Apple patches critical 'gotofail' bug with Mavericks update

Ships OS X 10.9.2 with nearly three-dozen security fixes; adds FaceTime audio calls

Apple today updated OX Mavericks, plugging the embarrassing security hole the Cupertino, Calif. company left wide open in the operating system's implementation of basic Internet encryption.

Mac users running Mavericks should update as soon as possible, as exploit code has already begun circulating on the Internet.

OS X 10.9.2, which weighed in at between 460MB and 860MB for the download, patched the vulnerability, according to tests conducted by Computerworld using the website, which indicated that Safari was again secure.

The update, the first since mid-December, patched 32 other vulnerabilities in various versions of OS X, including six in QuickTime, Apple's media player, and more disturbing, four bugs that could be used by attackers to bypass the application "sandbox," an isolation technology designed to minimize damage when malware does make it onto a Mac.

But CVE-2014-1266, the identifier for the bug in Mavericks' handling of SSL (secure socket layer) and TLS (transport layer security), was the one that stood out. Those protocols create an encrypted connection between a personal computer and a server -- such as one at -- so that snoopers cannot read the traffic and extract information like credit card numbers or log-in credentials.

The flaw had been dubbed the "gotofail" bug because Apple left an extraneous "goto" command in the code that validated SSL certificates, a monumental oversight that many security experts blasted Apple for not catching during development and testing, or in the 16 months since the release of iOS 6, where it first appeared.

Apple took heat for the delay in patching Mavericks; it issued updates for iOS 6 and iOS 7 on Feb. 21 that plugged the gotofail hole.

"How difficult is it to release for OS X?" asked Andrew Storms, director of DevOps at security firm CloudPassage, in an interview yesterday. "Shouldn't it have been out an hour later?"

Storms defended his criticism, and that of other security professionals. "We all know what happens. Whenever patches don't appear simultaneously, attackers mine it in one version for others. It's the gateway for finding the bug," Storms said.

In a separate security-only update, Apple patched four vulnerabilities in 2012's Safari 6, pushing the version number to 6.1.2. Safari 6 is the most current edition of Apple's browser for OS X 10.7, aka Lion, and OS X 10.8, or Mountain Lion. Those flaws were also fixed in Safari 7, taking it up to 7.0.2, for Mavericks, which was included with the 10.9.2 update.

Along with the vulnerability patches in OS X 10.9.2, Apple also provided several non-security fixes to deal with reliability, stability and performance issues, as well as a few that beefed up some integrated features and tools.

Mac users can now make and take audio-only calls using FaceTime, OS X's built-in video conferencing software, and block incoming iMessages from individual users. iMessages is the Mac's integrated chat and texting client that lets users bypass carriers' SMS fees when sending and receiving messages to and from iOS and OS X devices.

OS X 10.9.2 addressed other problems as well, resolving one that prevented Mail from receiving some email messages; fixing another that erratically disconnected VPN (virtual private network) connections, which are often used by workers to connect to their businesses' networks; and tackling two related to how Mail handled Google Gmail mailboxes and message labels.

Apple posted a longer list of 10.9.2's contents on its website.

OS X 10.9.2 and Safari 6.1.2 can be retrieved by selecting "Software Update..." from the Apple menu, or by opening the Mac App Store application and clicking the Update icon at the top right. Mavericks 10.9.2 can also be downloaded manually from Apple's support site., one of several online tests sites, with OS X 10.9.2's Safarishows that Apple fixed the embarrassing flaw.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His email address is

Read more about security in Computerworld's Security Topic Center.

Join the CSO newsletter!

Error: Please check your email address.

Tags Cybercrime and HackingAppleamazon.comsecurityMalware and Vulnerabilities

More about Amazon.comAmazon Web ServicesAndrew Corporation (Australia)AppleFaceTimeGoogleMicrosoftTopic

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Gregg Keizer

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place