4 ms·

https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73 https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73 http://i.imgur.com/CoALymQ.png http://i.imgur.com/CoALy

by rmoriz 13y ago

https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73 https://gist.github.com/rmoriz/fb2b0a6a0ce10550ab73 http://i.imgur.com/CoALymQ.png http://i.imgur.com/CoALymQ.png (i've not checked that on iOS or Apple TV just on OSX. Maybe it's another issue but the update description pretty much fits too well ;-)

lawl 13y ago
Holy shit! So they are really not checking the CN and knew it since 2013-11-28. I've lost the last bit of respect I had for apple (that was mostly building webkit) now. (I deleted my gp, because it's pretty much obsolete now with your full disclousure. Thanks!)
tlrobinson 13y ago
So OS X as well as iOS?
- rmoriz 13y ago
  I think so but I only discovered the OSX issue.
  - mzs 13y ago
    Good find. What about 10.8 and earlier? Have you heard anything about iOS6?
    - rmoriz 13y ago
      Nope. I'm just a Ruby developer, not a security researcher :)
acdha 13y ago
Interesting: bare IP addresses as you demonstrated but they do still appear to catch mismatched hostnames: https://213.133.107.227.xip.io/ https://213.133.107.227.xip.io/ Still an epic QA failure but much less of a threat if it doesn't allow arbitrary MITM attacks.
billjohn23 13y ago
FYI: This curl bug is totally unrelated to the bug just patched.
- lstamour 13y ago
  If they aren't, it's quite a coincidence ;-) Curl relies on third-party libraries for SSL. http://daniel.haxx.se/blog/2012/06/28/darwin-native-ssl-for-curl/ http://daniel.haxx.se/blog/2012/06/28/darwin-native-ssl-for-... Secure Transport by Apple is also known as Darwin/SSL.
aroch 13y ago
Doesn't seem to do it in 10.9.2 which is using the same curl version: http://pastebin.com/AZ38WYaB http://pastebin.com/AZ38WYaB