When is Apple fixing the Heartbleed TLS vulnerability?

Question

Level 1

8 points

When is Apple fixing the Heartbleed TLS vulnerability?

Its concerning that I don't see evidence of Apple's action in response to being informed of the Heartbleed TLS vulnerability.

It allows external access to SSL keys, passwords, accounts, and etc in memory.

I'm hoping Apple has been secretly rushing a patch and that I will see it today or tomorrow.

Does anyone have information on Apple progress?

Thanks,

Rich

PS. There should be a security category.

MacBook Pro (Retina, 15-inch, Late 2013), OS X Mavericks (10.9.2)

Posted on Apr 8, 2014 2:19 PM

Reply

Answer 1

Apr 8, 2014 2:55 PM in response to Rich Rein

Rich, hold down on the hysteria...

https://github.com/musalbas/heartbleed-masstest/blob/master/top1000.txt

This is SSL package, it's a web protocol, not the computer.

Reply

Answer 2

lkrupp

Level 7

23,089 points

Apr 8, 2014 3:08 PM in response to Rich Rein

It's not your computer, its not your browser, it's not Apple. The problem exists with an open source software package that some websites use to establish SSL connections. There is no patch to be issued for your computer. The vulnerability exists on the websites themselves. Yahoo was among the sites with the problem but it has been fixed already.

http://www.cnet.com/news/how-to-protect-yourself-from-the-heartbleed-bug/

Reply

Answer 3

Rich Rein Author

Level 1

8 points

Apr 8, 2014 3:23 PM in response to Rich Rein

Thanks lkrupp and chattphotos...

Excellent links.

I saw no statement from Apple related to Heartbleed.

Does the problem exist in the apache server provided for osx 10.9?

I deploy apps there.

Thanks,

Rich

Reply

Answer 4

Rich Rein Author

Level 1

8 points

Apr 8, 2014 3:59 PM in response to lkrupp

For anyone following this thread, I just checked the deprecated version of OpenSSL delivered with OSX 10.9.2 often used with Apache:

$ openssl version

OpenSSL 0.9.8y 5 Feb 2013

This version is safe because its older than the introduction of Heartbleed in OpenSSL 1.0.1 and 1.0.2 beta.

And given the great explainations from lkrupp and chattphotos above, OS X 10.9 does not contain the Heartbleed exploit.

Thanks,

Rich

Reply

Answer 5

Apr 8, 2014 4:42 PM in response to Rich Rein

Thanks Rich for the solid answer.

While I appreciate the response by lkrupp and chattphotos, to be clear the opensource package "some websites use" is actually the same one Apple uses - they just don't supply a version that has vunerabilities.

If in doubt do what Rich did. Open "Applications", within there open "Utilities" and run "Terminal.app". You get a windows with a prompt. at the prompt type in "opensll version". The response should be as Rich showed (0.9.8y or similar). If it isn't 1.0.1 or 1.0.2beta.

Regardless of the response it's only an issue if you offer a service to the world that uses SSL.

Regards,

John

Reply

Answer 6

lkrupp

Level 7

23,089 points

Apr 8, 2014 5:35 PM in response to JollyJohn66

All I'm trying to make clear is that this is not an OS X vulnerability. It is websites that have deployed the faulty server package. The normal OS X user is not running a server even if it is not an affected version. They should not be expecting a patch from Apple to "fix" this. The fix has to come from the affected websites. The Verge link estimates that 3 out of 4 websites use the OpenSSL package. Chattphotos links shows that almost one thousand websites were tested and only 47 showed the vulnerability.

Reply

Answer 7

Rich Rein Author

Level 1

8 points

Apr 8, 2014 7:26 PM in response to lkrupp

No worries. Its clear. All input was very helpful.

Apple has no fix expected.

Apple is secure as always. 🙂

It is one of the many reasons I use Apple laptops for development.

(Though I wish my MacBook Pro had way more RAM like 64GB or 128GB).

Apple is missing an opportunity, though.

This situation is actually a perfect time for Apple to brag about its security, by identifying that Heartbleed does not affect normal Apple users, unless the access a vulnerable site. And that developers are only at risk if the open source projects pull in OpenSSL 1.0.1 or 1.0.2beta. Easy to do and great for Apple's reputation.

Consumers would hear "Apple good" and "World scary".

Like any dangerous event, the Heartbleed alarm in the various communities is a little bit like yelling fire in the theater and management's response after.

People have to be sure the alarm is false or does not affect them.

If management speaks up, the problem is over.

If management does not, then all the individuals run around avoiding the problem or assessing the problem for themselves. The latter is less efficient and more stressful.

I spent serveral hours figuring out where I had to look to determine the scope and risk.

All of the answers above, were very helpfull and reduced the scope of my effort.

Thanks for all the input.

There was no formal statement from Apple clarifying the issue. (At least none I could find)

In fact some of today's security announcements (3pm 4/8/14) had complained that Apple

had not responded to emails.

Apple is not responsible for responding to all emails.

And not all posts, even on stack overflow, are accurate.

But in certain scenarios, a communication event is beneficial.

It woud have saved me hours, this community thread, the time of all who contributed here, and the time of all who read here.

BTW: Mcafee scans sites and can assess risk while you are browsing, but the local virus detection is not as good as others.

BTW: Has anyone checked this site for the SSL version? 🙂 (joke)

Cheers!

Rich

Reply

Answer 8

babowa

Level 9

78,580 points

Apr 8, 2014 7:33 PM in response to Rich Rein

I checked my banks on this site today:

https://www.ssllabs.com/ssltest/

Might come in handy for someone else as well.

Reply

Answer 9

Rich Rein Author

Level 1

8 points

Apr 8, 2014 7:57 PM in response to babowa

FYI: The site, https://www.ssllabs.com/ssltest/, says that support.apple.com and discussions.apple.com are not vulnerable to Heartbleed.

Reply

Answer 10

Apr 8, 2014 8:05 PM in response to lkrupp

Understood, and thanks. It was your article that got me here. You're right Apple don't need to "fix" this and no patch will be required and that is an important point for people to note. I also agree with Rich, a small site/app for testing that displays in big bold letters that your Mac is not at risk would be a good marketing opportunity and would also cover those people who have messed with OpenSSL. If there is anyone/anything out there that has inadvetently upgraded OpenSSL (maybe an app during installation) it would be much better to test it than simply assume it must be OK.

Either way the approach from Rich covers it, albiet without the overt marketing angle.

Regards,

John

Reply

Answer 11

babowa

Level 9

78,580 points

Apr 8, 2014 8:11 PM in response to Rich Rein

Yes, I checked that as well.

Reply

Answer 12

Phlac

Level 1

107 points

Apr 8, 2014 9:14 PM in response to Rich Rein

Just to clarify this thread. Apple does use OpenSSL - in Mavericks, OS X Server uses 0.9.8y (it's also included with 10.9 non-server, I believe). The 0.9.8 branch is not affected by the Heartbleed bug. If you are using the 1.0.1 branch (go to a terminal shell and type "openssl version" (without the quotes)) then the vulnerbility does exist if it is 1.0.1 to 1.0.1f (inclusive), and whomever handles this stuff in your organization should upgade to the 1.0.1g version at https://www.openssl.org/source/ .

This info is from http://heartbleed.com

Reply

Answer 13

Apr 8, 2014 10:35 PM in response to Rich Rein

Heartbleed. AKA: CVE-2014-0160

So now that I have visited 800 sites in the past 6 months I have nothing to worry about??????????

I thought I was just high (Littlle Fluffy Clouds - The ORB). I am on my way to get a new hard drive tomorrow morning. 1TB solidstate hard drives do not come cheap ya know. Then I have to change hundreds of passwords.

Ya know what? When 'The Waz' (for example) says he forsees particular future troubles for Apple with The Cloud I tend to pay close attention to him over Mr Cook or others AND avoid The Cloud. In the meantime I will start consultations with some of my most frequented destinations online.

When you compare the immune systems of a Laboratory Rat to a common Sewer Rat which one do you think has a better immune system??

I am the Sewer Rat. I go everywhere that I am told Not to. Been like this all of my life. I think Mavericks was named after people like me. I do this for Apple because I prefer the underdog.

Reply

Answer 14

Apr 8, 2014 10:48 PM in response to davesnewlion

I am going to do ahead with my own precautions anyway and sit and watch. After all, I do run and like Mavericks.

Reply

Answer 15

cclauss

Level 1

4 points

Apr 9, 2014 12:47 AM in response to Rich Rein

The answer for iOS is not as pretty for iOS as it is for Mac OSX... My iPhone and iPad have OpenSSL 1.0.1b 26 Apr 2012. Can these devices be attacked using the heartbleed bug? Will Apple be upgrading iOS devices to have OpenSSL 1.0.1g or better?

Reply