I0n1c Releases 'Quick and Dirty' Patch to Fix Serious SSL Vulnerability in OS X Mavericks

I0n1c Releases 'Quick and Dirty' Patch to Fix Serious SSL Vulnerability in OS X Mavericks

Posted by · 17168 views · Translate
Stefan Esser, also known as i0n1c, has made a 'quick and dirty' patch available to fix the serious SSL vulnerability that Apple just patched in iOS but has yet to fix in OS X Mavericks.

The flaw is very serious because it totally compromises the security of SSL and allows for man in the middle attack on otherwise secure SSL connections without any warning on the client side. Unfortunately it has been discovered that this vulnerability is also present in OSX Mavericks. When you look at the following code snippet that is taken from Security.framework's sslKeyExchange.c you can spot a superfluous "goto fail;" statement. This statement is executed in all cases and completely bypasses the call to sslRawVerify. This means there is actually no verification performed on the signed server key exchange.

I0n1c has released a patch for the 64bit version of the Security.framework. However, users are warned that it is experimental and shouldn't be installed on production machines.

To see if your machine is vulnerable visit http://www.gotofail.com with a Safari browser.

A more detailed explanation of the vulnerability can be found at ImperialViolet.

Please follow iClarified on Twitter, Facebook, Google+, or RSS for updates on the situation and to be informed when Apple releases an official patch.

Read More


I0n1c Releases 'Quick and Dirty' Patch to Fix Serious SSL Vulnerability in OS X Mavericks
ElMachoDingDong - February 24, 2014 at 8:32pm
How do I apply the patch on my computer?
CliveB - February 22, 2014 at 9:41pm
While Safari is vulnerable, Firefox is not per the test site.
Mung - February 22, 2014 at 10:41pm
Talk about chrome or ie to fix it's leaks.
Mashman - February 24, 2014 at 8:55am
"simply switching browsers will not fully protect you." Taken from gotofail.com Other applications on your system such as mail, chat, financial, social networking and backup apps are also at risk.
Recent