-------------------------------------------
寄件者: David Perry (MKT-US)
傳送日期: Friday, August 13, 2010 1:25:06 AM
收件者: Newsbank
主旨: ::NEWSBANK:: Apple kills browse-and-get-hacked bugs in iOS
自動依照規則轉寄
Apple kills browse-and-get-hacked bugs in iOS
iPhones, iPads, iPod touches safe again
By Dan Goodin in San Francisco
Posted in Malware, 11th August 2010 20:57 GMT
http://www.theregister.co.uk/2010/08/11/critical_iphone_vuln_patched/
Updated Apple has patched a critical iOS vulnerability that allows attackers to install malicious apps on iPhones, iPads, and iPod touches by doing nothing more than luring victims to a booby-trapped website or sending them a tainted email.
The update plugs a hole in Apple-designed document-viewing software that allows attackers to inject code of their choosing into PDF files.
By default, all three devices open the documents automatically when they are encountered in emails or on websites, leading to a classic browse-and-get-hacked exploit.
The Foxit document reader was vulnerable to the same flaw, until it was patched last week. Adobe has said its Reader application is unaffected.
A second vulnerability in iOS allows attackers to break out of the iOS security sandbox and access to the OS's root account, which has unfettered access to the device.
The vulnerabilities have been exploited for weeks on Jailbreakme.com, a website that allows people to jailbreak their devices by flicking a slider on the home page. There has been nothing stopping people from carrying out more malicious attacks, but so far there are no known reports of that happening.
In addition to patching the PDF flaw in iOS, Apple has also bolstered its sandbox by nixing an integer overflow in the handling of what's known as IOSurface properties.
The whole point of the design is to mitigate the severity of buffer overflows and other garden-variety software bugs by containing application processes inside protected walls that can't access sensitive parts of the OS.
There's no word of an accompanying update for Mac OS X. It remains unclear if that OS is unaffected or Apple hasn't gotten around to issuing a fix yet.
This might take a while
Apple's advisory suggests that users install the patch immediately, but it may make sense to wait until there's an ample amount of bandwidth available. The iPad update is a whopping 456.9MB in size and the iPhone download is 378MB.
This article was updated to correct erroneous information about the status of the sandbox patch.
Related stories
- Apple preps iOS fix as Germany warns of iPhone peril (4 August 2010)
- Updated iOS jailbreak howdunnit partially solved (3 August 2010)
- iPhone 4 jailbreak banks on browser exploit (2 August 2010)
- Adobe to fortify widely exploited Reader with security sandbox (20 July 2010)
- Dell sandboxes Firefox to boost corporate security (20 July 2010)
- Black Hat Hijacking iPhones and other smart devices using SMS (31 July 2009)
- MS adds sandboxing to Office 2010 (24 July 2009)
- Tool opens iPhone, iPod Touch via web (29 October 2007)
==========================================================
|
|
|
沒有留言:
張貼留言