYC Lines: 33 Message-ID: References: <_dadnQGhF7aH45bOnZ2dnUVZ_t2dnZ2d@earthlink.com> NNTP-Posting-Host: panix5.panix.com X-Trace: reader2.panix.com 1393379096 5542 166.84.1.5 (26 Feb 2014 01:44:56 GMT) X-Complaints-To: abuse@panix.com NNTP-Posting-Date: Wed, 26 Feb 2014 01:44:56 +0000 (UTC) Xref: csiph.com comp.sys.mac.system:57312 Ted Lee writes: > Nor does either the update info or the link to security update info say > anything that implies the SSL flaw has been fixed! At least I couldn't > find it. It's not on the web site yet, but - | APPLE-SA-2014-02-25-1 OS X Mavericks 10.9.2 and Security Update | 2014-001 | | OS X Mavericks 10.9.2 and Security Update 2014-001 is now available | and addresses the following: | Data Security | | Available for: OS X Mavericks 10.9 and 10.9.1 | | Impact: An attacker with a privileged network position may capture | or modify data in sessions protected by SSL/TLS | | Description: Secure Transport failed to validate the authenticity of | the connection. This issue was addressed by restoring missing | validation steps. | | CVE-ID | CVE-2014-1266 Billy Y.. -- sub #'9+1 ,r0 ; convert ascii byte add #9.+1 ,r0 ; to an integer bcc 20$ ; not a number