[Full-disclosure] Just FYI, APPLE-SA-2010-12-16-1 Released for Airport Firmware

[Sabahattin Gucukoglu <mail@xxxxxxxxxxxxxxxxxxxxxxxx>]

Honourable mention for a strong and swift [PS] response to security 
announcements.  Apple has released fixes for various problems with Airport 
firmware, whose vulnerabilities date back to 2008.  You can read the full 
announcement at:
http://support.apple.com/kb/HT4298

My unsanitised FTP PORT command problem (thanks for credit Apple, but which I 
have long since dealt with by not running an FTP server behind a Time Capsule) 
was nine months old.  I couldn't find the reference for the latest CVE, but it 
seems to be for a month ago.

A happy day. :-)

Cheers,
Sabahattin

PS: If anybody at Apple, or anybody with a humour impairment, should read this, 
it's a joke, dammit.  Of course I'm happy they've honoured the problems.  I'm 
almost sure they feel the same way I do about the whole thing, though.  I mean, 
the CVE comes out, they put an autoresponder in front of the security contact 
(which takes the form of a person using copy and paste) and nothing happens - 
either they just genuinely don't care for the severity of the problems (can you 
imagine Cisco doing that?!!), or they're too busy releasing shiny new iGadgets 
to put most of these little problems aside as minor inconveniences.  But until 
they remedy that, they won't get these things into business.  Which, FTR, I 
think would be a big shame.  No, seriously - there's something badly, badly 
wrong when you have to time your security announcements so that their 
availability heralds a new product release. :-(

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/