4 ms·
FTA: Security - Secure Transport Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.2 Impact: An attacker with a privileged network position m
by dan1234 13y ago
FTA:
Security - Secure Transport
Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.2
Impact: An attacker with a privileged network position may capture
data or change the operations performed in sessions protected by SSL
Description: In a 'triple handshake' attack, it was possible for an
attacker to establish two connections which had the same encryption
keys and handshake, insert the attacker's data in one connection, and
renegotiate so that the connections may be forwarded to each other.
To prevent attacks based on this scenario, Secure Transport was
changed so that, by default, a renegotiation must present the same
server certificate as was presented in the original connection. This
issue does not affect Mac OS X 10.7 systems and earlier.
CVE-ID
CVE-2014-1295 : Antoine Delignat-Lavaud, Karthikeyan Bhargavan and
Alfredo Pironti of Prosecco at Inria Paris
That doesn't sound good…
- osivertsson 13y agoMore info from researchers at https://www.secure-resumption.com/ https://www.secure-resumption.com/ I feel like a lot of excellent applicable work is coming from the researchers at https://www.inria.fr/ https://www.inria.fr/ Keep up the good work!
- zokier 13y ago> SecureTransport (Safari, iOS): notified January 10, 2014. Security update issued for Safari 7.0.2. Curious. Isn't this a different update?
- innoying 13y agoApple bundles updates to core applications all at once as a single install. So it's all within the security update. Of course the iOS update is separate.
- 0x0 13y agoThe 7.0.2 update came at the same time as OSX 10.9.2 which had the fix for the "gotofail" bug (CVE-2014-1266). So that's a bit weird. Could it be a typo and they meant 7.0.3? But 7.0.3 was released on april 2nd, while today's update "Security Update 2014-002" claims to fix CVE-2014-1295 ("triple handshake attack"). So maybe nothing was fixed in safari until today?
- canistr 13y agoThis also applies to iOS. So update to 7.1.1.
- swordswinger12 13y agoDoesn't this attack only apply to client authentication with renegotiation?
- marklubi 13y agoFrom the write up at https://www.secure-resumption.com/ https://www.secure-resumption.com/, that appears to be a major limiting factor: > We have confirmed that our attacks can be mounted on popular web browsers and HTTPS libraries, when they are used to perform certificate-based authentication at servers that enable both resumption and renegotiation.