Rumor has it Apple will release iOS 4.3.1 in the
next few weeks to close security holes, including the one in Safari
mobile Web browser that allowed Charlie Miller to crack the iPhone
during the recent Pwn2Own hacking contest.
At the same time the rumor made the rounds, Apple
released OS X 10.6.7, which fixed another Safari vulnerability Miller
had found for the Safari browser, but had not gotten a chance to demonstrate at the contest.
“OS X 10.6.7 is out, fixes our pwn2own bug, but
bug is still in latest iOS for a while longer, nice patch
coordination,” Miller wrote on Twitter on March 21.
This update is especially important for owners of
the new MacBook Pro systems because it fixes the graphics bug that
caused hangs and crashes under heavy graphics load, Apple said. This
update “improves graphics stability and external display compatibility”
in the new systems, Apple said.
Accessible on Software Update, OS X 10.6.7 is
available for both the client and server versions of the operating
system and as either delta or “combo” updaters, Apple said. It also
addresses the numerous security flaws with built-in services, system
utilities and core details such as the kernel and filesystem handling.
Left unpatched, attackers would have been able to access restricted
files, remotely execute code, or change system configuration, Apple
said. The update also fixed “Back to My Mac” remote connectivity
technology’s reliability issues and fixed bugs in Windows file sharing
Samba.
The minor update for the iPhone and iPad’s operating system will arrive in one or two weeks, according to Boy Genius Report,
a site that focuses on communications and consumer electronics, on
March 21. The update will contain “minor bug fixes,” as well address
Miller’s Safari mobile Web browser flaw and the iPad2’s jailbreak
vulnerability, BGR said.
Charlie Miller and Dion Blazakis, researchers from
Baltimore-based Independent Security Evaluators, exploited Apple’s
Safari mobile browser on an iPhone with a drive-by-exploit at CanSecWest’s Pwn2Own
hacking contest on March 10. The hacked phone had iOS 4.2.1, but Miller
had said the flaw still existed in iOS 4.3, which had been released
just the day before.
Under contest rules, HP TippingPoint, the
contest’s sponsor, shared the details of the exploit with Apple, and it
is reportedly fixed in 4.3.1.
Apple is also moving quickly to address jailbreak
issues. Three days after the iPad 2 was released, developer “Comex”
announced on Twitter that he had jailbroken the device remotely and
loaded Cydia, an application that allows users to find and download
jailbroken apps for iOS devices. The 4.3.1 update will close the new
tablet’s jailbreak flaw, BGR reported.
Along with Baseband updates for the iPhone 3GS and
the iPad, this new release will also fix the bug with memory hanging
and being corrupted when reading large files from the USIM filesystem,
the NTLM authentication problems in apps and on Web sites, and the
issue of Springboard and third-party apps not recognizing the gyroscope
on the iPad2, BGR said.
BGR’s wireless carrier sources have been fairly
accurate in forecasting iOS updates in the past. The site was only off
by a day when it predicted the iOS 4.3’s early release earlier this
month.
The exact date remains unclear, and BGR’s sources
did not know whether the update will be made for Verizon customers as
well. Verizon’s customers are still on iOS 4.2.
IT Security & Network Security News & Reviews News & Reviews 
