Apple updates iPhone, iPad for "jailbreak" flaw

Powered by SC Magazine
 

Flaw could lead to arbitrary code execution.

Apple has issued updates for its iOS mobile operating system to fix a vulnerability being widely used to jailbreak the latest iPhone. The updated operating system versions are iOS 4.0.2 for iPhone and iPod Touch devices, and iOS 3.2.2 for iPad devices.

The updates fix a stack buffer overflow vulnerability in the way Mobile Safari handles PDF files on iOS-powered devices, according to Apple's advisories. The flaw came to light last week when a group, called the Dev-Team, released hack details on the website JailbreakMe.com.

The site showed users how to jailbreak their iPhone, iPad and iPod Touch devices, which enables them to install unapproved applications.

Researchers have warned that while the jailbreak hack was not malicious, the same Mobile Safari flaw could easily be used to craft a more malevolent attack.

“Although we haven't yet seen malicious attacks via the jailbreakme vulnerability, we recommend to install the patch right away,” researchers at anti-virus firm F-secure wrote in a blog post.

The flaw could lead to arbitrary code execution by viewing a PDF document with maliciously crafted embedded fonts, according to Apple's advisories.

Meanwhile, the iOS updates also fix an integer overflow flaw that could allow malicious code to gain system privileges.

The updates can be downloaded and installed using iTunes.

See original article on scmagazineus.com

Copyright © SC Magazine, US edition


Apple updates iPhone, iPad for "jailbreak" flaw
 
 
 
Top Stories
Parliament passes law to let ASIO tap entire internet
Greens effort to limit devices fails.
 
Business-focused Windows 10 brings back the Start menu
Microsoft skips 9 for the "greatest enterprise platform ever".
 
Feeling Shellshocked?
Stay up to date with patching for the Bash bug.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  65%
 
Advanced persistent threats
  5%
 
Unpatched or unsupported software vulnerabilities
  11%
 
Denial of service attacks
  6%
 
Insider threats
  12%
TOTAL VOTES: 1382

Vote