Apple Fixes Heartbleed Bug in AirPort Extreme and Time Capsule

Back in early April Apple had told its key web-based services aren't affected by the Heartbleed security vulnerability, but it forgot to mention that some of its hardware — namely, the 2013 AirPort Extreme and Time Capsule — are vulnerable.

Now, the company has released a firmware update that fixes the issue for both products.

Apple describes the bug as follows:

"An out-of-bounds read issue existed in the OpenSSL library when handling TLS heartbeat extension packets. An attacker in a privileged network position could obtain information from process memory. This issue was addressed through additional bounds checking. Only AirPort Extreme and AirPort Time Capsule base stations with 802.11ac are affected, and only if they have Back to My Mac or Send Diagnostics enabled. Other AirPort base stations are not impacted by this issue."

In short, if you have an AirPort Extreme or an AirPort Time Capsule dating from June 2013 or later, you should apply the patch as soon as possible.

Heartbleed is a widespread bug in OpenSSL that allows an attacker to retrieve bits of data from the memory of systems protected by OpenSSL, potentially allowing him to steal passwords and other sensitive information. Most major web companies have announced a fix shortly after the news of the vulnerability went public.

Via 9to5Mac

Read full Article…

Android 4.1.1 Devices are Vulnerable to Heartbleed

It's not just websites and routers that are vulnerable to the web-wide bug Heartbleed — certain Android models are at risk too.

As Google noted in its own Heartbleed disclosures on Wednesday, Android devices running Android 4.1.1 Jelly Bean are vulnerable to Heartbleed. Google said patching information is being distributed to its Android partners.

So how many phones are still running Android 4.1.1? That's difficult to determine. Although 34.4% of Android devices are running Android Jelly Bean, Google doesn't break out how what percentage of users are on its various versions — 4.1.1 and 4.1.2.

The latest version of Jelly Bean is 4.1.2, which was released in October 2012.

A Google spokesperson confirmed to Bloomberg that there are "millions" of devices running Android 4.1.1.

Because Android updates are controlled by phone manufacturers and wireless carriers, it can be challenging to determine what versions of Android are available for various devices. We do know, however, that the HTC One S is running Android 4.1.1.

Heartbleed underscores what has long been one of Android's biggest problems: pushing out software updates to its myriad vendors. Android updates are the responsibility of the device maker, and often need to be approved by wireless carriers. The only exceptions are Google-made devices, such as the Nexus series and Google Play Edition phones.

Previous attempts at getting phone manufacturers and carriers to adopt Android updates have not met with success. If there is a silver lining to Heartbleed, it is that this might scare device makers into pay more attention to versions (and to put in better processes for security updates).

If you know your Android device is running Android 4.1.1, let us know the model and manufacturer in the comments, along with your wireless carrier. That will give us all a better sense of which companies are falling behind in the battle to patch Heartbleed.

Read full Article…