Apple releases OS X 10.9.2 update, patches severe SSL bug

[InfoSec News <alerts () infosecnews org>]

http://www.zdnet.com/apple-releases-os-x-10-9-2-update-patches-severe-ssl-bug-7000026765/

By Adrian Kingsley-Hughes
ZDNet News
Security
February 25, 2014

Apple has released OS X 10.9.2 update for all Maverick users, which, 
amongst other things patches the SSL bug in the operating system that 
could allow full transparent interception of HTTPS traffic.

This vulnerability not only affected Safari, but also other installed 
applications relying on an encrypted channel to the internet. However, 
third-party browsers such as Chrome and Firefox rely on different 
implementations of SSL/TLS, which means that they aren’t subject to the 
vulnerability.

The bug, which has apparently gone unpatched since iOS 6's release in 
2012, resides in a piece of open source code used by Apple.

Aldo Cortesi, CEO and founder of security consultancy firm Nullcube, 
claimed to have intercepted iCloud data, including KeyChain enrolment and 
updates, data from Calendar application, and traffic from apps that use 
certificate pining, such as Twitter.

[...]

--
Subscribe to InfoSec News
http://www.infosecnews.org/subscribe-to-infosec-news/