Just FYI, APPLE-SA-2010-12-16-1 Released for Airport Firmware

[Sabahattin Gucukoglu <mail () sabahattin-gucukoglu com>]

Honourable mention for a strong and swift [PS] response to security announcements.  Apple has released fixes for 
various problems with Airport firmware, whose vulnerabilities date back to 2008.  You can read the full announcement at:
http://support.apple.com/kb/HT4298

My unsanitised FTP PORT command problem (thanks for credit Apple, but which I have long since dealt with by not running 
an FTP server behind a Time Capsule) was nine months old.  I couldn't find the reference for the latest CVE, but it 
seems to be for a month ago.

A happy day. :-)

Cheers,
Sabahattin

PS: If anybody at Apple, or anybody with a humour impairment, should read this, it's a joke, dammit.  Of course I'm 
happy they've honoured the problems.  I'm almost sure they feel the same way I do about the whole thing, though.  I 
mean, the CVE comes out, they put an autoresponder in front of the security contact (which takes the form of a person 
using copy and paste) and nothing happens - either they just genuinely don't care for the severity of the problems (can 
you imagine Cisco doing that?!!), or they're too busy releasing shiny new iGadgets to put most of these little problems 
aside as minor inconveniences.  But until they remedy that, they won't get these things into business.  Which, FTR, I 
think would be a big shame.  No, seriously - there's something badly, badly wrong when you have to time your security 
announcements so that their availability heralds a new product release. :-(

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/