About the security content of Xcode 4.4

This document describes the security content of Xcode 4.4.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see "How to use the Apple Product Security PGP Key."

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see "Apple Security Updates".

Xcode 4.4

• neon

  Available for: OS X Lion v10.7.4 and later

  Impact: An attacker may be able to decrypt data protected by SSL

  Description: There are known attacks on the confidentiality of SSL 3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. The neon library (used by Subversion) disabled the 'empty fragment' countermeasure which prevented these attacks. This issue is addressed by enabling the countermeasure.

  CVE-ID

  CVE-2011-3389

• Xcode

  Available for: OS X Lion v10.7.4 and later

  Impact: Helper tools built with Xcode allow any App Store application to read their keychain entries

  Description: All signed programs contain a designated requirement (DR) which states, from the perspective of the developer of the program, what constraints a program needs to satisfy in order to be considered an instance of this program. When a Developer ID was used with Xcode to sign a product that did not have a bundle identifier, such as a command-line tool or an embedded helper, the generated DR for the product did not include the developer's ID in the part of the DR that applies to apps signed by the App Store. As a result, any App Store app may have accessed keychain items created by the product. This is addressed by generating a DR with improved checks. Affected products need to be re-signed with this version of Xcode to include the improved DR.

  CVE-ID

  CVE-2012-3698