Apple promises fix “very soon” for Macs with failed encryption (updated to include vulnerable apps)

Joseph Menn reports:

Apple Inc said on Saturday it would issue a software update “very soon” to cut off the ability of spies and hackers to grab email, financial information and other sensitive data from Mac computers.

Confirming researchers’ findings late Friday that a major security flaw in iPhones and iPads also appears in notebook and desktop machines running Mac OS X, Apple spokeswoman Trudy Muller told Reuters: “We are aware of this issue and already have a software fix that will be released very soon.”

Read more on Reuters.

Update: Ashkan Soltani posted an image showing apps that are vulnerable to the #gotofail problem: Calendar, FaceTime, Keynote, Mail, Twitter, iBooks, Software Update, and ApplePlusServices:

Here are some of the apps which rely on the vulnerable Apple #gotofail SSL library beyond Safari /cc @a_greenberg pic.twitter.com/ombDOOa01A

— ashkan soltani (@ashk4n) February 23, 2014

From Ashkan Soltani: In addition to Safari, here are some apps that rely on vulnerable #GoToFail SSL library.

See also Steve Bellovin’s comments on GoToFail.