iPhone 3.0 Software Sports Snazzy New Features, Sure: It Also plugs a Whopping 46 Security Flaws
The nearly four dozen security holes filled in the iPhone 3.0 software published by Apple yesterday have gone nearly ignored with all of the buzz surrounding the new features. But these flaws aren't anything you want to put on hold.
June 18, 2009
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
The nearly four dozen security holes filled in the iPhone 3.0 software published by Apple yesterday have gone nearly ignored with all of the buzz surrounding the new features. But these flaws aren't anything you want to put on hold.Check it out: 46 vulnerabilities in all. Some of these security flaws are almost a year old, such as CVE-2008-2320.
Many of these flaws, including CVE-2008-3623, CVE-2009-0145, CVE-2009-0146, CVE-2009-0147, CVE-2009-0165, CVE-2009-0155, CVE-2009-1179, CVE-2009-0946, CVE-2009-0040, CVE-2008-3281, CVE-2008-3529, CVE-2008-4409, CVE-2008-4225, CVE-2008-4226, CVE-2008-2320, CVE-2009-0945, CVE-2009-1686, CVE-2009-1687, CVE-2009-1690, CVE-2009-1698, and CVE-2009-1701 -- can all lead to "arbitrary code execution" -- which, in security speak, means "the attacker can run whatever code they please on your device."
Many of the flaws involve WebKit, CoreGraphics, and Safari. Complete details are available on Apple's support page.
I enjoy my iPhone -- but with this many software vulnerabilities being dumped all at the same time, and most likely timed with the 3.0 release to avoid much scrutiny -- I wouldn't sanction these devices for corporate use.
To make matters worse, it seems those running the iPod touch software have to pay $10 for the upgrade -- which means if they use their iPod touch to check e-mail or surf the Web -- they're vulnerable to all of these flaws. One shouldn't have to pay to have to security-related software defects fixed.
An e-mail to Apple asking whether iPod users can get the security update -- without having to pay for the privilege -- when unanswered by Apple PR.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024