Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3/19/2013
05:21 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Apple Fixes iOS Lock Bypass

Apple's iOS 6.1.3 update addresses a screen lock flaw and improves Maps for Japan.

Apple iPhone 5S: The Hot Rumors
Apple iPhone 5S: The Hot Rumors
(click image for slideshow)
Having recently updated its desktop operating system, OS X, Apple is doing the same for its iOS mobile operating system.

The company on Tuesday released iOS 6.1.3. The update weighs in at a mere 18.2 MB. It can be downloaded directly to an iOS device from the Settings/General/Software Update menu or through iTunes. It is mainly intended to fix a security flaw that made it possible to bypass the passcode screen.

Exploiting the flaw requires some manual dexterity and a call made to emergency services (911) that's immediately cancelled -- perhaps not the best number for a law breaker to call. Doing so provides access to the device's contacts, voicemail and photos, but not to the rest of the apps on the device. However, anyone able to try this exploit presumably has control of the device in question and could employ other tools that can access data on mobile devices, locked or not.

[ Apple has other problems. Read Is Apple Losing War Of Words? ]

There may be other security fixes as well, but Apple has been slow to update its security updates page, through which it distributes security patch information.

Several hours after iOS 6.1.3 was released, while this story was being written, Apple finally published a link pointing to information about the security content of the update. But the link -- http://support.apple.com/kb/HT5701 -- did not point to any published content. Shortly thereafter, the broken link was removed. It's likely that by the time this article is published, Apple will have repaired the broken link.

The update also includes improvements to Apple's Maps app for Japan. Apple has been improving its cartographic data more broadly since it revised its Maps app (and was roundly criticized for it) last September. Last month, the company expanded its effort to hire engineers to improve Maps.

A link to a new Apple TV update, Apple TV 5.2.1, was also removed from Apple's security updates page, though the linked page continues to be accessible. It describes fixes for three security flaws affecting Apple TV units: CVE-2013-0977, CVE-2013-0978 and CVE-2013-0981.

The first involves a state management flaw that has to do with the way Mach-O executable files with overlapping segments are handled, a vulnerability that could be exploited to allow unsigned code. The second involves an information disclosure flaw in the ARM prefetch abort handler that could allow a local user to access the address of structures in the kernel. The third involves an IOUSBDeviceFamily driver that didn't adequately validate pipe object pointers, allowing the possibility of arbitrary code execution.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
4/1/2013 | 3:32:34 AM
re: Apple Fixes iOS Lock Bypass
It is kind of funny when you think about it, a simple bypass to unlock the phone and have access to their phones data. It is even more funny when that phone is leading the mobile device pack.These seem to cover just about any user, all the programs are pretty common which makes the number of people susceptible much higher. It is a good thing Apple addressed these issues but should they even have been issues to begin with?

Paul Sprague
InformationWeek Contributor
Fill
50%
50%
Fill,
User Rank: Apprentice
3/21/2013 | 9:48:12 AM
re: Apple Fixes iOS Lock Bypass
Well, you have to give props to Apple for at least doing a very quick fix.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/1/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13775
PUBLISHED: 2020-06-02
ZNC before 1.8.1-rc1 allows attackers to trigger an application crash (with a NULL pointer dereference) if echo-message is not enabled and there is no network.
CVE-2020-12607
PUBLISHED: 2020-06-02
An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s^-1, the signature verification fails even if the signature is correct. This behavior is not solely a us...
CVE-2020-13764
PUBLISHED: 2020-06-02
common.php in the Gravity Forms plugin before 2.4.9 for WordPress can leak hashed passwords because user_pass is not considered a special case for a $current_user->get($property) call.
CVE-2020-13760
PUBLISHED: 2020-06-02
In Joomla! before 3.9.19, missing token checks in com_postinstall lead to CSRF.
CVE-2020-13761
PUBLISHED: 2020-06-02
In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS.