Apple dumped four separate updates to patch a slew of security holes, ranging from WebKit vulnerabilities discovered at Pwn2Own and the SSL certificates issue for iOS, Safari and Mac OS X.
customers finally get some patching love from Apple as the company dropped
updates for all iOS devices, Safari and MacOS X-addressing several Pwn2Own bugs
and the Comodo breach.
announced new iOS updates for all its mobile devices, updated the digital
certificates policy on the Mac OS X, patched WebKit issues in its Safari Web
browser and released the Xcode tool for developers on April 13. The last minor
update, iOS 4.3.1, was on March 22.
The iOS 4.3.2
is available for GSM iPhones, third- and fourth-generation iPod Touches,
original iPad and iPad2. A separate update, iOS 4.2.7, applies only for the
CDMA (Code Division Multiple Access) iPhone available through Verizon. The
fixes in iOS 4.2.7 are equivalent to the ones in iOS 4.3.2 for the GSM devices.
iPhone owners will see the iOS 4.2.7 update in iTunes.
security holes were fixed in iOS
, including several that had been identified during the
CanSecWest Pwn2Own hacking contest in early March. The MobileSafari
vulnerability, identified by Charlie Miller and Dion Blazakis under HP
TippingPoint's Zero-Day Initiative, caused an unexpected application
termination or arbitrary code execution when viewing a malicious Microsoft
fixed two additional WebKit vulnerabilities identified under the Zero-Day
Initiative, which also resulted in unexpected application termination or
arbitrary code execution when the user visited a malicious Website. The Webkit
flaws were discovered by Vupen Security and by members of TeamAnon, Vincenzo
Iozzo, Willem Pinckaers, Ralf-Phillipp Weinmann and "an anonymous researcher."
TeamAnon's WebKit bug had been used to compromise
at the hacking contest and Vupen's bug cracked
Safari on Mac OS X
vulnerabilities were also fixed as part of Safari 5.0.5
, also available.
fixed a flaw in libxslt that could be exploited by a malicious Website. This
flaw was identified by a member of the Google Chrome team.
the screen-freezing issue that was occurring for users during Facetime chats
and the bug that prevented iPads from connecting to international 3G networks
in 4.3.2. It is unclear whether the battery-life issues experienced by users
who upgraded to 4.3 have been fixed in this release.
referenced its Certificates Trust Policy in all of the updates. In light of the
recent Comodo incident where nine fraudulent SSL (Secure Sockets Layer) certificates
were mistakenly issued by a Comodo partner for several popular Websites, Apple
noted that attackers could have performed man-in-the-middle attacks to redirect
connections and to intercept sensitive user data.
invalidated the certificates immediately and major browser makers pushed out
updates to ensure the invalid certificates were blocked.
finally addressed the issue for Safari on Mac OS X with Security Update 2011-002
OS X 10.5.8 (Leopard) and 10.6.7 (Snow Leopard). On Windows, Safari relies on
the host operating system's certificate store to determine the validity of a
digital certificate so users should follow the instructions provided by
Microsoft, Apple said in the advisory.
The iOS 4.3.2
addressed the SSL certificates issue for mobile devices, according to the advisory.