Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.0230
APPLE-SA-2014-02-21-1 iOS 6.1.6 & APPLE-SA-2014-02-21-2 iOS
7.0.6 & APPLE-SA-2014-02-21-3 Apple TV 6.0.2
24 February 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: iOS
Apple TV
Publisher: Apple
Operating System: Apple iOS
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2014-1266
Comment: This bulletin contains three (3) Apple security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2014-02-21-1 iOS 6.1.6
iOS 6.1.6 is now available and addresses the following:
Data Security
Available for: iPhone 3GS, iPod touch (4th generation)
Impact: An attacker with a privileged network position may capture
or modify data in sessions protected by SSL/TLS
Description: Secure Transport failed to validate the authenticity of
the connection. This issue was addressed by restoring missing
validation steps.
CVE-ID
CVE-2014-1266
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "6.1.6".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJTBpNtAAoJEPefwLHPlZEwqcUP/0YJ7TXUy+Tpl3d+A0auJDYC
IbSALoQW0qipyJVLLTwlTIMwUC+FI/oiAZCy6ku/Y0qz9zx972GVa1W46H5szJiY
HJsTKOCnUgV6IqPeH902oOSl4A7cvBspZ6uR3veUwRoKGN0prKRcaTgTYkLpDu48
U8Jy4x7AVHUUHf7gcBKdS4KFE9f0C5ykRAIbJwxwe1NOyD1YbLYYfDXxykGbD3c5
57VfU7aQDjv/X7iBHfDbSW3VAQEGqXFK+OhCCP4qC0ZL/7YgmjjvGCBjIoOsmoED
3MaOELBFmjZcnp8gQ0UocrEknqoDVhiOtQddBQgCFlF5fFh3OGJDVX0RczX1u2Nd
cNXgoG9No/HXG+hNhce5c7SjvZeJ2O5TiHwmm8jBGCSpKpod1qjiwReANZJs6yoo
7h5E8FV4/dkSCmuPp1l/GoOFAPmt0gjCft5Fdv7K/kzvs54nqQ8ndF9Jn2Fe+D4U
M5iRd26WWN77KX6x6PKSNLwwdz7VgDE5j8gEOzoTSPEY3ramkmkZQWgi5rq91W70
5KHD638D0/BgFtdy7W1ZcD3bms0jK13xxJOg2BZmhgL3Zh1btxSFK01voq2CYN8N
KTt4cbq/6YMEeI3jr+TNDJA/5EKPCt3OCiexOze1XrqAnSdtrBeKNG4REjpxqG31
5HZpIZ+X2Pl9XIRpbryt
=m1BF
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2014-02-21-2 iOS 7.0.6
iOS 7.0.6 is now available and addresses the following:
Data Security
Available for: iPhone 4 and later, iPod touch (5th generation),
iPad 2 and later
Impact: An attacker with a privileged network position may capture
or modify data in sessions protected by SSL/TLS
Description: Secure Transport failed to validate the authenticity of
the connection. This issue was addressed by restoring missing
validation steps.
CVE-ID
CVE-2014-1266
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "7.0.6".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJTBpN9AAoJEPefwLHPlZEwFpYP/2Ac20hocp3/xWv08EFmpZpl
T52aoGMpJxZFRh307mS76jNXDZ2KodcBboESKbYE8PxMK9DkAtqEbSQjMa9cUK3+
3iUhqNnFm7YrG8+8JVoZ58Jxiq9zEmKGVEf+s4o1F1ORJPAQRDROiC5MBru1UOAb
/sXZeX1Awr81RJeu4f8A9Qddu6AEICr2sYRlWQA8wa24Y2qswrOvqvFRSK4WnB8L
6sqe6JL0C59GhjRh11WsObMQN+vbBcVty7q4e0WfuLNt0LP8yZBC2XruAx0Q2v1k
t5JA6keq7zwAzE+zO4qjYXGTVePyPe7vJx00ndjvTjAI7iXrcRgNxUuH5BAj7O7h
agzSWNKvaUYynJd2oiv5onN7kh+3UbexiXIKOc5ZgOpVk7fgLCnN9UcPuxpGjF5u
RODQM5LtAYEdmzs4Ws711Gu+k0OT3QTWXWu9/k6Yp2DKwCjDp9gzM/EhT5T7PqCL
KM8gnGOiTJh0vUmdI94huF987heNBzoRId/wdip/e2iXKTGB3Z8AipmDi72v63FB
seh7rZWOgxZ+9YSCyXFl4FfcZDBSEhERzw2C8OXP2iXBzspM3LsqlqBbbyTB/bRm
lOSrP8nxkf0Fw8ehqs52wxfjenk2hvnkHddE4HU3DuvoK4M9hZ98sLppHxoxw7Lp
aMn7lqBBT+6V5+uaVkA8
=klGW
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2014-02-21-3 Apple TV 6.0.2
Apple TV 6.0.2 is now available and addresses the following:
Apple TV
Available for: Apple TV 2nd generation and later
Impact: An attacker with a privileged network position may capture
or modify data in sessions protected by SSL/TLS
Description: Secure Transport failed to validate the authenticity of
the connection. This issue was addressed by restoring missing
validation steps.
CVE-ID
CVE-2014-1266
Installation note:
Apple TV will periodically check for software updates. Alternatively,
you may manually check for software updates by selecting
"Settings -> General -> Update Software".
To check the current version of software, select
"Settings -> General -> About".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
iQIcBAEBAgAGBQJTBpOGAAoJEPefwLHPlZEwmX0P/34F8kRqvI2JJS2eoNi1cPr5
yxLbd3QoaOcu8fMgaGe/DT/xJbaLTKhZkMfKdHsWkTT3lK2GkipUbAfHGqALByk6
SdvJazfHMqV8q8i5Rc2j1JF3p7E69VkBLUY7qB35b/aFKo8k3KTcXXTFw3wsQWF5
gzSZ9tNqn4qExyPQYtmrmVv2oDVW68UHsPraI2bbQldF+zrcvtiDWL3lDKGPdeQ0
c7M0Es7r+SgnIOun27FnIhiAtvgh+Fvva16SLGIY5U1zCSNBmg6rlwT30E28D/5j
P24lDV2AfqmHEsV79nHgivkspxFJq77b9ivpKTUnNSRLM6btw8o/5vfrawOFqd5v
LhAQmnoZBq1tlVHoxlAjSB0RAIzRlmVDAu55EekOwmAQP3Vy5klb5Uvf26yTiBqM
Gkh9fqJWjdFhfTM/DQygVLa4a9n7wOAS/8dPY4fcEIeBW9Iz5Kr3mN9tFOcmfghC
hGfls4xbDAdfigf4GCI+ZI0dk6l3e1iNNQ8BSriwyWgLeDJqvfef3Ubc6Y8uT7d5
GoElrH95dPA78GMZOiyaKeLktea0wwIdNO0duKmks2K0VHeUMYj4DVL0/+lNY2LN
dswkxFjE1oXgStjLHWQgmJVumKxaxiZaev9v+ZWpLWydg3gUOcL9pBpEVClK78cx
QGFP3upkcdJtNlUhbd8N
=dZI4
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBUwqu7hLndAQH1ShLAQLnVw//X0LZPVrkYAo8b2TUDgt2Vc/abm+4xfO/
h2ukzVgIKyNBtoMpX1zf13rimg8+el3sx8wtHuy4PA+9MOokk9bxDeMqlCx8IM5n
GTsfAC3+rulKDaLEq0hVfBEthEM4UpX4CvobhEClXH0Mzd0TlPjqNWEjl2+mKeqG
jy7Fx5dTYWVOOmiHL4ZB3WjcS2y4YHT72BFnT2u7Tk7sw7jsNA93m8GxxWsAJckW
tIfJtwaZO72Hxt6rH3LGnYLKSe7M1+4vjKibdEna3gzT0PiuAeEt3by1bCGsBa4D
EPgsJ4uHoJ99fJS7DV4bsbVcyMcALgCVokchqiOwaKug/oNVr+7tEuMJXRoKqZT6
Fsb3VokxfOot1A50i0+zDFrl5Rugb2IFhx8VFfJuA4dKaQ9rDnE88nT+tu3OKMtU
UWFVo5oocMW8yknx8E/VhZ1WQAmMwlb72B3KR94Ixh5wBmESpuAObiMb4bX/E5no
HiFXUiQlxHGPVbF7ognRA0AQWGApAwdOH09feymLgSEDnu8Qmugi+K3/UCvHs5j6
InGCv5LD5Ok1BeEJ5/u56OiOPq+oADtppMrKlNLBKnHvxmqvXknIC7l93oNen9rq
/tWBL8N1P+7EeZy+WG3MvDls1ZdRM5TVrUXC1pU5kGf0ZQA8CfGrsdXFkUEt0c5h
bg9+iMs1g+k=
=aZMT
-----END PGP SIGNATURE-----