Security News

Apple has released AirPort Base Station Firmware Update 7.7.3, addressing the Heartbleed bug, which may allow an attacker in a privileged network position to obtain memory contents.

According to the Apple security team, “An out-of-bounds read issue existed in the OpenSSL library when handling TLS heartbeat extension packets. An attacker in a privileged network position could obtain information from process memory.”

This update is available for: AirPort Extreme and AirPort Time Capsule base stations with 802.11ac.

Apple’s AirPort Base Station Firmware Update 7.7.3 mitigates the following vulnerability:

CVE-2014-0160 : The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

 

This issue was addressed through additional bounds checking. Only AirPort Extreme and AirPort Time Capsule base stations with 802.11ac are affected, and only if they have Back to My Mac or Send Diagnostics enabled. Other AirPort base stations are not impacted by this issue.

Firmware version 7.7.3 is installed on AirPort Extreme or AirPort Time Capsule base stations with 802.11ac using AirPort Utility for Mac or iOS. (AirPort Utility for iOS is a free download from the App Store.) Use AirPort Utility 6.3.1 or later on OS X, or AirPort Utility 1.3.1 or later on iOS to upgrade to Firmware version 7.7.3.