Safari – Phocean.net / Computer Security Blog Fri, 24 Feb 2017 21:17:51 +0000 en-US hourly 1 https://wordpress.org/?v=4.9.10 CVE-2009-3555: Safari, fix reached Mountain Lion… /2012/08/13/cve-2009-3555-safari-fix-reached-mountain-lion.html Mon, 13 Aug 2012 17:53:15 +0000 http://www.phocean.net/?p=1348 http://www.phocean.net/?p=1348 Continue Reading]]> I haven’t investigated much (and I will not more), but since my upgrade to Mac OS 10.8 (Mountain Lion), Safari supports safe renegociation.

Meanwhile, I had received a laconic answer from Apple to my bug report saying that they “are aware of this issue”.

Note that Safari 6.0 on Lion did not (at least on my computer, if someone could confirm)… so same browser version, different OS, the system SSL library must have been – silently – updated.

Anyway, good move finally.

]]> CVE-2009-3555: Safari not yet patched ??? /2012/06/10/cve-2009-3555-safari-not-yet-patched.html Sun, 10 Jun 2012 18:17:59 +0000 http://www.phocean.net/?p=1249 http://www.phocean.net/?p=1249 Continue Reading]]> The other day I was shocked to find this entry in my Apache logs:

[error] SSL Library Error: 336068931 error:14080143:SSL routines:SSL3_ACCEPT:unsafe legacy renegotiation disabled

It occurs appears when I try to use a SSL client certificate with Safari. Of course, authentication is broken as it just fails on an 403 error page.

So it seems that Safari is the last browser which was not patched against CVE-2009-3555 !

2009 !! At least, I quickly checked the other browsers I had around and they were fine: IE, Firefox, Chrome… I am having an issue with Opera also, but although I have not identified the problem yet, it seems unrelated (and does not throw the same error).

Note that I reported the issue to Apple, but I did not receive any answer. Silence on the wire.

]]>