Major Security Flaw in 2.0.2

[xUKHCx]

I just tried to replicate this on my original iPhone running OS 2.0.2 (5C1). I have contacts assigned as favorites and a lock code assigned. Pressing the "Emergency Call" button takes me to the Emergency Call screen as it should. Several rapid presses of the Home button simply takes me back to the Enter Passcode screen.

There are several reports in this thread as well as the main news thread on this subject stating that it is a wide problem so it is true and in fact I can make it happen on my phone.

You need to have the settings correct (default), check to see what settings- general - home button - phone favourites. If this is set to home it will return to the emergency call button like you experience now.

 

[emwit]

Just like Palm

Several Palm OS phones had a very similar flaw. It involved making an emergency call and then performing a "find" action. It took Palm a while to fix it, all while they too downplayed the severity as "minor."

c.f. http://www.securityfocus.com/archive/1/460059
c.f. http://www.intomobile.com/2007/05/21/palm-releases-security-updates-for-treo-650680700p.html

 

[JML42691]

Hi guys, to clarify some things...

Contributors ("demi-gods") have had access to raw news submissions with identifying information stripped out. It was an un-advertised benefit of contribution which is no longer offered.

As a result, greenmymac did have access to the submission information. Based on the similarities and timing, it seems very likely that hdm42 was the source of this post. (for what it's worth, I did know of someone else who had reported this to apple a few weeks ago).

I'll change the original post to reflect this, and greenmymac will be disciplined as determined appropriate for misuse of this information.

Sorry for the confusion, and I would ask that we try to prevent this thread from getting out of hand.

arn

In which case I apologize to hdm42 and everybody else who stuck to the point that it appeared that greenmymac had stolen his words. This was the proof that was needed to show how greenmymac stole his words, and now I believe that he did steal these words, I apologize for sticking to my point for so long, as there did not appear to be any connection between greenmymac's post here, and hdm42's submission until now.

 

[Matthew Yohe]

Well, at least we know who really found it first...

 

[Rybold]

This is EXACTLY why I updated to 2.1 firmware faster than Flash Gordon!

With 2.1 this flaw is history!