[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
CVE for Apple's ECDHE-ECDSA SecureTransport bug?
- To: Full Disclosure List <fulldisclosure@xxxxxxxxxxxx>, BugTraq <bugtraq@xxxxxxxxxxxxxxxxx>
- Subject: CVE for Apple's ECDHE-ECDSA SecureTransport bug?
- From: Jeffrey Walton <noloader@xxxxxxxxx>
- Date: Wed, 20 May 2015 18:52:28 -0400
Does anyone know if Apple's ECDHE-ECDSA SecureTransport bug was
assigned a CVE? It affected OS X and iOS.
Effectively, the bug was an implementation error that cause
interoperability failures. To mostly counter it, the cipher suites had
to be disabled, which resulted in a loss of security. If the person
experiencing it did not know the cause, then they were left with a
Denial of Service (DoS).
To be clear, this was a different bug than CVE-2015-1130 (Goto Fail).
Also see SSL_OP_SAFARI_ECDHE_ECDSA_BUG on the OpenSSL wiki
(http://wiki.openssl.org/index.php/SSL_OP_SAFARI_ECDHE_ECDSA_BUG).