Apple releases OS X Mavericks 10.9.2 with SSL fix

http://9to5mac.com/2014/02/25/apple-releases-os-x-mavericks-10-9-2-with-facetime-audio-contact-blocking-mail-fixes/

by davidbarker • 12 years ago

315 237 12 years ago

9to5mac.com

pje• 12 years ago

The release notes, however, do not make mention of the SSL security bug that was squashed on iOS late last week.

praseodym3• 12 years ago

Maybe someone who has already installed this could check if the SSL bug is fixed? https://www.imperialviolet.org:1266

ngoldbaum• 12 years ago

It's fixed.

itg• 12 years ago

Just tried it with Safari on 10.9.2

Safari can't open the page "https://www.imperialviolet.org:1266" because Safari can't establish a secure connection to the server "www.imperialviolet.org".

msbarnett4• 12 years ago

Tested with this and gotofail.com on 10.9.2. It's fixed.

sync• 12 years ago

http://support.apple.com/kb/HT6114

says at the bottom "For detailed information about the security content of this update, see Apple security updates.[1]"

[1] http://support.apple.com/kb/HT1222

praseodym3• 12 years ago

It's not there yet: Apple usually posts that information a few hours _after_ the update has been released.

meepmorp• 12 years ago

If anyone from Apple is reading and can influence this - could you convince whomever needs to be convinced that you ought to have less vague/shitty release notes, particularly wrt issues like this?

praseodym3• 12 years ago

They cover security issues in a separate announcement (listed on http://support.apple.com/kb/HT1222), but only a few hours after the update has been released. I do think high-impact security issues like this SSL bug deserve a mention in the release notes as well.

councilscheme• 12 years ago

most definitely the right person is reading this, Apple is a bottom-up corporation and someone reading HN could just talk to their manager and have the complaint heard by the right person.

johndoze• 12 years ago

It's definitely included in that update. Just tested Safari post-update.

http://imgur.com/qXLQUSh

gress2• 12 years ago

Who would benefit from that?

rdl4• 12 years ago

I'm confused -- the osx dev center doesn't have 10.9.2 at all (any build), only the original October 10.9 release. I guess that happens whenever they push a new release?

nicky0• 12 years ago

Developer preview builds are now pushed out the Mac App Store.

See the Dev center for the instructions to set it up.

joelmbell• 12 years ago

Its fixed

plg• 12 years ago

confirmed here as well, it's fixed

https://gotofail.com

pivo• 12 years ago

Hope it also fixes the "issue" where my 2013 Macbook Pro reboots when it wakes up from sleep if there's a USB drive attached.

serge2k• 12 years ago

Mine grey screens when I have my usb hub plugged in at startup (doesn't get to partition selection).

Android file transfer utility stops the keyboard and touchpad from working.

lucasisola• 12 years ago

I've got a similar USB issue. I have a SATA HDD in an External USB 3.0 enclosure. When my 2011 iMac wakes from sleep, it needs to wait for the external drive to spin up. Major PITA.

beedogs• 12 years ago

Having similar weird USB issues on my 13" late 2013 MBP. It's been really, really crappy since I bought it. Same issues with keyboard and touchpad breaking under random applications. Apple seems to be completely ignoring the issue aside from a botched "fix" in November.

eik3_de• 12 years ago

Is it possible to manually verify the code signature with Apple's built-in public key before installing?

lotharrr• 12 years ago

I would hope the built-in software-upgrade process does exactly that (independent of transport-layer SSL), but I have no evidence either way.

The manual-download pages on http://support.apple.com/downloads/ publish SHA1 sums. Unfortunately those pages aren't served over SSL. You could download the update and compare its hash against those of your friends: at least then you'd all be installing the same thing (preventing narrowly-targetted attacks).

sitkack• 12 years ago

The Apple site http://support.apple.com/kb/DL1726 reports

  c06a63982b522e43997a05cedc04b0bdb1a10207

which matches my download using `shasum -a OSXUpdCombo10.9.2.dmg`

IPGlider• 12 years ago

  pkgutil --check-signature OSXUpd10.9.2.dmg

0x04• 12 years ago

Finally.

Unfortunately we'll probably always be in the dark about the HOW, WHO and WHY. :(

scott_karana• 12 years ago

Of course.

If it was an honest mistake, they're not going to publically throw an employee under the bus.

If it was a malicious action from the NSA, they're not allowed to make it public.

I suspect the only hypothetical way we'd hear about the "who" is if an employee weakened it for his own personal gain, and criminal charges were raised.

sneak7• 12 years ago

Ahh, so they probably had to restart the QA on the whole release a few days ago (including FaceTime Audio and associated features) after adding the TLS fix at the last minute.

It makes a bit more sense why they'd make us wait a few days, now.

lucian1900• 12 years ago

It's still inexcusable. The security update should have been immediate and separate.

Jare2• 12 years ago

You still need a minimal amount of testing and release packing. 4 days for an OS update is pretty good response time IMHO, and I thank the Apple engineers that probably worked their asses off to get this mess sorted out.

What this doesn't excuse is disclosing the iOS bug before all fixes are ready. THAT was the major scrweup.

microtonal2• 12 years ago

It makes a bit more sense why they'd make us wait a few days, now.

It's still terrible. They should have pushed out a fix for this vulnerability first and push back 10.9.2 if necessary. Or perhaps introduce a modern package system for the base system.

outside1234• 12 years ago

Its totally unacceptable. Even Microsoft does patches of this severity in less than 24 hours.

I suspect what this points to is that Apple doesn't have automated testing and they need a bunch of old school "hands on keyboards testers" to run a test case list that takes 4 days.

georgebarnett• 12 years ago

The parent 'suspects' and doesn't actually know. It's not 'totally unacceptable' either. It's over a weekend and it's a set of trade offs about cutting a release made by a bunch of smart engineers who were probably very tired (last week for them has probably sucked) and they've just pulled a long weekend to get this out the door.

If you find this 'totally unacceptable', my suggestion would be to either go join them and help them improve the situation or to move to another OS. Bitching on the internet merely indicates how little experience you have with the trade offs that need to be made when pushing latge volumes of software.

gress2• 12 years ago

How is that 'totally unacceptable' when this is not? http://m.slashdot.org/story/198449

djulius• 12 years ago

"Even Microsoft" is terribly wrong. In fact Microsoft is several years in advance to other software companies regarding security lifecycle of its products.

The early days fiasco are long gone and the SDL (http://www.microsoft.com/security/sdl/default.aspx) has performed really well.

eddieroger• 12 years ago

Microsoft also has a history of not disclosing it until there's a fix.

lawnchair_larry4• 12 years ago

They already knew about the TLS issue. Remember, they found and fixed it themselves. It is not like Apple's release of iOS 7.0.6 was what alerted Apple to the vulnerability in OS X.

The problem was not coordinating the release of 10.9.2 and iOS 7.0.6. The other problem is their patching cycle in general.

This update includes many high severity fixes from mid 2013 and one issue as far back as 2011. That tells you all you need to know about Apple's security program management. They release uncoordinated and when they feel like it, with no sense of urgency. It's convenient for them to just toss critical security fixes in to their 6 month OS updates, so they do.

Some criticize Microsoft for their "slow" patching, but they at least have a dedicated monthly cycle just for security updates, and they will send them out of band if a 0day gets exposed. And rarely will you see them drop 0day on themselves (though this wasn't always the case).

jmelloy• 12 years ago

I think it's more likely that both were in the pipeline, and QA finished iOS 7.0.6 first - last week, and QA for 10.9.2 was slated to finish this week. So do you hold it or not?

Is it more critical to have 4 days of protection, or 4 days of "WTF is Apple incompetent" press?

0x04• 12 years ago

I know I'd choose 4 days of protection instead of 4 days of bad press :)

nextstep• 12 years ago

> • Adds call waiting support for FaceTime audio and video calls

Cool. Someday I'd like to be able to leave a FaceTime voicemail message if the receiver declines the FaceTime call.

gburt• 12 years ago

Surely this would be facemail, not voicemail. :)

anologwintermut• 12 years ago

That day was the last 4 days , between when Apple disclosed the SSL bug by patching it in iOS(effectively zero daying themselves) and when they bothered to fix it in OSX. If you are in North America, please contact the National Security Agency to retrieve your messages. For Asia, please contact the Chinese Ministry of State Security.

bluthru2• 12 years ago

I wonder if Apple is taking a stance against voicemail since many people find it to be a nuisance.

lelf• 12 years ago

  PHP
  Available for:  OS X Lion v10.7.5, OS X Lion Server v10.7.5,
  OS X Mountain Lion v10.8.5, OS X Mavericks 10.9 and 10.9.1
  Impact:  Multiple vulnerabilities in PHP
  Description:  Multiple vulnerabilities existed in PHP, the most
  serious of which may have led to arbitrary code execution <…>

Didn't know it's in Mac OS X… But yeah, it is… /usr/bin/php

0x04• 12 years ago

Oddly enough, the release notes states they upgraded to "5.4.22"... but "/usr/bin/php -v" gives "5.4.24" here.

pak• 12 years ago

Both the webserver (Apache) and PHP are off by default and have to be enabled separately, the latter by editing a config file.

Essentially, only Mac-owning web developers who enable these things (and serve PHP from their box to the world) are affected by any security problems in PHP. I imagine that most such web developers actually only dev locally and push the code to another server. It's nice that they updated them anyway.

calinet62• 12 years ago

Does it fix the networking stack also? Please dear god let it fix the networking stack. (https://discussions.apple.com/thread/5551686?start=0&tstart=...)

virtuallynathan• 12 years ago

I had this issue the other day, and yep - I hope its fixed.

X-Istence• 12 years ago

I sure as hell hope it fixes this issue... I am X-Istence on that thread, and I get almost daily emails with other people with the same issues.

bdash2• 12 years ago

Yes, this should be fixed in 10.9.2.

calinet62• 12 years ago

Any proof or reference? I'd prefer not to wait about 23 days for my server to explode.

brown9-2• 12 years ago

What about non-Mavericks versions of OS X?

Jare2• 12 years ago

10.8 and earlier are not vulnerable.

pronoiac• 12 years ago

An update's available for 10.8. I didn't verify the issue before upgrading.

Edit: I did check with Imperial Violet and gotofail.com, and the issue is not there after the update.

porsupah• 12 years ago

Tested with OS X 10.8.5 and Safari 6.0.5, gotofail.com declared the bug wasn't present. (At first, it declined to run the test, having concluded it didn't need to; following the link to explicitly run the test gave the "safe" result)

FWIW, applying the security update also installs iTunes 11, which users of Requiem may want to take note of.

cs02rm0• 12 years ago

No sign of 4k@60Hz on the rMBP for the 32" Dell then?

dmboyd• 12 years ago

This should really have been a separate fix & installed without user interaction. Instead this is 450 Megs & requires a restart. It'll take days for it to get out to those at risk.

pavel_lishin• 12 years ago

769 meg for me.

prawn• 12 years ago

900+ for me.

sneak7• 12 years ago

This should really have been a separate fix & installed without user interaction

Considering it needs to update the TLS support on the rescue partition too, doing it outside of single-user mode is probably not a good idea.

You're nitpicking, it seems.

Angostura• 12 years ago

Actually, that's a good point - I suspect testing the wacky double update could have added a day or so to QA

meowface3• 12 years ago

Looks like it's because they packaged a ton of other security patches with this update, too. See:

http://support.apple.com/kb/HT6150

rmoriz2• 12 years ago

Damn, I was close… :-)

http://i.imgur.com/vKnXhJ8.png

cpr• 12 years ago

Isn't yours just a manifestation of the general TLS bug? Or does it differ somehow?

rmoriz2• 12 years ago

No, it's just a bug of the SecureTransport backend in curl [1]. I thought Apple maintains the backend as nobody else uses it (homebrew curl uses OpenSSL) and that's why I've submitted the issue to Apple instead to the curl maintainer.

So maybe it brought some eyes on the "gotofail" but that's just speculation…

Thanks anonymous Apple guy :)

[1] https://github.com/bagder/curl/pull/93/files

SmileyKeith2• 12 years ago

I cant believe they don't even mention the SSL bug in this. That's just insulting.

avtar• 12 years ago

It's mentioned in the last line here http://support.apple.com/kb/HT6114 And yeah, that's kind of bizarre.

SmileyKeith2• 12 years ago

Nice call. Yea very strange. Seems like the most important thing in this update. It should at least be at the top of the bug fix list.

jbergstroem• 12 years ago

It might also be last in line since it was last to go in to the release.

chmars2• 12 years ago

That is normal in the general update notice. There is always a more detailed security update notice, for OS X 10.9.2 it can be found at:

http://support.apple.com/kb/HT6150

vacri• 12 years ago

So in order to show the importance of this security update, they've put it in bland writing in a long, detailed security notice that only the most ardent of admins would read thoroughly, and even then it doesn't particularly stand out as important.

Regular Jane and John Does or even power users would have no idea of the importance of upgrading their system for this. "500MB update? Nah, it can wait, I don't need any of that".

flatdeviant• 12 years ago

Apple has also changed the behavior of the power button on notebooks. Previously, pressing the button made the Mac instantly go to sleep. Now, just pressing it doesn't do anything. You can still hold the power button for 3 seconds to get the usual "Are you sure you want to shut down your computer now?" dialog box.

Awesome for those of us using FileVault who have to enter their login password each time they wake up their computer.

acdha• 12 years ago

This changed back when 10.9 was released:

http://support.apple.com/kb/HT5869

randomdata• 12 years ago

The parent is correct. In 10.9, pressing the power button put the computer to sleep, replacing the dialog prompt shown in your link. As of 10.9.2, simply pressing it does nothing at all.

bluthru2• 12 years ago

FYI if someone does want to instantly put their computer to sleep:

Command-Option-Media Eject (⏏)

http://support.apple.com/kb/HT1343?viewlocale=en_US&locale=e...

e1ven• 12 years ago

Forgive me, but I'm not really sure why this is getting so much attention.

It's certainly a bad bug, and it ought to have been caught. But it feels like this would be much harder to exploit than many other bugs which have had far less hoopla.

As I understand, this SSL bug makes it rather trivial to perform MITM attacks against apps which use the default system SSL libs.

That's certainly a problem, but most people are using trustworthy ISPs (at least in this sense). Comcast seems unlikely to try to steal your bank password, and Verizon is unlikely to try to harvest your HN cookies.

It seems like this primarily affects people connecting to untrustworthy access-points, such as Coffee Shops, or Airport Wifi - While that's certainly something that needs to be fixed, it seems far less crucial than remote-code-execution [1], or many other bugs we see regularly.

I'm sure I'm missing something here, can someone help me understand? Is it just the "Ick" factor of having something you thought was encrypted actually being fairly open?

I don't understand why this is getting more attention that other (seemingly) more dangerous exploits.

[1] http://msisac.cisecurity.org/advisories/2013/2013-088.cfm

joshdulac• 12 years ago

Think "outside the box" of the US. Not all Mac users have "trustworthy" ISPs or are on trusted networks.

ambrop77• 12 years ago

It's getting attention because:

- It's an easy to spot bug,

- in the most critical part of the code,

- of a fundamental security library,

- and it's been there for a long time, nobody knows how many systems have already been compromised due to it.

With this bug, Apple's library isn't actually a SSL implementation. It does not perform the most essential part of a SSL implementation - verifying that the peer possesses the private key it claims to posses.

it seems far less crucial than remote-code-execution
I don't understand why this is getting more attention that other (seemingly) more dangerous exploits.

Because it's the foundation for a heap of applications and services that were believed to be secure due to use of SSL. If you consider those, this is worse than any bug in any application. It's not just one application with a critical vulnerability - effectively, it's half (or whatmany) of all OSX and iOS apps with a critical vulnerability. All you need to do is go browse the net in a coffee shop, and some stranger can easily do things like:

- Pwn your box (MITM the auto update). Actually with this he can do all of the latter too.

- Steal your money (MITM your bank connection).

- Steam your online accounts, including email.

It's not "just a bug". Yes, everyone makes mistakes, we're all human. But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users.

That's certainly a problem, but most people are using trustworthy ISPs

Your argument seems to be that it's not a big issue if the security is totally broke since we don't need security in the first place.

ctolsen4• 12 years ago

It's even more unacceptable that it took them FOUR DAYS to fix it, just so they could add a couple of features to FaceTime while they were at it.

chimeracoder• 12 years ago

But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users.

The handling has been abysmal as well. They dropped a 0-day on themselves by releasing the iOS update, and then delayed the fix by several days, apparently so they could release it along with the Facetime integration.

And even then they don't mention it on the release notes![0] If you look at the release notes for this update, you'd have no idea how important this is, if you didn't already know.

[0] The release notes (http://support.apple.com/kb/HT6114) link to this: http://support.apple.com/kb/HT1222 , which as of right now, lists Dec. 16th as the most recent OS X security update.

nsxwolf2• 12 years ago

How many malicious exploits have occurred in the last 5 days? I'm genuinely curious if anyone has a guess.

Wouldn't you need to have control of the router Starbucks is using to set up the MITM attack?

eslaught• 12 years ago

"It's not "just a bug". Yes, everyone makes mistakes, we're all human. But it's completely unacceptable that those mistakes get unnoticed and into production code of such a critical component, and deployed to millions of users."

This is not a reasonable argument. At Pwn2Own each year, how many browsers have vulnerabilities that allow remote code execution? All of them. How many of these vulnerabilities are zero-days? A significant number of those. This happens every single year. Even the advanced protections in e.g. Chrome don't stop new vulnerabilities from being found on a regular basis. And all of these products are deployed to millions of users.

You could complain about Apple's response to this bug, and that might be a reasonable complaint to make. At least Google patches bugs quickly when they surface at Pwn2Own. But that's different from claiming the bugs shouldn't have existed (or should have been caught before making it into production). Bugs are fundamentally hard to find, and it's not really getting any easier.

dubcanada• 12 years ago

I may be wrong but is part of WebKit and not just Safari? In which case this isn't solely apple.

Zhenya• 12 years ago

What does it mean to "steam your online account"?

kryptiskt• 12 years ago

That's certainly a problem, but most people are using trustworthy ISPs (at least in this sense). Comcast seems unlikely to try to steal your bank password, and Verizon is unlikely to try to harvest your HN cookies.

But if you are tricked to go to bankofamericaa.com instead of bankofamerica.com, a crook can be the proxy between you and your bank and you are none the wiser.

saurik3• 12 years ago

This is true with or without this bug.

pera• 12 years ago

Coffe Shops, Airports, your insecure home wlan, your office, GSM networks... actually, do you use tls at all or you just go plain text because you're using a "trustworthy ISP"?

untog• 12 years ago

This seems like the key to me. Seems naive to think that your trusted ISP is the only person you'll ever get internet access through.

pktgen• 12 years ago

Comcast seems unlikely to try to steal your bank password

I don't know about that. Comcast doesn't seem to have any problem robbing its customers right now.

gopalv• 12 years ago

It's about the false sense of security.

And that betrayed sense, which invokes a hint of paranoia - that bug looks too obvious to have been skipped in QA.

lawnchair_larry4• 12 years ago

You're not necessarily totally off-base, but potential attackers include far more than who you think operates your first hop.

corresation• 12 years ago

If you trust every network hop, are sure that you are never impacted by aberrant if not even malicious routes, never touched by DNS spoofing....SSL becomes irrelevant, doesn't it?

lfuller• 12 years ago

I believe that the recent NSA revelations are the primary reason this bug is so concerning. We already know that the US government has access to the majority of packets being routed across the US, and this bug makes it trivial to decrypt those originating from Apple devices.

zorked• 12 years ago

This got famous because:

- It really is a severe bug in a major platform (and by that I mean iOS not MacOS)

- It is easy to understand once spotted, so everybody who can read code in the entire planet can write about how stupid Apple is because they refuse to see the light and switch over to their favorite pet language/coding standard/methodology

- The NSA has massive MITM capabilities and is known to sabotage American products and this looks like a very, very convenient bug to have for them, leading to speculation that this could not be a mistake

- Apple haters.

ne0codex• 12 years ago

Apple hating seems to be the new trend and I see it as the main reason for thus much attention.

That, and also for the fact that if Steve Jobs were still around, he'd be able to sweep this up or else be able to assuage the public about the 1 extra line of goto fail; I think that in the post-Jobs future, we'll see more and more "revelations" about bugs/issues within Apple/iOS/OS X with people aggressively posting as much info as possible to "stick it to Apple"

zaroth• 12 years ago

Easy to understand definitely drives the reporting.

Compare the reporting of this to the Chrome vulnerability in TLS patched yesterday... https://news.ycombinator.com/item?id=7295785

cbsmith3• 12 years ago

That's actually a quite easy to understand problem as well.

The difference is pretty major. It's believable that someone forgot to consider the case where a new certificate was negotiated. It's downright inconceivable that no one tested whether a bad certificate failed validation. That's like selling a pregnancy test without testing what happens if the person isn't pregnant.

brudgers3• 12 years ago

"Forgive me, but I'm not really sure why this is getting so much attention."

Because because the level of professional incompetence it exhibits in a world where people think using iPods as part of an airline's essential safety process is a fucking whizzing of an idea. It makes the first order problem of using iPods to transmit confidential medical records feel rather trivial.

Yet there is nothing for which you need ask forgiveness. A model of the world where everyone lives in circumstances where either Comcast or Verizon is always available for one's internet connection [and it goes without saying that neither could possibly be compromised] is so absurd that you can only be speaking tongue in cheek

Well played.

Shish2k2• 12 years ago

most people are using trustworthy ISPs

Have you not seen the news, at all, for the past several months? There have been a few revalations that perhaps some ISPs are not entirely trustworthy, to say the least...

cbsmith3• 12 years ago

That's certainly a problem, but most people are using trustworthy ISPs (at least in this sense). Comcast seems unlikely to try to steal your bank password, and Verizon is unlikely to try to harvest your HN cookies.

You got it! Really when you think about it, why do we even bother with crypto on the Internet in the first place? It's not like your data is traveling over a series of networks and nodes with different owners/operators that you don't even know and certainly haven't vetted for trustworthiness. That'd be crazy.

rch2• 12 years ago

I'm still not upgrading to Mavericks. I have a lot of work to do, and I dislike being asked to upend my system on somebody else's schedule.

cpach• 12 years ago

If you don’t run Mavericks you’re not affected by the goto fail.

rch2• 12 years ago

Yep, I know. As discussed a couple of days ago.

I think I'm just bothered by my perception that this Mavericks upgrade is being presented as a fix for an OS X security issue, rather than just offering a patch to Mavericks users.

jcampbell12• 12 years ago

Just installed this. Now I get a HSTS error on github for both Chrome and Safari.

subdigital2• 12 years ago

I do too. Did you find any more details on this?

subdigital2• 12 years ago

to fix it I had to reset my Keychain. Pain in the ass, but it was preventing me from working.

To do this, open Keychain Access, open Preferences, and click Reset Keychain. It will create a new login keychain and keep your old one backed up in the keychains folder.

LeoNatan252• 12 years ago

I hope for a iOS 7.1 beta soon with this fix.

Watabou• 12 years ago

iOS was already patched a couple of days ago with iOS 7.0.6

LeoNatan252• 12 years ago

Yes, they fixed the 7.0.X branch, but the 7.1 beta branch is still unfixed.

protomyth• 12 years ago

Well, the bugs I reported in Finder are still there and it still crashes. I am very much missing Snow Leopard.

chmars2• 12 years ago

In 10.9.2. Apple did also fix a sadly impressive number of other security-related bugs:

http://support.apple.com/kb/HT6150

jtokoph• 12 years ago

The fun thing to think about is whether or not you can guarantee that the update you receive is actually from Apple and not someone sending you a fake via MITM.

Sure, they show a SHA1 on this page: http://support.apple.com/kb/DL1726 but that could be MITM'd as well.

stusmall• 12 years ago

That wouldn't even need an SSL bug to MITM

msbarnett4• 12 years ago

Updates are signed and the OS will refuse to run them if signature verification fails, so unless your MITM has Apple's signing key that wouldn't work.

(And no, this bug didn't break client-side signed package verification.)

ambrop77• 12 years ago

Unless your box has already been pwnd and the update installer has been modified to not install that update in the way it was meant to be.

yincrash• 12 years ago

Looks like you can get the sha1 via https: https://support.apple.com/kb/DL1726

ecmendenhall2• 12 years ago

This bug was pretty serious. I'd better be extra careful and install and verify this myself.

Oh, good: there's a standalone installer available (http://support.apple.com/kb/DL1726). But the download is served over HTTP. Maybe I can just try the same URL with HTTPS:

  $ curl --head https://support.apple.com/downloads/DL1726/en_US/OSXUpdCombo10.9.2.dmg
  HTTP/1.1 302 Moved Temporarily
  Server: Apache/2.2.24 (Unix)
  Location: http://download.info.apple.com/Mac_OS_X/031-3279.20140225.Zzasf/OSXUpdCombo10.9.2.dmg

Nope. Well, at least I can verify the SHA1 sum displayed on the download page. Wait, no, that was served over HTTP, too.

Okay, I'll follow Apple's instructions for checking the certificate fingerprint in the installer (http://support.apple.com/kb/ht5044). But that page (Last modified November 2011) displays a different fingerprint (9C864771 vs FA02790F)...and that fingerprint was also served over HTTP.

Gives up and opens the App Store.

pilif2• 12 years ago

The packages themselves are signed: Mount the .dmg file and use pkgutil --check-signature /path/to/Installer.pkg to check whether the package is signed by a valid CA (if you want to be totally sure, do this check on a machine running 10.8 or earlier)

isomorphic• 12 years ago

FWIW, I did this for the combo update. The SHA1 checksum on the Apple page, c06a63982b522e43997a05cedc04b0bdb1a10207, matches the file, and pkgutil reports

   Package "OSXUpdCombo10.9.2.pkg":

   Status: signed Apple Software

   Certificate Chain:
    1. Software Update
       SHA1 fingerprint: 1E 34 E3 91 C6 44 37 DD 24 BE 57 B1 66 7B 2F DA 09 76 E1 FD
       -----------------------------------------------------------------------------

    2. Apple Software Update Certification Authority
       SHA1 fingerprint: FA 02 79 0F CE 9D 93 00 89 C8 C2 51 0B BC 50 B4 85 8E 6F BF
       -----------------------------------------------------------------------------

    3. Apple Root CA
       SHA1 fingerprint: 61 1E 5B 66 2C 59 3A 08 FF 58 D1 4A E2 24 52 D1 98 DF 6C 60

dfc2• 12 years ago

In addition to pillf's suggestion:

  1. Use linux/fbsd/obsd/win box to download update.
  2. Verify authenticity of cert/sha1
  3. scp dmg / copy to USB drive
  4. Apply update and move on.

brudgers3• 12 years ago

"Mom, First use linux/fbsd/obsd/win box to download update. Next verify authenticity of cert/sha1. Then just scp dmg / copy to USB drive, apply update and move on."

If you're 13, add "duh" at the end.

Shish2k2• 12 years ago

Seems ironic that of all the patches that don't get served over SSL, the "SSL is meaningless" bug is the one where you'd point out that SSL should be available :P

sneak7• 12 years ago

This is all pointless handwaving; the update package itself is signed and will not install if tampered with, regardless of TLS certs used to download it.

TLS is not used to authenticate the update.

ecmendenhall2• 12 years ago

Ah, right. That makes sense. If only it was mentioned on the download page!

guid• 12 years ago

Interesting: After the update, ocspd downloaded roughly 40MB of ... certificate revocation lists?

ocspd /usr/sbin/ocspd Total: 196 B sent, 45.8 MB received Outgoing to devimages.apple.com (92.122.207.101), Port http (80), Protocol TCP (6), 196 B sent, 45.8 MB received

cerberusss• 12 years ago

I think that's not related to the SSL/TLS bug, but instead to the curl problem that also came with the update to 10.9.2. This is the description from Apple's security mailing list:

"curl Available for: OS X Mavericks 10.9 and 10.9.1 Impact: An attacker with a privileged network position may intercept user credentials or other sensitive information Description: When using curl to connect to an HTTPS URL containing an IP address, the IP address was not validated against the certificate. This issue does not affect systems prior to OS X Mavericks v10.9. CVE-ID CVE-2014-1263 : Roland Moriz of Moriz GmbH"

dola• 12 years ago

What I wonder, is if Apple can be held responsible (to some extent) for damages that resulted due to this bug for app developers like a bank whose customers were robbed because the bank relied on the secure connection as it should have been provided by the Apple API. Clearly, the attacker is still the person to have exploited the bug but I think a developer should be able to assume that Apples security relevant API functionalities are indeed secure.

rimantas• 12 years ago

Does it have a precedent with gaziilions of other bugs on all platforms? It is really fun to watch how "hey I understand this one" turns into "the most dangerous and evil bug on any platform evah".

spiralpolitik3• 12 years ago

Remember that software license you clicked while installing ? Most likely it had something like:

THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.

So yeah Apple can't be held responsible. If they could then the whole free software open source community would be in deep doo doo.

jasey• 12 years ago

edit - oh wow I just read what this fix's. Will be updating asap

I haven't upgraded to Mavericks at all yet because I'm worried that it will break software I depend on a daily basis. Can some please confirm if upgrading has a significant risk of breaking compatibility with things like rails, mamp, netbeans, android studio, golang, vagrant, virtualbox, docker etc.

Thanks

bkmrkr• 12 years ago

Still no handling for hidpi and dell 2815Q

vardump2• 12 years ago

OS X Mavericks audio problems are still not fixed. Audio dropouts in Google Chrome more often than once per second when a lot of tabs are open. Makes for example Youtube unbearable to watch. Chrome audio worked fine in OSX 10.8 with a lot more tabs.

Mid 2012 MBP (MacBookPro9,2).

giovannibajo1• 12 years ago

Are you sure it's not a chrome bug? Obviously chrome updated itself many times in the meantime. Do you see this same bug even in different contexts (eg when using multiple applications, when doing CPU-intensive tasks and using iTunes at the same time, etc.)?

vardump2• 12 years ago

The bug does not show up immediately with light load in Chrome (only a few tabs open). But anything heavier, and audio dropouts start. No idea whether it's a Chrome bug or OSX, but the problem started immediately after 10.9 update.

The issue is present after a fresh reboot with no other applications running than Chrome.

My Chrome version is now 33.0.1750.117, which should be the current one.

iTunes and Safari audio output is always fine.

I run VMWare Fusion 6 virtual machines often, but that doesn't seem affect the bug way or another. Also, I only installed VF6 long after updating to 10.9.

Audio in Windows or Linux Chrome running in a VF6 virtual machine is perfectly good.

Just tested again, the issue seems to only affect Chrome playing Macromedia Flash content. I don't have Flash player installed, only Chrome's internal PPAPI Flash player.

emocakes• 12 years ago

took me 4 reboots and 15minutes of waiting at something do with SD cards to get this crap installed. Even windows update works better these days.

millerm• 12 years ago

To all those who say "it was so easy to spot", congrats on finding the flaw and letting us all know first thing. /s

therealmarv• 12 years ago

Yeah. Finally they fixed this ssl bug and also important to me this annoying webcam bug on Macbook Air for Skype and Hangouts.

QuiteMouse• 12 years ago

So are they going to release this fix for Snow Leopard ? Not all of us are on the latest and greatest hardware.

spiralpolitik3• 12 years ago

The issue only effects OS X Mavericks.

watermarkcamera• 12 years ago

At last fixed SSL bug at OSX Mavericks 10.9.2

gwu78• 12 years ago

A compelling way to get holdouts to upgrade iOS/OSX. Get those iPhone 4 folks who are content with iOS 6.x to install iOS 7.x.

God only knows what incompetence and disregard for user privacy and sanity awaits in these "new" versions. What are they adding that we really need? Oh, the ability to use SSL PKI. Yeah, I guess you have to upgrade.

Why isn't HN discussing the effects this screw up has on email? Email is bigger than the web, belive it or not.

And most of the world appears to use webmail.

With this "bug" HTTPS for your webmail is futile.

You have no way to know you are connecting to the real googlemail, yahoomail, hotmail, etc.

The "authentication" functions of SSL need to be made an compilation option, not a default.

It's obvious almost no knows or cares how to use SSL's PKI mechanism properly.

SSL's encryption capabilities have been useful, but using SSL to do server authentication causes more problems than it solves.

History has shown it's just not easy enough to use.

SSH can do authentication without PKI. Alas, it is embedded into a program that only nerds use.

I'm using the authentication framework in CurveCP. I'm working on making it very easy to use.

ralfd• 12 years ago

Don't be a ignorant. Together with 7.0.6 there was also a security update to iOS 6.1.6.

http://support.apple.com/kb/HT6146

cajueira• 12 years ago

I have not read much in regards to WHY this exact same bug was also found in OSX. Can anyone shed some light on this?

Do they use the same code stack for iOS and OSX? This seems weird to me - even though parts of code could be used in both operating systems, I would imagine separate teams would be on iOS and OSX, each reviewing code bases on their own, running unit tests and whatnot. Still, this major flaw has been present for 2.5(?) years - all the more reason for paranoia about its presence.

Add to this, why wait so long with the OSX update? A security issue THIS serious MUST be patched instantly and rolled out as an individual/separate update as soon as possible, even if that means pushing back OSX 10.9.2. Or did they need some time to introduce a new flaw somewhere? o_O

chrisBob• 12 years ago

But will this fix the bug where my mail doesn't update for hours at a time?!!

volume• 12 years ago

i wonder how soon a metasploit plugin will be available?

johnny635• 12 years ago

How many more backdoors will be discovered?

Apple releases OS X Mavericks 10.9.2 with SSL fix

Related Stories