Honourable mention for a strong and swift [PS] response to security announcements. Apple has released fixes for various problems with Airport firmware, whose vulnerabilities date back to 2008. You can read the full announcement at: http://support.apple.com/kb/HT4298
My unsanitised FTP PORT command problem (thanks for credit Apple, but which I have long since dealt with by not running an FTP server behind a Time Capsule) was nine months old. I couldn't find the reference for the latest CVE, but it seems to be for a month ago. A happy day. :-) Cheers, Sabahattin PS: If anybody at Apple, or anybody with a humour impairment, should read this, it's a joke, dammit. Of course I'm happy they've honoured the problems. I'm almost sure they feel the same way I do about the whole thing, though. I mean, the CVE comes out, they put an autoresponder in front of the security contact (which takes the form of a person using copy and paste) and nothing happens - either they just genuinely don't care for the severity of the problems (can you imagine Cisco doing that?!!), or they're too busy releasing shiny new iGadgets to put most of these little problems aside as minor inconveniences. But until they remedy that, they won't get these things into business. Which, FTR, I think would be a big shame. No, seriously - there's something badly, badly wrong when you have to time your security announcements so that their availability heralds a new product release. :-( _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
