41–50 of 155 posts
[deleted]
https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73 http://i.imgur.com/CoALymQ.png (i've not checked that on iOS or Apple TV just on OSX. Maybe it's another issue but the update description pretty much fits too well ;-)
It's not just cURL. It's much bigger, and much worse. http://pastebin.com/Yb6pUvr6
So, I'm not sure about that one. Apparently s_client ignores the error and completes the connection because it's intended to be used for debugging. > Currently the verify operation continues after errors so all the problems with a certificate chain can be seen. As a side effect the connection will never fail due to a server certificate verify failure. https://www.openssl.org/docs/apps/s_client.html https://www.mail-a…
Earlier quoted context omitted.
Mac os is not vulnerable
It appears to be, per https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73 (and my own testing on OS X 10.9.1).
[deleted]
https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73 http://i.imgur.com/CoALymQ.png (i've not checked that on iOS or Apple TV just on OSX. Maybe it's another issue but the update description pretty much fits too well ;-)
Earlier quoted context omitted.
https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73 http://i.imgur.com/CoALymQ.png (i've not checked that on iOS or Apple TV just on OSX. Maybe it's another issue but the update description pretty much fits too well ;-)
FYI: This curl bug is totally unrelated to the bug just patched.
http://daniel.haxx.se/blog/2012/06/28/darwin-native-ssl-for-...
Secure Transport by Apple is also known as Darwin/SSL.
Background on Secure Transport:
"At the bottom of the TLS stack on both iOS and Mac OS X is a component known as Secure Transport. Secure Transport maintains a per-process TLS session cache. When you connect via TLS, the cache stores information about the TLS negotiation so that subsequent connections can connect more quickly. The on-the-wire mechanism is described at the link below.
http://en.wikipedia.org/wiki/Transport_Layer_Security#Resume...
"This presents some interesting gotchas, especially while you're debugging." More at: https://developer.apple.com/library/ios/samplecode/AdvancedU...
Odd. Apple updated iOS 7 and iOS 6 but didn't update Secure Transport in iOS 5? I wonder if the bug was introduced between iOS 5 and 6. Background on Secure Transport: "At the bottom of the TLS stack on both iOS and Mac OS X is a component known as Secure Transport. Secure Transport maintains a per-process TLS session cache. When you connect via TLS, the cache stores information about the TLS negotiation so that subs…
You won't be able to get the new iOS 6.1.6 on your iPhone unless it supports iOS 6 but not iOS 7, it is basically only for iPod 4th gen.
So, was this plus automatic updates over SSL one of the ways the NSA could access "any iOS device"?
Earlier quoted context omitted.
Comedic derision appreciated :) However this is a pretty damn serious oversight. I've just shut down my MacBook and picked up my ThinkPad.
Mac os is not vulnerable