PODCAST: News from RSA 2015

Dennis Fisher, Mike Mimoso and Brian Donohue discuss the news of the week from the RSA Conference. Download: digitalunderground198.mp3 Music by Chris Gonsalves Flickr photo via @jf10...

APPLE-SA-2015-03-09-1 iOS 8.2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2015-03-09-1 iOS 8.2 iOS 8.2 is now available and addresses the following: CoreTelephony Available for: iPhone 4s and later, iPod touch 5th generation and later, iPad 2 and later Impact: A remote attacker can cause a device to unexpectedly...

Apple Extends Two-Factor Authentication to iMessage, FaceTime

Apple extended two-factor authentication 2FA yesterday to its iMessage and FaceTime services, adding an extra layer of security to the popular iOS apps. The move, which Apple has taken to calling “two-step verification,” follows the company’s enabling of 2FA on its iCloud storage service back in...

Apple-iTunes-9.0---(.pls)

Apple iTunes is prone to a buffer-overflow vulnerability because the software fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit...

Google Offers Bug Bounty Vulnerability Research Grants

Google last week announced that it has instituted a program for 2015 in which researchers can receive up to 3,133.70 in grant money for bug hunting. Researchers must apply for the grants, which will be an up-front award that will be paid out before a bug is submitted, Google said. “Researchers’...

CVE-2014-8840

The iTunes Store component in Apple iOS before 8.1.3 allows remote attackers to bypass a Safari sandbox protection mechanism by leveraging redirection of an SSL URL to the iTunes Store...

Design/Logic Flaw

The iTunes Store component in Apple iOS before 8.1.3 allows remote attackers to bypass a Safari sandbox protection mechanism by leveraging redirection of an SSL URL to the iTunes Store...

CVE-2014-8840

The iTunes Store component in Apple iOS before 8.1.3 allows remote attackers to bypass a Safari sandbox protection mechanism by leveraging redirection of an SSL URL to the iTunes Store...

CVE-2014-8840

CVE-2014-8840 affects the iTunes Store component in Apple iOS prior to 8.1.3, where a website redirect from Safari to the iTunes Store could bypass Safari’s sandbox protection. The root cause is improper handling of SSL URL redirects to the iTunes Store, enabling a remote attacker to bypass sandb...

Apple iOS Malicious Site Safari Sandbox Restriction Bypass Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability in Apple iOS's handling of redirect URLs from Safari to the iTunes Store allows remote attackers to exploit the vulnerability to construct URIs that users are tricked into parsing...

Apple iTunes < 12.0.1 Multiple Vulnerabilities (uncredentialed check)

The version of Apple iTunes on the remote host is prior to version 12.0.1. It is, therefore, affected by multiple vulnerabilities related to the included version of WebKit. The errors could lead to application crashes or arbitrary code execution. Note that Nessus has not tested for this issue but...

Apple iTunes < 12.0.1 Multiple Vulnerabilities (credentialed check)

The version of Apple iTunes installed on the remote Windows host is prior to 12.0.1. It is, therefore, affected by multiple vulnerabilities due to the included version of WebKit. The errors could lead to application crashes or arbitrary code execution. Note that Nessus has not tested for this iss...

Privacy Criticism Hits OSX Yosemite over Location Data

Apple has fixed a huge number of security vulnerabilities in OS X and iTunes and, at the same time, is being hit with criticisms about privacy issues in the new version of OS X. The latest version of the operating system, known as Yosemite, sends location information to Apple by default via the...

iTunes < 12.0.1 Multiple Vulnerabilities

Binary data 8561.prm...

Apple iTunes multiple security vulnerabilities

84 vulnerabilities on different formats and protocols parsing...

APPLE-SA-2014-10-16-6 iTunes 12.0.1

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-10-16-6 iTunes 12.0.1 iTunes 12.0.1 is now available and addresses the following: iTunes Available for: Windows 8, Windows 7, Vista, XP SP2 or later Impact: A man-in-the-middle attack while browsing the iTunes Store via iTunes may lead t...

Apple iTunes Insecure Permissions Privilege Escalation Vulnerability - Mac OS X

Apple iTunes is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:itunes";...

Apple Rolls Out iOS 8 with Bucket of Security Fixes

Apple has finally released iOS 8, the latest version of its operating system, for free to iPhone, iPad and iPod touch users. The company has assured that the latest iOS 8 update is a significant step away up from iOS 7. You can grab the new update through an over-the-air update accessible by goin...

Apple TV multiple security vulnerabilities

DoS, memory corruptions, unauthrized access to iTunes store...

APPLE-SA-2014-06-30-4 Apple TV 6.1.2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-06-30-4 Apple TV 6.1.2 Apple TV 6.1.2 is now available and addresses the following: Apple TV Available for: Apple TV 2nd generation and later Impact: An application could cause the device to unexpectedly restart Description: A null point...