Apple delivers prodigious patch batch for iPhone with OS update
Fixes 46 flaws, including bug that 'Pwn2Own' hacker used to win $5K in March
Computerworld - Apple yesterday patched 46 security vulnerabilities, half of them in the Safari browser and its WebKit rendering engine, for the iPhone and iPod Touch as it released iPhone OS 3.0.
The company fixed nearly four times the number of flaws Wednesday than when it last patched the iPhone software. In November 2008, Apple issued a security update alongside iPhone 2.2 that plugged 12 holes.
Almost half of the vulnerabilities -- 21 all told -- were tagged with Apple's usual "arbitrary code execution" phrase, lingo that essentially means that the bug is critical and could be used to compromise the device. Unlike other major software makers, such as rival operating system developer Microsoft and database giant Oracle, Apple doesn't rank vulnerabilities using a scoring system.
Not surprisingly, 50% of the patches apply to bugs in Safari, the iPhone and iPod Touch's browser, or WebKit, the open-source browser engine that Apple uses as Safari's foundation. Safari and WebKit have been the focus of most research into iPhone hacks. The first reported iPhone bug, for example, was a Safari flaw found by a trio of researchers, including Charlie Miller, formerly with the National Security Agency, in July 2007.
One of the WebKit vulnerabilities stands out because of the attention it received in March, when a German college student, who gave only his first name, Nils, walked away with a $5,000 cash prize for hacking Safari at the "Pwn2Own" challenge. Nils used a bug in WebKit's handling of SVGList objects to crack Safari.
Nils' WebKit bug was first patched in a massive 67-flaw fix issued in mid-May for Mac OS X; today Apple patched the same vulnerability in the iPhone's operating system.
Apple addressed eight bugs in CoreGraphics, five in the XML library, two in the iPhone's e-mail client, and other flaws in ImageIO, IPSec and Unicode components of the operating system. The update also patches a vulnerability in how the iPhone connects to Microsoft Exchange servers, which could be exploited to steal data or gain access to the iPhone's Exchange account.
iPhone 3.0, which contains the 46 patches, can be downloaded by connecting the iPhone or iPod Touch to its sync PC or Mac, running iTunes, clicking on the device in the listing on the left and then clicking the "Check for Update" button.
Apple iPhone 3.0
- Opinion: The 5 best things about iPhone OS 3.0
- Apple delivers iPhone OS 3.0 update on schedule
- Your next iPhone: iPhone 3.0 update or iPhone 3G S?
- FAQ: What iPhone 3.0 means to you
- Palm Pre vs iPhone 3.0 vs Blackberry Storm 2
- Instant analysis: With iPhone OS 3.0, Apple opens the creativity coffers
- Apple struts iPhone 3.0, touts 100 new features
- iPhone 3.0 preview sways 20% of cell phone owners to buy Apple
Read more about Security in Computerworld's Security Topic Center.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts