Apple security update addresses DigiNotar certificates

By on September 9, 2011, 6:00 PM

Apple has issued an update for Mac OS X 10.7 Lion and 10.6 Snow Leopard systems that addresses the recent security breach involving DigiNotar's fake SSL certificates. The patch removes DigiNotar from the list of trusted root certificates, the list of Extended Validation certificate authorities and configures the default system trust settings so that DigiNotar's certificates, including those issued by other authorities, are not trusted.

DigiNotar is one of several firms that are authorized to issue digital certificates used to verify the identity of a website. On August 30 the Dutch company announced that its servers had been compromised and that fake certificates might have leaked into the wild. It's been suggested that more than 500 fake certificates have been issued so far, including certificates for Microsoft, Facebook, Twitter, and Google. An attacker using a stolen certificate could potentially gain access to intercept a user's credentials and sensitive information.

Web browsers including Firefox, Chrome and Opera were quickly updated following the breach to revoke all certificates issued by DigiNotar. Windows users also received an update shortly thereafter but Apple had so far remained quiet. Meanwhile, neither Google nor Apple have made any announcements regarding a patch for their mobile platforms.

Security Update 2011-005 is available to download via Software Update or through Apple's support site. The smallish download (188Kb - 15Mb) requires a restart and is recommended for all Mac users.




User Comments: 3

Got something to say? Post a comment
NTAPRO NTAPRO said:

Technology allowed nearly a fake of anything :|

Cota Cota said:

Bo who i still clean porn.exe, that i bet it scams more people =D

tonylukac said:

I just installed firefox 6.0.2 and it has like 5 Diginotar certificates. Wasn't the idea of the update from 6.0.0 to 6.0.2 to get rid of those certificates?

Load all comments...

Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.