Apple users put at risk by 3-week delay between OS X and iOS patches, researchers say

IOS users were kept vulnerable for three weeks to known security issues previously patched in Safari for OS X, a former Apple employee said

Apple exposed iOS users to security threats by taking three weeks longer to patch the same vulnerabilities in the mobile OS that it previously fixed in Safari on OS X, a former Apple security engineer said.

Security researcher Kristin Paget, who left Apple at the end of January for a position at Tesla Motors, strongly criticized her former employer's software patching practices in a blog post Wednesday.

The researcher pointed out that many of the vulnerabilities fixed in iOS 7.1.1, which was released by Apple Tuesday, were the same ones the company had patched in Safari 6.1.3 and 7.0.3 for OS X on April 1. Many of those vulnerabilities were located in WebKit, the Web rendering engine used by iOS, the Safari browser and other OS X applications, and most of them had been found by members of the Google Chrome security team.

According to Apple's security advisory for iOS 7.1.1, some of the WebKit flaws could allow attackers to execute arbitrary code when users visit maliciously crafted websites.

"Apple preaches the virtues of having the same kernel (and a bunch of other operating system goop) shared between two platforms [iOS and OS X] -- but then only patches those platforms one at a time, leaving the entire userbase of the other platform exposed to known security vulnerabilities for weeks at a time," Paget said. "In what world is this acceptable?"

"Apparently someone needs to sit Apple in front of a chalkboard and make them write out 100 lines: 'I will not use iOS to drop 0day on OSX, nor use OSX to drop 0day on iOS.'," she said.

Zero-day (0day) refers to vulnerabilities that are publicly known but have no official fix from the affected product's vendor.

It is certainly possible for attackers to analyze the fixes for one product and create exploits that work against other products and platforms that are not fixed yet, said Carsten Eiram, the chief research officer at vulnerability intelligence firm Risk Based Security, Thursday via email.

According to Eiram, these sorts of patch delays between Apple products are a regular occurrence, especially when it comes to fixing WebKit vulnerabilities.

"We've seen for a very long time that Google usually addresses WebKit-related vulnerabilities in Chrome long before Apple does the same in their products," Eiram said. "My rough impression from looking at WebKit security fixes is that the delay is around two-three months on average -- though I've seen some much longer. After Google forked WebKit into Blink it seems to be getting worse."

Google Chrome used WebKit as its rendering engine until version 27 and has since switched to an engine called Blink that's still based on WebKit. Because of that, many of the issues found and fixed in Chrome also affect WebKit.

However, Apple is not only slow at patching the WebKit engine itself, but also at integrating those fixes into all of its WebKit-dependent software.

Eiram pointed to the patching timeline for a WebKit vulnerability identified as CVE-2013-2909 as an example. That vulnerability was originally fixed in Chrome on Oct. 1, 2013, then Apple patched it in Safari 6.1.1 and 7.0.1 on Dec. 16, 2013 (two-and-a-half months later); in iOS 7.1 on March 10 (five months later), and finally in Apple TV 6.1 on April 22 (six-and-a-half months later).

"The lack of coordination between Google and Apple is one thing," Eiram said. "However, Apple releasing fixes for vulnerabilities in some of their products while leaving other of their products vulnerable for a long time is a very curious practice that I strongly disagree with. It's unacceptable that they're putting their own users at risk like that."

Apple did not immediately respond to a request for comment.

Other vendors have faced criticism in the past for similar patching practices. For example, vulnerabilities patched in Flash Player used to remain unfixed for weeks in Adobe Reader, which bundled Flash Player as a library called authplay.dll. Adobe eventually removed the authplay.dll component from Adobe Reader starting with version 9.5.1.

One of the few cases when it can be acceptable to push out a security patch for one product while leaving others vulnerable is if a 0-day vulnerability was being actively exploited to target users of that product, but not users of the other products, Eiram said. However, even in such a case of immediate threat, the vendor shouldn't wait too long before patching the rest of its products as well, he said.

Join the PC World newsletter!

Error: Please check your email address.

Tags patchestelecommunicationapplicationsiospatch managementmobileoperating systemsExploits / vulnerabilitiesAppleMac OSsecurityRisk Based SecurityMobile OSessoftware

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Essentials

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?