4 ms·

I'm sure everything that linked against it is vulnerable, and as soon as we have an update, they'll all be OK. I just wish the update were out now.

by RyJones 13y ago

yaeger 13y ago
Interestingly enough, I just checked a system with Snow Leopard using Safari and Firefox and it seems that both do not have this vulnerability. I can't say when this was introduced, but if it is in Mavericks, it must have gotten there sometime between Lion and Mountain Lion.
- brymaster 13y ago
  Not that interesting, as this was introduced in Mavericks. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1266 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-126...
Xylakant 13y ago
There's one major problem: software updater itself is vulnerable. So in theory the only way to get a clean system is to download a fresh, fixed installer via a channel that's not affected and reinstall. What a mess.
- rimantas 13y ago
  This is a problem only if updates are not signed.
  - Xylakant 13y ago
    No, it's not. The updater needs to know the correct signatures and it doesn't have a trusted way of retrieving them. Also, any previous update may have been malicious and replaced the updater. The updater may very well have embedded keys, but we don't know, so the secure option would be not to trust it.
    - QSIITurbo 13y ago
      That's not how signing works. Also, if the signing is indeed implemented correctly, then the updater cannot have been compromised earlier.
    - lucian1900 13y ago
      The updater verifies the signature using the public counterpart to Apple's current private key. It can only be changed by updating the updater (or a separate keys-only package), with the correct signature. Or at least that's how it's supposed to work.
chmars 13y ago
Most iOS users have not gotten the update notification yet. And many of those who have are waiting to apply the update since it requires a reboot. In addition, the update is only available for iOS 7.0.5 except for the 3GS and its iPod Touch equivalent. There is still a substantial number of iOS users on iOS 6 – usually not by incident …

I'm sure everything that linked against it is vulnerable, and as soon as we have an update, they'll all be OK. I just wish the update were out now.

by RyJones 13y ago

I'm sure everything that linked against it is vulnerable, and as soon as we have an update, they'll all be OK. I just wish the update were out now.

yaeger 13y ago

Interestingly enough, I just checked a system with Snow Leopard using Safari and Firefox and it seems that both do not have this vulnerability. I can't say when this was introduced, but if it is in Mavericks, it must have gotten there sometime between Lion and Mountain Lion.

brymaster 13y ago
Not that interesting, as this was introduced in Mavericks. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1266 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-126...

Xylakant 13y ago

There's one major problem: software updater itself is vulnerable. So in theory the only way to get a clean system is to download a fresh, fixed installer via a channel that's not affected and reinstall. What a mess.

rimantas 13y ago
This is a problem only if updates are not signed.
- Xylakant 13y ago
  No, it's not. The updater needs to know the correct signatures and it doesn't have a trusted way of retrieving them. Also, any previous update may have been malicious and replaced the updater. The updater may very well have embedded keys, but we don't know, so the secure option would be not to trust it.
  - QSIITurbo 13y ago
    That's not how signing works. Also, if the signing is indeed implemented correctly, then the updater cannot have been compromised earlier.
  - lucian1900 13y ago
    The updater verifies the signature using the public counterpart to Apple's current private key. It can only be changed by updating the updater (or a separate keys-only package), with the correct signature. Or at least that's how it's supposed to work.

chmars 13y ago

Most iOS users have not gotten the update notification yet. And many of those who have are waiting to apply the update since it requires a reboot. In addition, the update is only available for iOS 7.0.5 except for the 3GS and its iPod Touch equivalent. There is still a substantial number of iOS users on iOS 6 – usually not by incident …