Apple iPhone 2.2 update includes critical security patches |
 |
By SearchSecurity.com Staff
21 Nov 2008 | SearchSecurity.com |
|
|
Apple issued version 2.2 of its iPhone firmware, repairing at least a dozen security issues, including dangerous flaws in its Safari browser that attackers can exploit to steal passwords, account information and other sensitive data.
|
| SearchSecurity.com: |
| To get security news and tips delivered to your inbox, click here to sign up for our free newsletter. |
|
|
|
|
Version 2.2 of the firmware addresses software flaws in both the iPhone and iPod touch. Several issues address problems with the way Safari handles HTML table and iframe elements. An attacker could exploit the flaws to cause a memory corruption and execute arbitrary code, Apple said in its advisory. One of the errors enables an attacker to spoof the user interface, Apple said.
A TIFF image handling error can be exploited by an attacker by tricking the user to view a malicious TIFF image. CoreGraphics contains memory corruption issues resulting in processing errors. An attacker can exploit the issues to pass arbitrary code or conduct a denial-of-service (DDoS) attack Some TIFF imaging errors cause the device to reset, Apple said.
A networking error was also corrected. An error with the default setting reduced the encryption level for point-to-point tunneling protocol (PPTP) and virtual private network (VPN) connections.
A flaw in Office Viewer could also be exploited by an attacker by tricking a user into viewing a malicious Microsoft Excel file. "Viewing a maliciously crafted Microsoft Excel file may lead to an unexpected application termination or arbitrary code execution," Apple said.
Several passcode and SMS messaging errors were also addressed, Apple said. The software maker also addressed a bug that allowed a user to dial non-emergency numbers when locked out of the iPhone.
Danish vulnerability clearinghouse Secunia gave the flaws a highly critical rating. It said the flaws "can be exploited by malicious people to bypass certain security restrictions, disclose potential sensitive information, conduct spoofing attacks … or potentially compromise a user's system."
|
|
|
|
