Software Fix for iOS PDF-Handling Vulnerability Awaiting Release

[MacRumors]

CNET reports that Apple has developed a software fix for the iOS security hole exploited to enable a Web-based jailbreak over the weekend, and that the fix will be deployed in an upcoming software update.

On Wednesday an Apple spokeswoman said in a statement, "We're aware of this reported issue, we have already developed a fix and it will be available to customers in an upcoming software update."

Apple declined to say when the update would be pushed out.

Apple had reported just yesterday that it was investigating the issue, which actually comprises a pair of flaws, and has obviously moved rapidly to close the security hole.

There are two distinct vulnerabilities in the iPhone uncovered with the jailbreak software's release, principal analyst Charlie Miller of Independent Security Evaluators told CNET Tuesday. One flaw is in the way the browser parses PDF files, enabling the code to get inside a protective sandbox, and the other hole allows code to break out of the sandbox and get root, or control, privileges on the device.

While the vulnerability was exploited to offer users a simple method to jailbreak their iOS devices in this case, it could easily be used as an entry point for the execution of malicious code.

Article Link: Software Fix for iOS PDF-Handling Vulnerability Awaiting Release

 

[OrangeSVTguy]

Apple is quick! I wonder when they will release it?

 

[Voidness]

Sounds good, but Apple needs to change the way they do iOS software updates. No matter how small the changes are, users have to download the entire +350MB OS. This is very inefficient and probably discourages a lot of users from updating. Apple needs to do incremental updates.

 

[CFreymarc]

Apple is quick! I wonder when they will release it?

My take it is out before the end of the month. Anything that puts native code at the kernal level is nipped in the butt quick.

 

[cleggster83]

lets only hope they get it with 4.1 and a proximity sensor fix!

 

[palmerc2]

so, basically, no more jailbreaking this way....right?

 

[adamt56]

Apple is quick! I wonder when they will release it?

Tonight would be nice.

 

[cocky jeremy]

Sounds good, but Apple needs to change the way they do iOS software updates. No matter how small the changes are, users have to download the entire +350MB OS. This is very inefficient and probably discourages a lot of users from updating. Apple needs to do incremental updates.

I think updates fixing the holes that allow jailbreaking is the main reason people don't update.

 

[OrangeSVTguy]

Don't see why Apple really cares . There would be a lot less iPhones to replace/repair since jail-breaking voids the warranty.

I think most people jailbreak to unlock anyways to use on other carriers besides AT&T. I bet AT&T pushes Apple to avoid that from happening.

 

[Consultant]

Of course the theoretical exploit vector will be closed off quickly.

Good job Apple.

so, basically, no more jailbreaking this way....right?

Not for another 3 years, maybe.

Sounds good, but Apple needs to change the way they do iOS software updates. No matter how small the changes are, users have to download the entire +350MB OS. This is very inefficient and probably discourages a lot of users from updating. Apple needs to do incremental updates.

50K anti-jailbreak fix!

Don't see why Apple really cares . There would be a lot less iPhones to replace/repair since jail-breaking voids the warranty.

I think most people jailbreak to unlock anyways to use on other carriers besides AT&T. I bet AT&T pushes Apple to avoid that from happening.

Only true if it breaks something which software restore cannot fix.

 

[I WAS the one]

ha ha ha! Well, jailbreakme.com 3.0 coming soon! and so on and on and on and on..... and by the way... Apple is loosing the coolness more and more... beware, iFans are dying slowly, young users don't care of Apple history and today it doesn't matter who introduce the first gadget...it who build the best one. tic toc tic toc.... people are getting aware.

 

[cmaier]

ha ha ha! Well, jailbreakme.com 3.0 coming soon! and so on and on and on and on..... and by the way... Apple is loosing the coolness more and more... beware, iFans are dying slowly, young users don't care of Apple history and today it doesn't matter who introduce the first gadget...it who build the best one. tic toc tic toc.... people are getting aware.

Does coolness require such lousy spelling and grammar?

 

[Deelron]

Don't see why Apple really cares . There would be a lot less iPhones to replace/repair since jail-breaking voids the warranty.

Meh I could care less about jail breaking either way but it is a pretty serious hole for this sort of access though the web browser.

 

[Consultant]

ha ha ha! Well, jailbreakme.com 3.0 coming soon! and so on and on and on and on..... and by the way... Apple is loosing the coolness more and more... beware, iFans are dying slowly, young users don't care of Apple history and today it doesn't matter who introduce the first gadget...it who build the best one. tic toc tic toc.... people are getting aware.

Epic fail. That must be why Apple is now the most valuable technology company, expecting to surpass Microsoft in revenue.

 

[Rajani Isa]

ha ha ha! Well, jailbreakme.com 3.0 coming soon! and so on and on and on and on..... and by the way... Apple is loosing the coolness more and more... beware, iFans are dying slowly, young users don't care of Apple history and today it doesn't matter who introduce the first gadget...it who build the best one. tic toc tic toc.... people are getting aware.

So fixing a security hole is losing apple fans?

Yes, it will stop this jailbreak, but the fact that I haven't heard of anyone having some kinda virus by now is kind of a surprise.

 

[xraytech]

ha ha ha! Well, jailbreakme.com 3.0 coming soon! and so on and on and on and on..... and by the way... Apple is loosing the coolness more and more... beware, iFans are dying slowly, young users don't care of Apple history and today it doesn't matter who introduce the first gadget...it who build the best one. tic toc tic toc.... people are getting aware.

Really?

As much as I love my Jailbroken iP4 via www.jailbreakme.com, The method scares the **** out of me. You need to grow up, learn some proper English and realize how BAD this is.

 

[p0intblank]

ha ha ha! Well, jailbreakme.com 3.0 coming soon! and so on and on and on and on..... and by the way... Apple is loosing the coolness more and more... beware, iFans are dying slowly, young users don't care of Apple history and today it doesn't matter who introduce the first gadget...it who build the best one. tic toc tic toc.... people are getting aware.

Wow. Aren't you quite the expert!

[/sarcasm]

 

[Corbin052198]

Wirelessly posted (Mozilla/5.0 (iPod; U; CPU iPhone OS 3_1_3 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7E18 Safari/528.16)

Just 4 days ago I jailbreaked my iPod Touch 1G (running iOS 3.1.3) with Jailbreakme. Glad Apple is fixing this, though. I would not want some website jailbreaking (or worse) my iThing without my permission.

I still can't belived this went unseen for so long. Apple needs to step it up a notch

 

[JoshBoy]

I don't see the massive need for a jailbreak anymore. Skype calls over 3g, multitasking is here, cut and paste, spell check, wallpapers. I enjoy not having to worry if there will be issues or something going wrong due to jailbreaking. I must say it was a must living in Australia and having the 1st gen iphone back in 2007 but once the 3G came along with the app store it became less and less.

 

[japanime]

lets only hope they get it with 4.1 and a proximity sensor fix!

As well as a fix for Apple's Nike+ application, which doesn't work properly under iOS4.

 

[xraytech]

Now that cloud based Jailbreaking is on the way out, is someone working on a computer based Jailbreak anytime soon?

 

[japanime]

So fixing a security hole is losing apple fans?

Yes, it will stop this jailbreak, but the fact that I haven't heard of anyone having some kinda virus by now is kind of a surprise.

No, you got it all wrong. He didn't say Apple was losing fans. He said Apple was "loosing" fans.

 

[Corbin052198]

Wirelessly posted (Mozilla/5.0 (iPod; U; CPU iPhone OS 3_1_3 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7E18 Safari/528.16)

Now that cloud based Jailbreaking is on the way out, is someone working on a computer based Jailbreak anytime soon?

If you don't care about the iPhone 4, there are numorus applications and programs that will suit your needs.

 

[Poll Smoker]

is nipped in the butt quick.

It seems like the more popular Apple becomes, the more stupid its users become.

 

[xraytech]

Wirelessly posted (Mozilla/5.0 (iPod; U; CPU iPhone OS 3_1_3 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7E18 Safari/528.16)



If you don't care about the iPhone 4, there are numorus applications and programs that will suit your needs.

You reply sorta hit me sides ways, I love my iP4.

So there are computer based apps, like Spirit, that will Jailbreak my iP4?