4 ms·
Were all of the other OS X versions affected, too? The CVE only lists 10.9.x (so, 10.9 and 10.9.1)
by reanimus 6y ago
Were all of the other OS X versions affected, too? The CVE only lists 10.9.x (so, 10.9 and 10.9.1)
- cookiengineer 6y agoYes, all previous OSX version up until 2014 were affected, too. The doubled `goto fail;` line was included since the first public revision of libsecurity_ssl, and the (c) of that file is 1999-2001,2005-2012 Apple Inc. [1] Nowadays, due to Apple never using any git or any other version control software for opensourced codes, I could trace it down to Mac OSX 10.4 which was released in 2005. [2] With 10.1, there's no libsecurity open sourced, I don't know why, but I'm pretty damn sure that at least 10.2 included the library back then. I don't have my old Powerbook G4 anymore, but I swear I could verify this bug on 10.2 (Jaguar) that was running on it at the time. Other versions of (maybe patched?) versions of libsecurity-ssl are located on the same server, with a global directory for everything so it's not actually versioned!? [3] At least the version of the file that has copyright 2000-2001 still has the same bug in it, so that is very likely the one that was used in the 10.1 public release [4] [1] https://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c.auto.html https://opensource.apple.com/source/Security/Security-55471/... [2] https://opensource.apple.com/release/mac-os-x-104.html https://opensource.apple.com/release/mac-os-x-104.html [3] https://opensource.apple.com/source/libsecurity_ssl/ https://opensource.apple.com/source/libsecurity_ssl/ [4] https://opensource.apple.com/source/libsecurity_ssl/libsecurity_ssl-6/lib/sslKeyExchange.cpp.auto.html https://opensource.apple.com/source/libsecurity_ssl/libsecur...