Security Update 2014-002

Re:Security Update 2014-002 by dan1234 on Tuesday April 22, 2014 @03:35PM (#7629868)

FTA:

Security - Secure Transport

Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.2

Impact: An attacker with a privileged network position may capture

data or change the operations performed in sessions protected by SSL

Description: In a 'triple handshake' attack, it was possible for an attacker to establish two connections which had the same encryption keys and handshake, insert the attacker's data in one connection, and renegotiate so that the connections may be forwarded to each other.

To prevent attacks based on this scenario, Secure Transport was changed so that, by default, a renegotiation must present the same server certificate as was presented in the original connection. This issue does not affect Mac OS X 10.7 systems and earlier.

CVE-ID CVE-2014-1295 : Antoine Delignat-Lavaud, Karthikeyan Bhargavan and Alfredo Pironti of Prosecco at Inria Paris

That doesn't sound good…

[ Parent | on HN ]

Re:Security Update 2014-002 by osivertsson on Tuesday April 22, 2014 @03:42PM (#7629911)

More info from researchers at https://www.secure-resumption.com/

I feel like a lot of excellent applicable work is coming from the researchers at https://www.inria.fr/ Keep up the good work!

[ Parent | on HN ]

Re:Security Update 2014-002 by zokier on Tuesday April 22, 2014 @04:29PM (#7630217)

> SecureTransport (Safari, iOS): notified January 10, 2014. Security update issued for Safari 7.0.2.

Curious. Isn't this a different update?

[ Parent | on HN ]

Re:Security Update 2014-002 by 0x0 on Tuesday April 22, 2014 @06:47PM (#7630984)

The 7.0.2 update came at the same time as OSX 10.9.2 which had the fix for the "gotofail" bug (CVE-2014-1266). So that's a bit weird. Could it be a typo and they meant 7.0.3? But 7.0.3 was released on april 2nd, while today's update "Security Update 2014-002" claims to fix CVE-2014-1295 ("triple handshake attack"). So maybe nothing was fixed in safari until today?

[ Parent | on HN ]

Re:Security Update 2014-002 by innoying on Tuesday April 22, 2014 @05:01PM (#7630417)

Apple bundles updates to core applications all at once as a single install. So it's all within the security update. Of course the iOS update is separate.

[ Parent | on HN ]

Re:Security Update 2014-002 by swordswinger12 on Tuesday April 22, 2014 @06:12PM (#7630819)

Doesn't this attack only apply to client authentication with renegotiation?

[ Parent | on HN ]

Re:Security Update 2014-002 by marklubi on Tuesday April 22, 2014 @06:16PM (#7630847)

From the write up at https://www.secure-resumption.com/, that appears to be a major limiting factor:

> We have confirmed that our attacks can be mounted on popular web browsers and HTTPS libraries, when they are used to perform certificate-based authentication at servers that enable both resumption and renegotiation.

[ Parent | on HN ]

Re:Security Update 2014-002 by canistr on Tuesday April 22, 2014 @03:43PM (#7629917)

This also applies to iOS. So update to 7.1.1.

[ Parent | on HN ]