JailbreakMe: Apple issues emergency iPhone/iPad security patch

Filed Under: Apple, Malware, Mobile, Vulnerability

iPhone
Apple has kept true to its promise, and released a security patch for users of iPhones, iPads and the iPod Touch, closing the door on a vulnerability that could have exposed them to malware and other malicious attacks.

The vulnerability first came to the public's attention after it was used by a website, JailbreakMe.com, which made it simple for iPhone and iPad users to jailbreak their devices.

As I reported earlier this month, the drive-by jailbreak exploited a vulnerability in the way that the mobile edition of Safari (the default browser used in the iOS operating system) handles PDF files - specifically its handling of fonts. Therefore, just visiting the JailbreakMe website could run code on the visitor's iPhone, iPod Touch or iPad.

Such a vulnerability, if left unpatched, leaves open opportunities for hackers to spread malicious code to Apple's mobile products.

iOS 4.0.2 for iPhone

The iOS 4.0.2 update for iPhone and iPod Touch can be downloaded and installed using iTunes, with further information available in Apple's support advisory HT4291.

The same process can be used to update Apple iPads to version 3.2.3 of iOS, with detailed information about the vulnerability published on Apple's support knowledgebase.

It remains to be seen, of course, how many iPhone and iPad users decide to install this security patch. Some may be delighting in their newly-jailbroken gadget.

However, in my opinion, leaving this security hole open would be a very foolish move. It would be relatively trivial for a malicious hacker to exploit it, and cause a problem on your shiny Apple gear.

, , , , , ,

You might like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley is an award-winning security blogger, and veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Send Graham an email, subscribe to his updates on Facebook, follow him on Twitter and App.net, and circle him on Google Plus for regular updates.