Apple Finally Fixes OS X ‘Gotofail’ Flaw

Microsoft vulnerabilities. Monthly. Adobe zero-day patches. Fairly common. Oracle patches. Lots of them. But this week the industry is seeing something a little more rare: Apple security fixes.

For all the talk that Apple is largely immune to hacker attacks, the company on Tuesday issued a fix for Mac computers to protect users' personal information from being stolen by hackers. ItEUs a critical EUgotofailEU SSL flaw that could open a door for hackers to access a victimEUs communications, including FaceTime video chats, e-mail addresses and address book appointments, and even Find My Mac tracking information.

The security update, OS X version 10.9.2, fixes the flaw in OS X Mavericks as well as the older Mountain Lion; older versions of Mac OS X are not thought to be affected.

EUThe bug was caused by a line of C code that says 'goto fail,' which was a self-descriptive irony too amusing to ignore,EU writes Sophos security analyst Paul Ducklin in a blog post. EUSo the bug quickly became known as the EUgoto failEU, or even the EUdouble-goto-fail.EU (The error was that the line appeared twice instead of once.)EU

SSL is Horribly Broken

We caught up with Tyler Reguly, manager of security research for Tripwire, to see what he had say about these fixes. He told us this type of bug leaves him torn.

EUI hate seeing flaws like this because of how dangerous they are but they also serve as a good reminder that SSL is horribly broken. The moment people get comfortable with SSL, these bugs crop up to remind people that it's a dangerous thing to trust,EU Reguly said.

EUWhen I think about people visiting coffee shops and hotels with wireless networks and think about how many iOS devices are connecting regularly, it makes me cringe. This bug could prove devastating for a lot of users....

Comments are closed.