Apple delivers prodigious patch batch for iPhone

Fixes 46 flaws, including bug that 'Pwn2Own' hacker used to win $US5K in March

Apple yesterday patched 46 security vulnerabilities, half of them in the Safari browser and its WebKit rendering engine, for the iPhone and iPod Touch as it released iPhone OS 3.0.

The company fixed nearly four times the number of flaws Wednesday than when it last patched the iPhone software. In November 2008, Apple issued a security update alongside iPhone 2.2 that plugged 12 holes.

Almost half of the vulnerabilities -- 21 all told -- were tagged with Apple's usual "arbitrary code execution" phrase, lingo that essentially means that the bug is critical and could be used to compromise the device. Unlike other major software makers, such as rival operating system developer Microsoft and database giant Oracle, Apple doesn't rank vulnerabilities using a scoring system.

Not surprisingly, 50% of the patches apply to bugs in Safari, the iPhone and iPod Touch's browser, or WebKit, the open-source browser engine that Apple uses as Safari's foundation. Safari and WebKit have been the focus of most research into iPhone hacks. The first reported iPhone bug, for example, was a Safari flaw found by a trio of researchers, including Charlie Miller, formerly with the National Security Agency, in July 2007.

Twenty-one of the 23 browser-related bugs that Apple patched yesterday were in WebKit code; the remaining two were in Safari itself. Among the former were multiple cross-site scripting bugs that identity thieves could use for phishing attacks and malware makers to inject rogue attack code, including JavaScript, to hijack the browser and gain access to information on the iPhone or iPod Touch.

One of the WebKit vulnerabilities stands out because of the attention it received in March, when a German college student, who gave only his first name, Nils, walked away with a $US5,000 cash prize for hacking Safari at the "Pwn2Own" challenge. Nils used a bug in WebKit's handling of SVGList objects to crack Safari.

Nils' WebKit bug was first patched in a massive 67-flaw fix issued in mid-May for Mac OS X; today Apple patched the same vulnerability in the iPhone's operating system.

Apple addressed eight bugs in CoreGraphics, five in the XML library, two in the iPhone's e-mail client, and other flaws in ImageIO, IPSec and Unicode components of the operating system. The update also patches a vulnerability in how the iPhone connects to Microsoft Exchange servers, which could be exploited to steal data or gain access to the iPhone's Exchange account.

iPhone 3.0, which contains the 46 patches, can be downloaded by connecting the iPhone or iPod Touch to its sync PC or Mac, running iTunes, clicking on the device in the listing on the left and then clicking the "Check for Update" button.

Join the PC World newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags security patchAppleiPhonepwn2own

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?