Apple Macbook pro and other wireless fixes
Do you remember the big bruhaha a month or so back about the “apple wireless vulnerability” that everybody picked apart because in the video taped demonstration they used a third party card…. EVEN though the demonstrators stated that the same vulnerability existed in Apple’s own driver some on the internet tore one reporter up over stating that because Apple denied being shown exploit code (slight semantic issue there…) Well… those driver vulnerabilities that must have not existed, were fixed today by Apple. Brian Krebs has the story, as well as incidents.org
What’s really interesting is that several remote code execution vulnerabilites are fixed in this update, but no credit is given to the company that presented the vulnerability, so it’s either “bad blood” over the issue or a matter of pride for Apple since they’ve not admitted the demonstrated vulnerability was actually in their driver. In fact…. according to the Security Fix post they (Apple) say…
“Basically, what happened is SecureWorks approached Apple with a potential flaw that they felt would affect the wireless drivers on Macs, but they didn’t supply us with any information to allow us to identify a specific problem. So we initiated our own internal product audit, and in the course of doing so found these flaws.”
–Update 10/1/06–
This is still an ongoing controversy. There definitely appears to be bad blood, it’ll continue to be interesting to follow this one.