Safari, iOS 6 flaws patched

By

Apple has fixed two critical vulnerabilities.

Apple has released updates to address flaws in its Safari 6 web browser and iOS 6 mobile operating system.

Safari, iOS 6 flaws patched

The fixes were made available last week and address two vulnerabilities in Safari 6.0.2.

The bugs, which lie in the open source WebKit web browser engine, could allow for “unexpected application termination or arbitrary code execution” if users visited a malicious website, according to Apple's summary of the flaws.

The browser update affects the OS X Lion and OS X Mountain Lion operating systems.

Updates for iOS 6.0.1 affecting iPhone 3GS, iPad 2 and the fourth-generation iPod Touch also addressed the same vulnerabilities, but for mobile users.

Other patches in iOS addressed a data disclosure bug, which could allow “maliciously crafted or compromised iOS applications” to determine addresses in the kernel, and a passcode-lock security issue, which could potentially allow attackers to bypass password requirements for Passbook – an iOS app that can store users' airline boarding passes, coupons, movie tickets, retailer reward cards and other mobile payment information.

Qualys CTO Wolfgang Kandek said the WebKit bugs represented the most widespread threat to users.

“When you use Safari or Google Chrome, for instance, you are using WebKit as its underpinning,” Kandek said. “The attacks would be through a website that has something malicious on there that knows about the vulnerability, and it could run something on your machine that wants to take control of it. You probably wouldn't even notice [malware] that had been installed on your machine, which could feed information to an attacker.”

Sophos senior security advisor Chester Wisniewski said the WebKit fix appeared most critical.

“From a critical standpoint, I'd rate the WebKit issues highest because they affect Safari, Google Chrome and mobile users – and allow attackers to launch a drive-by exploit, which are most likely to be used by an attacker.”  

This article originally appeared at scmagazineus.com

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

CBA looks to GenAI to assist 1200 'security champions'

CBA looks to GenAI to assist 1200 'security champions'

NSW Police to embark on $126m IT overhaul

NSW Police to embark on $126m IT overhaul

Australia's super funds told to assess authentication controls

Australia's super funds told to assess authentication controls

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Log In

  |  Forgot your password?