Attention OSX 10.9 Users

February 26, 201411 yr

Administrator

For those that don't already know, OSX 10.9.0-.1 Mavericks has a SSL security vulnerability. Users currently not on 10.9.2 should update immediately (the update was released earlier today). Users running 10.8 Mountain Lion are not affected.

This vulnerability essentially gives hackers the ability to intercept SSL/TLS traffic for any software using SecureTransport (this includes most/all Apple software, such as Safari, Mail) provided that they are in a "privileged network position" (e.g. running the network). Chrome and Firefox are not affected as they use NSS instead of SecureTransport.

Obviously the consequences of this are far reaching since HTTPS traffic was no longer secure. Generally speaking, the protocol is used to secure information (such as your passwords, credit cards, and other sensitive information) transmitted over the internet.

Yes, I know Apple took their sweet time writing what should have been a quick fix. But, that may have been due to merging the other updates in 10.9.2. And yes, I know that if they did a simple dead code search, this problem would probably never have come up. Things happen and we don't know what ultimately allowed such a bug to slip through, so let's not jump to conclusions quickly.