News for hackers. Stuff that matters.

A comment on Security Update 2014-002. Parent comment

Re:Security Update 2014-002 by osivertsson on Tuesday April 22, 2014 @03:42PM (#7629911)
More info from researchers at https://www.secure-resumption.com/

I feel like a lot of excellent applicable work is coming from the researchers at https://www.inria.fr/ Keep up the good work!

[ Parent | on HN ]
Re:Security Update 2014-002 by zokier on Tuesday April 22, 2014 @04:29PM (#7630217)
> SecureTransport (Safari, iOS): notified January 10, 2014. Security update issued for Safari 7.0.2.

Curious. Isn't this a different update?

[ Parent | on HN ]
Re:Security Update 2014-002 by 0x0 on Tuesday April 22, 2014 @06:47PM (#7630984)
The 7.0.2 update came at the same time as OSX 10.9.2 which had the fix for the "gotofail" bug (CVE-2014-1266). So that's a bit weird. Could it be a typo and they meant 7.0.3? But 7.0.3 was released on april 2nd, while today's update "Security Update 2014-002" claims to fix CVE-2014-1295 ("triple handshake attack"). So maybe nothing was fixed in safari until today?
[ Parent | on HN ]
Re:Security Update 2014-002 by innoying on Tuesday April 22, 2014 @05:01PM (#7630417)
Apple bundles updates to core applications all at once as a single install. So it's all within the security update. Of course the iOS update is separate.
[ Parent | on HN ]