Risk
3/19/2013
05:21 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Apple Fixes iOS Lock Bypass

Apple's iOS 6.1.3 update addresses a screen lock flaw and improves Maps for Japan.

Apple iPhone 5S: The Hot Rumors
Apple iPhone 5S: The Hot Rumors
(click image for slideshow)
Having recently updated its desktop operating system, OS X, Apple is doing the same for its iOS mobile operating system.

The company on Tuesday released iOS 6.1.3. The update weighs in at a mere 18.2 MB. It can be downloaded directly to an iOS device from the Settings/General/Software Update menu or through iTunes. It is mainly intended to fix a security flaw that made it possible to bypass the passcode screen.

Exploiting the flaw requires some manual dexterity and a call made to emergency services (911) that's immediately cancelled -- perhaps not the best number for a law breaker to call. Doing so provides access to the device's contacts, voicemail and photos, but not to the rest of the apps on the device. However, anyone able to try this exploit presumably has control of the device in question and could employ other tools that can access data on mobile devices, locked or not.

[ Apple has other problems. Read Is Apple Losing War Of Words? ]

There may be other security fixes as well, but Apple has been slow to update its security updates page, through which it distributes security patch information.

Several hours after iOS 6.1.3 was released, while this story was being written, Apple finally published a link pointing to information about the security content of the update. But the link -- http://support.apple.com/kb/HT5701 -- did not point to any published content. Shortly thereafter, the broken link was removed. It's likely that by the time this article is published, Apple will have repaired the broken link.

The update also includes improvements to Apple's Maps app for Japan. Apple has been improving its cartographic data more broadly since it revised its Maps app (and was roundly criticized for it) last September. Last month, the company expanded its effort to hire engineers to improve Maps.

A link to a new Apple TV update, Apple TV 5.2.1, was also removed from Apple's security updates page, though the linked page continues to be accessible. It describes fixes for three security flaws affecting Apple TV units: CVE-2013-0977, CVE-2013-0978 and CVE-2013-0981.

The first involves a state management flaw that has to do with the way Mach-O executable files with overlapping segments are handled, a vulnerability that could be exploited to allow unsigned code. The second involves an information disclosure flaw in the ARM prefetch abort handler that could allow a local user to access the address of structures in the kernel. The third involves an IOUSBDeviceFamily driver that didn't adequately validate pipe object pointers, allowing the possibility of arbitrary code execution.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
4/1/2013 | 3:32:34 AM
re: Apple Fixes iOS Lock Bypass
It is kind of funny when you think about it, a simple bypass to unlock the phone and have access to their phones data. It is even more funny when that phone is leading the mobile device pack.These seem to cover just about any user, all the programs are pretty common which makes the number of people susceptible much higher. It is a good thing Apple addressed these issues but should they even have been issues to begin with?

Paul Sprague
InformationWeek Contributor
Fill
50%
50%
Fill,
User Rank: Apprentice
3/21/2013 | 9:48:12 AM
re: Apple Fixes iOS Lock Bypass
Well, you have to give props to Apple for at least doing a very quick fix.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2003-1598
Published: 2014-10-01
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.

CVE-2011-4624
Published: 2014-10-01
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.

CVE-2012-0811
Published: 2014-10-01
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files gene...

CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Chris Hadnagy, who hosts the annual Social Engineering Capture the Flag Contest at DEF CON, will discuss the latest trends attackers are using.