Key iOS Security Updates Patch PDF and Certificate Validation Vulnerabilities (4.3.4 and 4.3.5)
The two latest iOS updates are fairly significant in that they patch two critical vulnerabilities. iOS update 4.3.4 patched a number of bugs including comex’s PDF/FreeType vulnerability used to create the latest JailbreakMe exploit. If you’re a jailbreaker, it’s essential that you run comex’s ‘PDF Patcher 2’ within Cydia, in order to patch the underlying vulnerability. iOS update 4.3.5 released a couple days ago, patches a fairly significant bug in the way iOS validates SSL/TLS certificates. This vulnerability can allow an attacker to intercept and/or modify data protected within an SSL session without the user knowing it. This was possible to due the fact that iOS didn’t validate the basicContstrains parameter of SSL certificates in the chain.
If you’re only an occasional patcher – now is the time.
Jailbreak iOS 4.3.3 with JailbreakMe 3.0
JailbreakMe.com has been updated to allow easy untethered jailbreak of your iOS devices, just follow the instructions on the site. Thanks to a new PDF exploit from comex (with the help of chpwn), it is now possible to jailbreak iPhones, iPads (including iPad 2) and iPod Touches running iOS 4.3.3 (note this doesn’t yet include any versions below that). During the jailbreak, saurik’s Cydia app store is automatically installed.
Interestingly, users with jailbroken devices can protect themselves by patching the PDF vulnerability by using ‘PDF Patcher 2’ in Cydia. Normal users will have to wait for iOS 4.3.4 from Apple. Note, however, that having a jailbroken iPhone or iPad still makes you slightly more vulnerable to other attacks, as the iOS sandbox is essentially bypassed.
limera1n brings unpatchable iOS Jailbreak
geohot has released limera1n, the latest iOS jailbreak. After the success of comex’s Jailbreakme.com, which was patched by iOS 4.0.2, limera1n brings a theoretically unpatchable exploit thanks to an extremely low-level vulnerability that affects all of Apple’s iOS-base devices. Both Mac OS X and Windows versions of limera1n are now available for download.
The jailbreak uses an exploitable vulnerability in the iOS boot-rom. This is the reason it’s theoretically unpatchable, as the boot-rom is something that would need to be physically flashed on the affected devices. By ‘unpatchable’ I mean that Apple will not be able to patch the vulnerability that makes the jailbreak possible, on existing iOS devices. If this is indeed the case, then this would mean that the current line of iOS devices are guaranteed to be jailbreakable even when applying new iOS updates. Apple would have to patch the bug in the boot-rom in new devices they release down the line.
In other news, the jailbreaking scene has had its feathers ruffled as the chronic dev team were originally going to release their greenpois0n jailbreak (using their SHAtter exploit). Rumor has it they shared their exploit with geohot, who went ahead and published his own tool before they could. Fun times.
[Update] Although the boot-rom exploit might not be patchable, limera1n uses a userland exploit to perform the untethered jailbreak. This means that Apple could potentially patch the untethered part of the jailbreak – although the boot-rom exploit would still exist. For more info read Update #1 at the bottom of this post.
Many people seem to be wondering what is meant by limera1n being ‘unpatchable’. Hopefully this posts answers that question somewhat. If you’re still unsure, feel free to post a question in the comments.
Loading ...
