Risk
3/19/2013
05:21 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Apple Fixes iOS Lock Bypass

Apple's iOS 6.1.3 update addresses a screen lock flaw and improves Maps for Japan.

Apple iPhone 5S: The Hot Rumors
Apple iPhone 5S: The Hot Rumors
(click image for slideshow)
Having recently updated its desktop operating system, OS X, Apple is doing the same for its iOS mobile operating system.

The company on Tuesday released iOS 6.1.3. The update weighs in at a mere 18.2 MB. It can be downloaded directly to an iOS device from the Settings/General/Software Update menu or through iTunes. It is mainly intended to fix a security flaw that made it possible to bypass the passcode screen.

Exploiting the flaw requires some manual dexterity and a call made to emergency services (911) that's immediately cancelled -- perhaps not the best number for a law breaker to call. Doing so provides access to the device's contacts, voicemail and photos, but not to the rest of the apps on the device. However, anyone able to try this exploit presumably has control of the device in question and could employ other tools that can access data on mobile devices, locked or not.

[ Apple has other problems. Read Is Apple Losing War Of Words? ]

There may be other security fixes as well, but Apple has been slow to update its security updates page, through which it distributes security patch information.

Several hours after iOS 6.1.3 was released, while this story was being written, Apple finally published a link pointing to information about the security content of the update. But the link -- http://support.apple.com/kb/HT5701 -- did not point to any published content. Shortly thereafter, the broken link was removed. It's likely that by the time this article is published, Apple will have repaired the broken link.

The update also includes improvements to Apple's Maps app for Japan. Apple has been improving its cartographic data more broadly since it revised its Maps app (and was roundly criticized for it) last September. Last month, the company expanded its effort to hire engineers to improve Maps.

A link to a new Apple TV update, Apple TV 5.2.1, was also removed from Apple's security updates page, though the linked page continues to be accessible. It describes fixes for three security flaws affecting Apple TV units: CVE-2013-0977, CVE-2013-0978 and CVE-2013-0981.

The first involves a state management flaw that has to do with the way Mach-O executable files with overlapping segments are handled, a vulnerability that could be exploited to allow unsigned code. The second involves an information disclosure flaw in the ARM prefetch abort handler that could allow a local user to access the address of structures in the kernel. The third involves an IOUSBDeviceFamily driver that didn't adequately validate pipe object pointers, allowing the possibility of arbitrary code execution.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
4/1/2013 | 3:32:34 AM
re: Apple Fixes iOS Lock Bypass
It is kind of funny when you think about it, a simple bypass to unlock the phone and have access to their phones data. It is even more funny when that phone is leading the mobile device pack.These seem to cover just about any user, all the programs are pretty common which makes the number of people susceptible much higher. It is a good thing Apple addressed these issues but should they even have been issues to begin with?

Paul Sprague
InformationWeek Contributor
Fill
50%
50%
Fill,
User Rank: Apprentice
3/21/2013 | 9:48:12 AM
re: Apple Fixes iOS Lock Bypass
Well, you have to give props to Apple for at least doing a very quick fix.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-6278
Published: 2014-09-30
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and m...

CVE-2014-6805
Published: 2014-09-30
The weibo (aka magic.weibo) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6806
Published: 2014-09-30
The Thanodi - Setswana Translator (aka com.thanodi.thanodi) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6807
Published: 2014-09-30
The OLA School (aka com.conduit.app_00f9890a4f0145f2aae9d714e20b273a.app) application 1.2.7.132 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-6808
Published: 2014-09-30
The Active 24 (aka com.zentity.app.active24) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.