Apple Fixes iOS PDF Security Hole With iOS 4.0.2 and 3.2.2

[sticky.chicken]

Apple don´t ban jailbreak. They solve a security issue.

Precisely.

My old iPhone 3G is jailbroken and uses ultrasn0w for a carrier unlock. I bought my iPhone 4 carrier unlocked from Apple directly, and I can't see a reason at the moment to jailbreak it.

I'm not against jailbreaking, I just don't have a need for it personally, and I am glad that Apple are fixing security issues.

 

[bobthedino]

Apparently done.
There's a discussion at Redhat talking about using Apple's fix.
https://bugzilla.redhat.com/show_bug.cgi?id=621144

Makes you wonder why Apple is using FreeType at all... surely they have their own font rendering library?!

 

[KnightWRX]

Makes you wonder why Apple is using FreeType at all... surely they have their own font rendering library?!

Because FreeType is fast, works and reinventing the wheel is a big waste of time ?

Bugs happen, they get fixed. Open source provides a lot of advantages for companies like Apple.

 

[SayaSe]

Makes sense to download 367MB to fix one hole... Yes I have uncapped broadband. Get your act together, Apple.

 

[jayducharme]

I plugged my phone in, hit the update button and was finished within a matter of 5 minutes. I'm sure the time it took you to log into the forum and post, you could have updated the software on your iPod.

I'm on DSL. I plugged my iPhone in and waited about 15 minutes as the 500mb+ download chugged along. The estimated time for completing the download was 4 hours. That's why many people won't bother with it.

 

[nascimento]

Should I assume the iPhone 3G is still nearly useless under this update?

BTW, Apple, your Start page still says, "iOS 4.0.1 Software Update - Download it now."

YES

You should assume that the 3G Iphones are still hellishly laggy. I had a glimmer pf hope that this update would address the problems that we 3G users have been having with IOS4 but after the long and time consuming update everything is the same

What on earth is going on with Apple, problems with a brand new phone, millions of discontent 3G owners.

 

[SayaSe]

You should assume that the 3G Iphones are still hellishly laggy.

Disable Spotlight.

 

[subsonix]

That was pretty fast, this is good news.

 

[nascimento]

Disable Spotlight.

Done that ages ago...

At the moment I am more likely to just send this laggy, jerky piece of junk to be recycled thats how angry I am.

 

[pmjoe]

I think one can come to the conclusion at this point that Apple INTENTIONALLY crippled possibly over a million iPhone 3G's.

It has been over a month and a half and, as far as I know, Apple has never officially acknowledged there is a problem (they've only acknowledged indirectly to being "aware of the reports" and "looking into the matter"). I have read stories of people going to the Genius Bar at Apple stores, and they basically tell you to "upgrade" to a new phone (or if you're in warranty, some have received a new phone with OS 3). Read many threads on this issue, and much like me, most users experience missed calls and are using their phones less due to significantly degraded performance. At least some people post that the issue caused them to upgrade to the iPhone 4. Despite all of this, Apple still encourages 3G owners to upgrade to iOS 4.

Apple's actions here border on criminal. Folks, our next step is to individually make sure you have reported the issue to Apple through an official channel, then immediately contact the Attorney General in your state.

 

[rochford]

Should I assume the iPhone 3G is still nearly useless under this update?

Happily not the case, my 3G's been crawling along through IOS 4.0/4.1, but now its as fast, if not faster, than I remember from 2 years ago. Good to see there's still some legacy support.

Mind you my Mac Plus (which I still have), bought mid 1986 was still supported up to System 7.5.5 - System 7.6 was released on Jan 7 1997, nearly 11 years later. Pretty sure I'll have a new phone by 2019!
———————————————————————
Just read comments above…that's not what I'm finding, good speed now.

 

[skidbubble]

Too bad it takes a full image to update a tiny bug. I'll be updating when I get home.

Agreed. It hasn't even been a month since the last update, half a gigabyte for a little .gif file just to change the # of bars displayed. Not everyone likes the bohemoth sized downloads. It's getting tiresome.

 

[markfc]

I'm glad 4.02 is out. I've been waiting to update so I can "unjailbreak" my phone without resorting to a restore.

The jailbreakme was really messing with my wireless network connections, could only browse for 5 minutes at a time before data would just stop requiring a reboot to make it work again.

I'm happy again.

 

[fsck-y dingo]

I think it's great that Apple fixed the security hole. What I don't like is how they left older models of their hardware still vulnerable.

Leave it to Saurik to fix all idevices and not just recent models. With a 5k sized patch too.

https://forums.macrumors.com/threads/991858/

Basically what Apple's neglect has done is to force those with a 2G iPhone or 1G iPod Touch to jailbreak in order to be protected.

 

[rhett7660]

I wish they cared more about the proxy sensor than fixing a stupid jailbreaking hole. Thanks apple, always thinking about the customers.

Once again, an Apple user who has no idea what this hole could do. You are right Apple isn't thinking about the customer on this one.

 

[tblrsa]

Basically what Apple's neglect has done is to force those with a 2G iPhone or 1G iPod Touch to jailbreak in order to be protected.

Yeah, i honestly can´t understand this move by Apple. They should´ve fixed all of their devices. 4.0.2 is running great though, has anybody already jailbroken it?

 

[joseph2166]

I'm probably not going to JB, but in case I do, I'm not upgrading!

Thanks for keeping us up to date with your iPhone intentions.

 

[Rodimus Prime]

I will say this update or more so the length of time it took apple to get out a fix for this update is the reason why apple is rated very poorly in security.

The key rating number is not the number of fix but the number or zero day holes found and then the length of time it takes to get a patch out for them. Apple is rated pretty poorly in both those areas.

 

[fsck-y dingo]

Yeah, i honestly can´t understand this move by Apple. They should´ve fixed all of their devices. 4.0.2 is running great though, has anybody already jailbroken it?

No. The next jailbreak will most likely be for 4.1 since the 4.1 beta 3 is already out and the final release is expected in September or October.

The only difference between 4.0.1 and 4.0.2 is the security patch and that's availible with a jailbroken phone on 4.0.1 and the new fix by Saurik.

 

[Daveoc64]

I think it's great that Apple fixed the security hole. What I don't like is how they left older models of their hardware still vulnerable.

It is a little odd.

When they released 2.0 for the iPod touch as a paid upgrade, they issued a 1.1.5 update so that people who hadn't paid to upgrade weren't exposed to security issues that had been fixed in that release.

I kinda expected the same to happen with 3.x.x on the first generation devices - they might still do that, but at less frequent intervals.

Apple doesn't publish support life-cycles (as far as I know), so all we have to go on is the precedent they've set with the iPhone releases to date (three major software releases per phone - including the one it ships with).

 

[tblrsa]

No. The next jailbreak will most likely be for 4.1 since the 4.1 beta 3 is already out and the final release is expected in September or October.

The only difference between 4.0.1 and 4.0.2 is the security patch and that's availible with a jailbroken phone on 4.0.1 and the new fix by Saurik.

Anyone tried this method on his 3G? They say it jailbreaks 4.0.2 on older devices, not on the iPhone 4 though.

http://www.redmondpie.com/jailbreak-ios-4.0.2-with-redsn0w-how-to-guide/

 

[tempusfugit]

Cydia's 5 kb patch for this exploit = major win.

Apple's 579 mb 4.0.2 = major pain.

 

[SpinThis!]

All they need is to get you to visit a website.

Yeh you don't even need to be fooled. One method is simply dns trickery. Someone gets access to a popular hotspot or even your own and sets the dns servers to their own; you do a google search for anything and that would bring up the hackers' google instead. The page looks normal except for the embedded pdf -5000px off to the left. You might never even know you were hacked until it was too late.

 

[Daveoc64]

Yeh you don't even need to be fooled. One method is simply dns trickery. Someone gets access to a popular hotspot or even your own and sets the dns servers to their own; you do a google search for anything and that would bring up the hackers' google instead. The page looks normal except for the embedded pdf -5000px off to the left. You might never even know you were hacked until it was too late.

Yes, because that's incredibly "simple".

1) How often does this happen with exploits for Windows? - virtually never.

2) How likely is it that someone would go to all that trouble for an iPhone exploit? - not likely.

 

[tblrsa]

Cydia's 5 kb patch for this exploit = major win.

Apple's 579 mb 4.0.2 = major pain.

Apple always provides a full firmware download. Nothing new here.