Apple dumped four separate updates to patch a slew of security holes, ranging from WebKit vulnerabilities discovered at Pwn2Own and the SSL certificates issue for iOS, Safari and Mac OS X.
Verizon iPhone
customers finally get some patching love from Apple as the company dropped
updates for all iOS devices, Safari and MacOS X-addressing several Pwn2Own bugs
and the Comodo breach.
Apple
announced new iOS updates for all its mobile devices, updated the digital
certificates policy on the Mac OS X, patched WebKit issues in its Safari Web
browser and released the Xcode tool for developers on April 13. The last minor
update, iOS 4.3.1, was on March 22.
The iOS 4.3.2
is available for GSM iPhones, third- and fourth-generation iPod Touches,
original iPad and iPad2. A separate update, iOS 4.2.7, applies only for the
CDMA (Code Division Multiple Access) iPhone available through Verizon. The
fixes in iOS 4.2.7 are equivalent to the ones in iOS 4.3.2 for the GSM devices.
Only CDMA
iPhone owners will see the iOS 4.2.7 update in iTunes.
Several
security holes were fixed in
iOS
4.3.2/4.2.7, including several that had been identified during the
CanSecWest Pwn2Own hacking contest in early March. The MobileSafari
vulnerability, identified by Charlie Miller and Dion Blazakis under HP
TippingPoint's Zero-Day Initiative, caused an unexpected application
termination or arbitrary code execution when viewing a malicious Microsoft
Office file.
Apple also
fixed two additional WebKit vulnerabilities identified under the Zero-Day
Initiative, which also resulted in unexpected application termination or
arbitrary code execution when the user visited a malicious Website. The Webkit
flaws were discovered by Vupen Security and by members of TeamAnon, Vincenzo
Iozzo, Willem Pinckaers, Ralf-Phillipp Weinmann and "an anonymous researcher."
TeamAnon's WebKit bug had been used to
compromise
RIM's BlackBerry at the hacking contest and Vupen's bug
cracked
Safari on Mac OS X.
The WebKit
vulnerabilities were also fixed as part of
Safari 5.0.5, also available.
Apple also
fixed a flaw in libxslt that could be exploited by a malicious Website. This
flaw was identified by a member of the Google Chrome team.
Apple fixed
the screen-freezing issue that was occurring for users during Facetime chats
and the bug that prevented iPads from connecting to international 3G networks
in 4.3.2. It is unclear whether the battery-life issues experienced by users
who upgraded to 4.3 have been fixed in this release.
Apple
referenced its Certificates Trust Policy in all of the updates. In light of the
recent Comodo incident where nine fraudulent SSL (Secure Sockets Layer) certificates
were mistakenly issued by a Comodo partner for several popular Websites, Apple
noted that attackers could have performed man-in-the-middle attacks to redirect
connections and to intercept sensitive user data.
Comodo
invalidated the certificates immediately and major browser makers pushed out
updates to ensure the invalid certificates were blocked.
Apple has
finally addressed the issue for Safari on Mac OS X with
Security Update 2011-002 for Mac
OS X 10.5.8 (Leopard) and 10.6.7 (Snow Leopard). On Windows, Safari relies on
the host operating system's certificate store to determine the validity of a
digital certificate so users should follow the instructions provided by
Microsoft, Apple said in the advisory.
The iOS 4.3.2
addressed the SSL certificates issue for mobile devices, according to the advisory.
Email
Print
