BugTraq
APPLE-SA-2014-10-20-2 Apple TV 7.0.1 Oct 20 2014 05:25PM
Apple Product Security (product-security-noreply lists apple com)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

APPLE-SA-2014-10-20-2 Apple TV 7.0.1

Apple TV 7.0.1 is now available and addresses the following:

Apple TV
Available for: Apple TV 3rd generation and later
Impact: A malicious Bluetooth input device may bypass pairing
Description: Unencrypted connections were permitted from Human
Interface Device-class Bluetooth Low Energy accessories. If a device
had paired with such an accessory, an attacker could spoof the
legitimate accessory to establish a connection. The issue was
addressed by denying unencrypted HID connections.
CVE-ID
CVE-2014-4428 : Mike Ryan of iSEC Partners

Apple TV
Available for: Apple TV 3rd generation and later
Impact: An attacker may be able to decrypt data protected by SSL
Description: There are known attacks on the confidentiality of SSL
3.0 when a cipher suite uses a block cipher in CBC mode. An attacker
could force the use of SSL 3.0, even when the server would support a
better TLS version, by blocking TLS 1.0 and higher connection
attempts. This issue was addressed by disabling CBC cipher suites
when TLS connection attempts fail.
CVE-ID
CVE-2014-3566 : Bodo Moeller, Thai Duong, and Krzysztof Kotowicz of
Google Security Team

Installation note:

Apple TV will periodically check for software updates. Alternatively,
you may manually check for software updates by selecting
"Settings -> General -> Update Software".

To check the current version of software, select
"Settings -> General -> About".

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT1222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org

iQIcBAEBAgAGBQJURUI7AAoJEBcWfLTuOo7ts5IP/1xFhDUXTw1ve/+JVh7JwPy8
KM7/Uir10DiV9YCf1h9mnDqqZNbc1uvWGRoLpJ8VHs01M3STAr5PKbO9FOhzNz2H
vLhl+YXRunwgfVr/tzW4YPeypkusGXF33ktIOwqLJqeIwoh0j2HDPE7eS9ZDJOvw
r8bB8eLbAHQqjQ1looMxH8WCXPb6pp8pgWkkakaM9ys4edQUqfoGa1fVQ6qks4KF
9/fXBp1mZuQDL7mZWDUnSoK91rLp9AKwQ/Gs3zJuXaliBKjF5XZK6bzCiKtqnzfV
YOstG8YO/KlCqtValNcmJV0DrUtdouPaU007QnzF9IjKdB8SR2iJsqyxrSdlyJ7e
X8kyDibE4Wh2hHf+9LqbfgXl8dBX4j1TXLv1wGmmPOC8UOISnLZyqn3ORtQSaD7k
DsFlXhLGys5KFRc3N6bQMank1Xw12fCh21y45jNxIpIhlcPj4kzcqqQ1KSoVo3Y2
bn46HxSFZTTHsnEESItqTbCnrdY0LTuVWa8qGklyuhB7wzLLUBbsee8KU4Eehzvs
9Edkr840rPpJ8Lswees8x+U0lJKMnBwxnlw7s4dOGhh5OtCPbuHKmTYagscdV+es
cV6LDDlGeWjOtLibk76jh5NmmfYeNmRs1l4iImgvsASIisqeIbrayoKtoLS+Q7jR
k6fRn81qCCJ+pSUCEkir
=q+7g
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org

iQIcBAEBAgAGBQJURUWcAAoJEBcWfLTuOo7t9xAP/1O+gqjt0DGxKt9/hFVSf8vB
QYqxli3GvMN4usipqx9T+TtR/OSQZl9CehMPqm1OJ2LXw1Xpirdn3IyJTuHOj7PO
3uJIJ7pnQM9gdRAQ3LnyNH5DMcTZyK9Dq/rDK/wiVjNSFiup6UHdcP+WKy9wMbGH
Iv3D5FPIoX2Zvd70eYdaYvxDc1WKJLaSQwjh8uVu8ODBz47fhiTua4GPiSomiHXu
fjMlkdsoAxjVGCzluNHBTGd68ysgnlCsx8G3VE3cwtjTCPjIX/vFDZd7C6QZ9HLL
yQUBOeYtG4rtgrTDgrqT5icw5f3Igp8RES/eG57V/nPKeNhW5waibh3VT/1fdYQd
KiEt6pWzFGMxCUzQCSp26bMAsZb8l6Izz6D/Lf/NBHjiPvpPHRQRH4sO1++pjEVY
Np6NBEHNVlQoo9YYeqHp2FKFqxOzc4Hvv0fxXH/XV4y81pXfWEDb7nZImtB717Xh
UE3JyB06SWNYTY/19oAkjUYS6hccrmuHh3W6V9GE45BsPvEqhn2gli3UV4hYNTj4
Q3h26A6oeKzXB+iq982nsv3dSbDWnQYSGNLzzDHsddQk6ieNcqwYSpAFKwZhSxBj
8dOzhFt0279nDvp51i/OusEXatiO6ng4yGr+x7A18WimoI73AggWGsNdlgC2zlvx
i/0wcbjFp+g8wMrxAomH
=Hlb0
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus