Apple today released security updates for Mac OS X 10.7.1, Mac OS X 10.7.1 Server, Mac OS X 10.6.8, and Mac OS X 10.6.8 Server operating systems. The less than 200K patch removes the “DigiNotar” certificates from the Trust list in the Safari web browser. Mozilla Firefox, Google Chrome, and Microsoft Explorer (Windows) were patched last week.
Digital certificates – SSL (Secure Sockets Layer) and EVSSL (Extended Validation) – are issued by various certificate authorities (VeriSign and Thawte are two notable ones) which are validated by Web browsers to verify that you are not visiting a fake website trying to appear legitimate.
You can view what certificates are trusted by your browsers in the respective application’s “View Certificates” pane or via the Apple utility Keychain Access.
Last month, it was revealed that DigiNotar, a Dutch company, was hacked to issue hundreds of fraudulent certificates issued for various Web companies to unknown recipients in foreign countries. These certificates were used to launch various attacks on the Web companies’ services. With these certificates in place, a hacker with a privileged network position may intercept user credentials or other sensitive information.
In the release notes, Apple commented, “This issue is addressed by removing DigiNotar from the list of trusted root certificates, from the list of Extended Validation (EV) certificate authorities, and by configuring default system trust settings so that DigiNotar’s certificates, including those issued by other authorities, are not trusted.”
The update can be applied via Software Update or downloaded separately.




