Apple Patched A Major Ssl Bug In Ios Yesterday But Os X Is Still At Risk

Update: Apple says an OS X fix is coming soon.

Yesterday Apple released iOS update 7.0.6 alongside new builds for iOS 6 and Apple TV  that it said provided “a fix for SSL connection verification.” While Apple didn’t provide much specific information on the bug, it wasn’t long before the answer was at the top of Hacker News. It turns out that minor security fix was actually a major flaw that could in theory allow attackers to intercept communications between affected browsers and just about any SSL-protected site. Not only that, but the bug is also present in current builds of OS X that Apple has yet to release a security patch for.

Researchers from CrowdStrike described the bug in a report:

Adam Langley, a senior software engineer at Google, also wrote about the flaw on his blog ImperialViolet and created a test site to check if you have the bug (pictured above):

The updates Apple released for iOS yesterday are expected to fix the issue and Langley confirmed as much, but OS X 10.9.1 remains at risk. A test site to check if you have the bug is here.

I coded up a very quick test site at https://www.imperialviolet.org:1266. Note the port number (which is the CVE number), the normal site is running on port 443 and that is expected to work. On port 1266 the server is sending the same certificates but signing with a completely different key. If you can load an HTTPS site on port 1266 then you have this bug.

Some users also report that Apple’s latest developer build 10.9.2 is still vulnerable:

[tweet https://twitter.com/octal/status/437241194779652096]

Apple is yet to comment directly on the situation or provide an ETA on an incoming fix for OS X users.