9 ms·
Security Update 2014-002
- SeanLuke 12y agoNot available for 10.5.x it would appear.
- mhurron 12y ago10.6 and previous are out of support. Apple seems to support n and n-1 only by and large with n-2 updates if it's bad enough.
- coherentpony 12y agoIf you're still using 10.5.x, this security update is actually not your biggest problem.
- ProAm 12y agoWhat is their biggest problem?
- bananas 12y agoThat your computer is so old that you no longer look hip in Starbucks. Plastic MacBooks are so noughties!
- deleted 12y ago[deleted]
- coherentpony 12y ago>That your computer is so old that you no longer look hip in Starbucks. Plastic MacBooks are so noughties! I was actually thinking more in terms of security and support. PPC architectures are not very well supported nowadays, and haven't been for over 5 years. Perhaps longer. Sure, you can still run your machine on 10.5 and it might run really well still. That's no reason to trust it for mission critical tasks. God forbid if someone was using a OS X Server 10.5 and users trusted it with their credentials. Vanity was pretty low on my list, but I understand everyone's priorities are different.
- bananas 12y agoI was mocking the consumer perspective but obviously HN is too sensitive... Not sure I trust Apple with longevity. Windows XP from 2002 just hit the dust and I've got a decade out of RHEL. For something from 2007 to be a write off is not good IMHO. I thoroughly regret my MBP purchase for theae reasons.
- pja 12y agoBy the time Apple drops support for your hardware you have a decent chance of being able to install a current Linux distribution with no hiccups and full hardware support, so all is not completely lost.
- bananas 12y agoPossibly right but I don't see how a piece of hardware that is pretty much glued together (as of recent MBA and MBPs) is going to survive that long to be honest.
- mzr 12y agoConveniently enough, so is this Slashdot post.
- windsurfer 12y agoSupport has stopped. The latest update was 5 years ago. Most software doesn't support it anymore, including Chrome and Firefox.
- akjj 12y agoThere's a fork of Firefox ESR that supports OS X versions 10.4 and up: http://www.floodgap.com/software/tenfourfox/ http://www.floodgap.com/software/tenfourfox/
- GFK_of_xmaspast 12y agoTurns out if you missed the 10.5 -> 10.6 or 10.7 upgrades, you appear to be hosed unless you can find some physical media for those releases, you can't go 10.5 -> 10.8 (never tried ->10.9, would not expect it to work).
- pja 12y agoGet hold of a 10.9 installer on a USB stick from a friend with a 10.9 Mac & restore /Users from backup after a wipe & fresh install of 10.9?
- coherentpony 12y agoI think this issue is that it might be the case the hardware isn't even supported on newer OS X releases.
- ams6110 12y agoYes they stopped building PPC support after 10.5
- coherentpony 12y agoNot just PPC. They also stopped support certain intel hardware too.
- ams6110 12y agoThat's true. The latest OSX releases won't install on some of the early Intel Macs. I've heard it's possible, with a certain amount of hacking, to get an early Intel MacPro for example to run 10.8 or maybe even 10.9 but it's unsupported.
- GFK_of_xmaspast 12y agoThat works but it's not exactly an easy upgrade path.
- 12y ago
- SeanLuke 12y agoYou do what you gotta do. 10.5.8 is the last OS X version which supported PPC.
- stock_toaster 12y agoRun Linux or one of the *BSD's on it?
- SeanLuke 12y agoWould that I could.
- coherentpony 12y agoAnd any Mac software you buy that still supports PPC is almost certainly not vendor-supported with security updates.
- yuhong 12y agoLuckily PowerPC exploits were pretty uncommon even back when it was current, partly because it was more difficult to create than x86 exploits.
- r00fus 12y agoApparently not affecting 10.7 and earlier either.
- dan1234 12y agoAre you sure? The change log mentions 10.7.x for a couple of the items.
- dan1234 12y agoFTA: Security - Secure Transport Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.2 Impact: An attacker with a privileged network position may capture data or change the operations performed in sessions protected by SSL Description: In a 'triple handshake' attack, it was possible for an attacker to establish two connections which had the same encryption keys and handshake, insert the attacker's data in one connection, and renegotiate so that the connections may be forwarded to each other. To prevent attacks based on this scenario, Secure Transport was changed so that, by default, a renegotiation must present the same server certificate as was presented in the original connection. This issue does not affect Mac OS X 10.7 systems and earlier. CVE-ID CVE-2014-1295 : Antoine Delignat-Lavaud, Karthikeyan Bhargavan and Alfredo Pironti of Prosecco at Inria Paris That doesn't sound good…
- osivertsson 12y agoMore info from researchers at https://www.secure-resumption.com/ https://www.secure-resumption.com/ I feel like a lot of excellent applicable work is coming from the researchers at https://www.inria.fr/ https://www.inria.fr/ Keep up the good work!
- zokier 12y ago> SecureTransport (Safari, iOS): notified January 10, 2014. Security update issued for Safari 7.0.2. Curious. Isn't this a different update?
- innoying 12y agoApple bundles updates to core applications all at once as a single install. So it's all within the security update. Of course the iOS update is separate.
- 0x0 12y agoThe 7.0.2 update came at the same time as OSX 10.9.2 which had the fix for the "gotofail" bug (CVE-2014-1266). So that's a bit weird. Could it be a typo and they meant 7.0.3? But 7.0.3 was released on april 2nd, while today's update "Security Update 2014-002" claims to fix CVE-2014-1295 ("triple handshake attack"). So maybe nothing was fixed in safari until today?
- rdl 12y agoReally glad they released OSX and iOS on the same day this time.
- RyJones 12y agoAs well as for the Airport (all of mine required updating when I got home)
- deleted 12y ago[deleted]
- chmars 12y agoAirPort base stations seems to be affected too, I got at least an update for a relatively new AirPort Extreme (running now 7.7.3), however, not for older base stations (running 7.6.4).
- chmars 12y agoAccording to http://www.imore.com/apple-updates-airport http://www.imore.com/apple-updates-airport, 'only' base stations with ac-support are affected.
- 0x0 12y agoThe AirPort 7.7.3 update is actually the OpenSSL Heartbleed bug, CVE-2014-0160: http://osdir.com/ml/general/2014-04/msg39413.html http://osdir.com/ml/general/2014-04/msg39413.html The OP is about a Secure Transport bug, CVE-2014-1295. So I guess Apple must have been using the OpenSSL library instead of their in-house Secure Transport library on the Airports!
- nwh 12y agoMakes sense. I doubt their AirPort devices run anything like OSX internally.
- 0x0 12y agoWell, it was recently revealed that even the actual lightning-to-hdmi adapter dongle is running a cut-down Darwin/xnu: https://www.panic.com/blog/the-lightning-digital-av-adapter-surprise/ https://www.panic.com/blog/the-lightning-digital-av-adapter-...
- nwh 12y agoThat's incredibly complicated. Amazing.
- peterkelly 12y ago"This issue was addressed by ignoring incomplete HTTP header lines." I hope they've taken into account the fact that the value of a HTTP header can span multiple lines (RFC2616 section 4.2)
- MichaelGG 12y agoWhat is support like for the terrible line-folding (and comments) part of the specification? In SIP land, which copied HTTP then messed it up even further, there is no correct handling of such messages. Some SIP stacks will error, some will ignore, some will do it correctly. Thus you can't trust your proxy and server to come to the same conclusions and perform the same operations or apply the same security policy. There's no good reason for line folding or comments. Protocols need only be human readable not human easily-composed-for-formatting. This isn't the 60s or early 70s where you're writing all emails and headers by hand.
- rbanffy 12y ago> Protocols need only be human readable not human easily-composed-for-formatting. No, but being so is incredibly convenient. > This isn't the 60s or early 70s where you're writing all emails and headers by hand. Again, no, but, again, it'd be very convenient to be able to do it.
- jimktrains2 12y agoTell that all to the HTTP2 people:(
- rbanffy 12y agoWill they listen?
- MichaelGG 12y agoThis "convenience" (of which I highly doubt, having crafted plenty of messages by hand) comes at a major cost to implementors, both in performance and complexity and hence security. HTTP isn't a programming language. It does not benefit from crazy syntax.
- p4lindromica 12y agoThose ruby vulnerabilities are old news ... https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-in-floating-point-parsing-cve-2013-4164/ https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-i...
- gpvos 12y agoThis seems to be the <s>first</s>second security update that is not available for 10.6. Is there anywhere where Apple officially announces when they stop supporting an OS X version?
- pja 12y agoI don't think Apple ever officially announces when they drop support for an OSX version. I suspect it's part of the Apple approach to marketing to never say anything negative about the brand in any way & that that includes not announcing EOL on old OSX versions.
- gpvos 12y agoI actually got a popup on my MBP a week or two ago adhorting me to upgrade to 10.9.x. I guess that was the announcement.
- grapeshot 12y agoIt's time I made sure my family's 2007 iMacs are up to date, I guess. At least one of them is probably still on 10.6 because they send me things in Word for Mac 2004 format and that definitely won't run on anything newer because it's PPC-only code.
- beejiu 12y agoOn a practical note, has anybody's Adobe Flash stopped working after this update? Any ideas on why it could be affected?