Technology news and Jobs 
VIRTUALISATION Apple plugs iPhone, iPod touch, QuickTime security holes
VIRTUALISATION Apple plugs iPhone, iPod touch, QuickTime security holes | Apple plugs iPhone, iPod touch, QuickTime security holes |
|
| by Stephen Withers | |
| Thursday, 10 September 2009 | |
  
Featured Whitepaper
5 Best Practices for Smartphone Support
One group of fixes relates to external attacks. These include changes to the handling of maliciously crafted AAC and MP3 files to avoid crashing or arbitrary code execution, and improvements to SMS handling to avoid the SMS attack publicly revealed by Charlie Miller at this year's Black Hat security conference. Also fixed are various WebKit flaws that allow crashing, arbitrary code execution, cross-site scripting, and the disclosure of user names and passwords. A wider range of Unicode characters are flagged in the address bar to reduce the risk of URL spoofing. Another group of issues concerns issues requiring physical access. An Exchange Server inactivity time lock can no longer be overridden by extending the iPhone OS's Require Password setting. When characters in a password are deleted, they no longer made briefly visible. Deleted messages no longer appear in Spotlight search results. A hole in Recovery Mode that made it possible to bypass the device's passcode in order to access data has been plugged. The updates are available via iTunes. iPhone OS 3.1 is a free download; iPhone OS 3.1.1 costs $A5.99/$US4.95. The reason for the difference is that Apple accounts for iPhone sales revenue across the expected life of the devices, so the cost of any upgrades can be recognised along with the income. But as iPod touch revenue is booked immediately, Apple would have to restate past results if it delivered free updates for that device - so it doesn't. QuickTime 7.6.4 (for Mac OS X 10.4.11, 10.5.8, and Windows XP, Vista and 7) fixes various memory corruption and overflow conditions that could lead to crashing or arbitrary code execution when playing H.264, MPEG-4 or FlashPix content. The update is available via Software Update (Apple Software Update on Windows) or the QuickTime Downloads site. |
Tags
| < Next story in category | Previous story in the category > |
|---|
