Apple Fixes iOS PDF Security Hole With iOS 4.0.2 and 3.2.2

[Mark Booth]

I shot this E-mail to Steve Jobs this AM:

Steve,

You promised the proximity sensor fix in the next update. 4.0.2 is here, no fix for the proximity sensor bug. I'm getting concerned that the rumors are true, and that it's a hardware bug that can't be fixed in firmware. Please reassure me.

Here's his reply:

Software update addressing this issue coming soon.

Mark

 

[chrissnv]

jailbreak is no longer illegal. it was pass in congress. so now anybody can jailbreak their iphone whatsoever. I don't understand why Apple took action like this. it will be trouble if anybody will argue with it near the future. then what Apple has done today would be illegal. they don't have a right to force something ban because they don't want. sometimes, they have to follow even though they don't agree. I'm done with Apple.

This comment is just dumb stupid and you have no idea at all. Apple fixed a security hole, they need to get a few things sorted out with the patching on iPhones (a 500MB download for a minor fix is a bit over the top). This security hole is a major one though as it allows code being run on your phone that stores private information, I am glad Apple fixed it. I am sad that it blocks the easy Jailbreak option (for those who really want it, it is uninteresting to me as I can do all I want to do with it), but to be honest I am sure there will be another easy option soon.

Again to bash Apple when they fix a security vulnerability is stupidity ... grow up.

 

[davidcarswell]

+++

The media hypes up the slightest Apple vulnerability like none other. However, on this occasion, when Apple has a legitimate, and serious vulnerability, there is almost no talk of it.

This is a huge bug, and probably a bigger danger than any other, that Apple has released.

I wouldn't be surprised if the guy who discovered it, figured that the best way to compromise all these people's phones was to first use it to jailbreak iPhones, therefore ensuring that people did not apply the patch when Apple released it, although Apple has done a good job of releasing a patch within about a week of knowing the problem.

Some people are alarmist fools. The guy who wrote the jailbreak is an awesome guy. He's well trusted and appreciated by the jailbreak community. And he works for free though many users have donated in thanks. The jailbreak store Cydia had a fix the day of the release to close the hole and secure the jailbreak phones. Comex also has other holes unrelated to the PDF exploit lined up for future jailbreaks. He won't be wasting one on this update which is strictly for the paranoid hallucinogenic. The jailbreakme site had full disclosure to what it was going to do prior to it starting the jailbreak. If you slide the slider to the right you allow and begin the jailbreak process. The jailbreak community is strong and does their best to make the jailbreak experience one without trouble. It's not likely that a threat will come from these wonderful and supportive group of people. Go ahead and update if you don't want to jailbreak. We don't want want your negative alarmist paranoid schitzo vibes in our community anyhow. Move on. Let it go. Red alert my ass.

 

[Ubuntu]

To people commenting on how slow Apple is with this I'd say its pretty fast compared to how they dealt with the iPhone 4 and iOS4 on iPhone 3Gs.

Oh wait, they didn't deal with the iPhone 3Gs yet.

 

[Crike .40]

Update didn't go so well on my iPhone. Said there was some internal error and now the phone is stuck in restore mode. Restoring it now and hopefully I can load all my stuff from the backup. This was on a non-jailbroken iPhone 4.

yes, same problem on my wife's new iPhone 4- - non-jailbroken as well. Have gone through several attempts, and have a genius bar appointment in an hour. I'll post again with the results from the apple store.

For those who care - here is the full list of the attempted fix:

“Download and install”
Leave plugged in - return to “The iphone could not be restored. An unknown error occurred (9).”
“More Information” “Show Details” “Disagree”
“iTunes has detected an iPhone in recovery mode. You must restore this iPhone before it can be used with iTunes.”
“OK” “Restore” “Restore and Update”
“The iphone could not be restored. An unknown error occurred (9).”
Restart computer. Check if itunes is updated (it is)
“iTunes has detected an iPhone in recovery mode. You must restore this iPhone before it can be used with iTunes.”
“OK” “Restore” “Restore and Update”
“The iphone could not be restored. An unknown error occurred (9).” Read apple support document online - suggests different computers/usb cables/usb ports
Try with different USB cable - same result
Try with different USB port - same result
Try on Mac Pro (different computer - both cables/multiple ports) - same result
Try on MacBook (different computer - both cables/multiple ports) - same result
Call AppleCare - closed
Call Apple Store The Oaks - told to hold both buttons until phone resets and reenters recovery mode - try again
Do as instructed - same result
Try on other 2 computers (both cables/many ports) - same result
Heading to Apple Store/"Genius" Bar

 

[davidcarswell]

yes, same problem on my wife's new iPhone 4- - non-jailbroken as well. Have gone through several attempts, and have a genius bar appointment in an hour. I'll post again with the results from the apple store.

For those who care - here is the full list of the attempted fix:

“Download and install”
Leave plugged in - return to “The iphone could not be restored. An unknown error occurred (9).”
“More Information” “Show Details” “Disagree”
“iTunes has detected an iPhone in recovery mode. You must restore this iPhone before it can be used with iTunes.”
“OK” “Restore” “Restore and Update”
“The iphone could not be restored. An unknown error occurred (9).”
Restart computer. Check if itunes is updated (it is)
“iTunes has detected an iPhone in recovery mode. You must restore this iPhone before it can be used with iTunes.”
“OK” “Restore” “Restore and Update”
“The iphone could not be restored. An unknown error occurred (9).” Read apple support document online - suggests different computers/usb cables/usb ports
Try with different USB cable - same result
Try with different USB port - same result
Try on Mac Pro (different computer - both cables/multiple ports) - same result
Try on MacBook (different computer - both cables/multiple ports) - same result
Call AppleCare - closed
Call Apple Store The Oaks - told to hold both buttons until phone resets and reenters recovery mode - try again
Do as instructed - same result
Try on other 2 computers (both cables/many ports) - same result
Heading to Apple Store/"Genius" Bar

I have seen this before. If you have a firewall up on your computer or router, turn it off for iPhone updates. Maybe this is it. Maybe not. Worth a shot.

 

[Crike .40]

I have seen this before. If you have a firewall up on your computer or router, turn it off for iPhone updates. Maybe this is it. Maybe not. Worth a shot.

Well, just got back from Apple Store....the problem happened again on their computer in store... The "genius" told me that it was likely "user error" but gave us a new phone anyway. When I asked him to update the new phone it did the same thing again. Strange....we got a 2nd new phone and it worked fine. 4 hours later - problem "solved"

 

[Master Chief]

Cydia's 5 kb patch for this exploit = major win.

Apple's 579 mb 4.0.2 = major pain.

It's not a patch, but a work around, because it doesn't fix anything – it only prevents you from loading PDF's automatically. You are still vulnerable to the major exploit. In short: It's a major fail. Not a major win.

 

[rjohnstone]

It's not a patch, but a work around, because it doesn't fix anything – it only prevents you from loading PDF's automatically. You are still vulnerable to the major exploit. In short: It's a major fail. Not a major win.

No.. the latest fix on Cydia that Saurik posted is an actual patch to the PDF exploit.
The PDF warning patch is removed when you install the fix.
Try and keep up.

 

[ChazUK]

Wirelessly posted (Mozilla/5.0 (Linux; U; Android 2.1-update1; en-gb; Dell Streak Build/ERE27) AppleWebKit/530.17 (KHTML, like Gecko) Version/4.0 Mobile Safari/530.17)

It's not a patch, but a work around, because it doesn't fix anything – it only prevents you from loading PDF's automatically. You are still vulnerable to the major exploit. In short: It's a major fail. Not a major win.

No.. the latest fix on Cydia that Saurik posted is an actual patch to the PDF exploit.
The PDF warning patch is removed when you install the fix.
Try and keep up.

Well I never knew that. Thanks!

I'll install it on my wifes jailbroken 3g.

 

[rjohnstone]

Wirelessly posted (Mozilla/5.0 (Linux; U; Android 2.1-update1; en-gb; Dell Streak Build/ERE27) AppleWebKit/530.17 (KHTML, like Gecko) Version/4.0 Mobile Safari/530.17)



Well I never knew that. Thanks!

I'll install it on my wifes jailbroken 3g.

Here's some more info on the patch.
I've loaded it and have not seen any ill side effects.

http://www.iclarified.com/entry/index.php?enid=11147

 

[ChazUK]

Wirelessly posted (Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_1_3 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7E18 Safari/528.16)

Wirelessly posted (Mozilla/5.0 (Linux; U; Android 2.1-update1; en-gb; Dell Streak Build/ERE27) AppleWebKit/530.17 (KHTML, like Gecko) Version/4.0 Mobile Safari/530.17)



Well I never knew that. Thanks!

I'll install it on my wifes jailbroken 3g.

Here's some more info on the patch.
I've loaded it and have not seen any ill side effects.

http://www.iclarified.com/entry/index.php?enid=11147

Just installed it on her phone. Thanks for all the info!

 

[polaris20]

Wirelessly posted (Mozilla/5.0 (Linux; U; Android 2.1-update1; en-gb; Dell Streak Build/ERE27) AppleWebKit/530.17 (KHTML, like Gecko) Version/4.0 Mobile Safari/530.17)



Well I never knew that. Thanks!

I'll install it on my wifes jailbroken 3g.

Here's some more info on the patch.
I've loaded it and have not seen any ill side effects.

http://www.iclarified.com/entry/index.php?enid=11147

It's working great on my 1st gen iPT. Very happy that at least Cydia didn't forget gen 1 users, like Apple did.

 

[Master Chief]

No.. the latest fix on Cydia that Saurik posted is an actual patch to the PDF exploit.
The PDF warning patch is removed when you install the fix.
Try and keep up.

I see. So now they patch one of the two vulnerabilities, with the info provided by Apple. Good for them. Still no patch for number two. Too bad Apple isn't stepping in for older phones.

Thanks for the heads up [I'm not into jail breaking myself].