Two Unpatched Flaws Show Up In Apple iOS

Trailrunner7 writes "The technique that the Jailbreakme.com Web site is using to bypass the iPhone's security mechanisms and enable users to run unapproved apps on their phones involves exploiting two separate vulnerabilities. One of the vulnerabilities is a memory-corruption flaw that affects the way that Apple's mobile devices, including the iPad and iPod Touch, display PDFs. The second weakness is a problem in the Apple iOS kernel that gives an attacker higher privileges once his code is on a targeted device, enabling him to break out of the iOS sandbox. The combination of the two vulnerabilities — both of which are unpatched at the moment — gives an attacker the ability to run remote code on the device and evade the security protections on the iPhone, iPad or iPod Touch. The technique became public earlier this week when the Jailbreakme.com site began hosting a set of specially crafted PDF files designed to help users jailbreak their Apple devices and load apps other than the ones approved by Apple and offered in its official App Store."

Re:Flaw?

[somenickname]

This is a feature in the same way the antenna problem is: "Well, at least I get a free bumper out of it!"

Re:The price not paid

[beej]

Currently Apple users are not paying any price despite having a very popular mobile platform that every now and then has well-publicised vulnerabilities. Hmm.

Apple products are only free if your money is not worth anything. ;-)

Apple bans PDFs...

[trboyden]

This just in... Apple bans PDFs on Apple devices... Steve Jobs was quoted as saying "PDFs are yesterday's portable documents - nobody uses them anymore. So we've decided to stop supporting PDFs on Apple devices. In addition, we've decided to not allow any media on our devices that you can't obtain through the iTunes Store. This way nobody can make our devices unstable and insecure like kernel vulnerabilities and overheating chipsets - oh wait..."

How will Apple correct this?

[chrism238]

Will Apple just place the patch in a PDF file on their website, for us all to download and auto-install?