Disclaimer: as technology changes, advisories may become out of date or may no longer be relevant, please refer to the "Date" section of the header to be sure the advisory is recent as pertains to your situation.
Keywords: SSL, TLS, Apple, HTTPS, Vulnerability, Data Exposure, Mac OSX, iOS
DBSA ID: 2014-0004
Regarding: Apple SSL/TLS Vulnerability
Date: 2014 02 24
Last Modified: 20140224185541 by Kradorex Xeron
Who should take note: All users of Apple devices and platforms
Rationale: Information may be disclosed without immediate action
Rationale: Trusted encrypted connections may be at risk
Spread of Issue: MULTI-PLATFORM HIGH
Rationale: The issue effects both Mac OSX and iOS to which iOS is utilized on millions of devices.
Apple is a manufacturer and publisher of hardware and software platforms including Mac OSX, which is an operating system utilized on desktop and laptop computers; and iOS, which is a platform utilized on mobile phones and tablets. A vulnerability has been located in Apple's SSL/TLS (Secure Socket Library/Transport Layer Security) cryptography libraries which may result in interception or alteration of data protected in SSL sessions including HTTPS sessions through the Apple web browser safari. The vulnerability in specific is a certificate verification check that is supposed to check specific parameters of the website's certificate unable to fail. Thus an attacker can leverage this flaw to issue certificates that should by rights be rejected that are accepted by the vulnerable software.
For further technical information, please review CVE-2014-1266
iOS users are advised to update their devices immediately.
Mac OSX computer users are advised to immediately cease utilizing Safari as a web browser (which utilizes the vulnerable libraries) and to install and/or use Mozilla Firefox or Google Chrome.