{"id":24832,"date":"2014-04-22T16:15:54","date_gmt":"2014-04-22T23:15:54","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=24832"},"modified":"2016-10-06T12:41:20","modified_gmt":"2016-10-06T19:41:20","slug":"apple-releases-airport-base-station-firmware-update-7-7-3-addresses-heartbleed-bug","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/apple-releases-airport-base-station-firmware-update-7-7-3-addresses-heartbleed-bug\/","title":{"rendered":"Apple Releases AirPort Base Station Firmware Update 7.7.3, Addresses Heartbleed Bug"},"content":{"rendered":"

\"airport\"<\/a>Apple has released AirPort Base Station Firmware Update 7.7.3, addressing the Heartbleed bug<\/a>, which may allow an attacker in a privileged network position to obtain memory contents.<\/p>\n

According to the Apple security team, “An out-of-bounds read issue existed in the OpenSSL library when handling TLS heartbeat extension packets. An attacker in a privileged network position could obtain information from process memory.”<\/p>\n

This update is available for: AirPort Extreme and AirPort Time Capsule base stations with 802.11ac.<\/p>\n

Apple’s AirPort Base Station Firmware Update 7.7.3\u00a0mitigates the following vulnerability:<\/p>\n

CVE-2014-0160<\/a> :\u00a0The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.<\/p>\n

 <\/p>\n

This issue was addressed through additional bounds checking. Only AirPort Extreme and AirPort Time Capsule base stations with 802.11ac are affected, and only if they have Back to My Mac or Send Diagnostics enabled. Other AirPort base stations are not impacted by this issue.<\/p><\/blockquote>\n

Firmware version 7.7.3 is installed on AirPort Extreme or AirPort\u00a0Time Capsule base stations with 802.11ac using AirPort Utility for\u00a0Mac<\/a> or iOS. (AirPort Utility for iOS\u00a0is a free download from the App Store.)\u00a0Use AirPort Utility 6.3.1 or later on OS X, or AirPort Utility 1.3.1\u00a0or later on iOS to upgrade to Firmware version 7.7.3.<\/p>\n","protected":false},"excerpt":{"rendered":"

Apple has released AirPort Base Station Firmware Update 7.7.3, addressing the Heartbleed bug, which may allow an attacker in a privileged network position to obtain memory contents. According to the Apple security team, “An out-of-bounds read issue existed in the OpenSSL library when handling TLS heartbeat extension packets. An attacker in a privileged network position […]<\/p>\n","protected":false},"author":4,"featured_media":8813,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[19,3151,949,967],"class_list":["post-24832","post","type-post","status-publish","format-standard","has-post-thumbnail","category-security-news","tag-airport","tag-apple","tag-cve-2014-0160","tag-firmware-update-7-7-3"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t