full-disclosure - Just FYI, APPLE-SA-2010-12-16-1 Released for Airport Firmware

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <05F62ED5-C9FA-4D42-97E9-F7F9188696F9@sabahattin-gucukoglu.com>
Date: Fri, 17 Dec 2010 03:22:38 +0000
From: Sabahattin Gucukoglu <mail@...ahattin-gucukoglu.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Just FYI,
	APPLE-SA-2010-12-16-1 Released for Airport Firmware

Honourable mention for a strong and swift [PS] response to security announcements.  Apple has released fixes for various problems with Airport firmware, whose vulnerabilities date back to 2008.  You can read the full announcement at:
http://support.apple.com/kb/HT4298

My unsanitised FTP PORT command problem (thanks for credit Apple, but which I have long since dealt with by not running an FTP server behind a Time Capsule) was nine months old.  I couldn't find the reference for the latest CVE, but it seems to be for a month ago.

A happy day. :-)

Cheers,
Sabahattin

PS: If anybody at Apple, or anybody with a humour impairment, should read this, it's a joke, dammit.  Of course I'm happy they've honoured the problems.  I'm almost sure they feel the same way I do about the whole thing, though.  I mean, the CVE comes out, they put an autoresponder in front of the security contact (which takes the form of a person using copy and paste) and nothing happens - either they just genuinely don't care for the severity of the problems (can you imagine Cisco doing that?!!), or they're too busy releasing shiny new iGadgets to put most of these little problems aside as minor inconveniences.  But until they remedy that, they won't get these things into business.  Which, FTR, I think would be a big shame.  No, seriously - there's something badly, badly wrong when you have to time your security announcements so that their availability heralds a new product release. :-(

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/