Apple closes security holes with iOS 5.1 and iTunes update

Alongside the launch of the "new iPad", Apple released iOS 5.1 for the iPhone 3GS, 4 and 4S, the 3rd generation iPod touch, and iPad and iPad 2. The update includes fixes for 91 issues with CVE identifiers. The majority, 66 of the issues, are described as "unexpected application termination or arbitrary code execution" in WebKit due to memory corruption. These flaws were mostly found by Apple or members of the Google Chrome Security Team, while a number were found by Chrome special reward winner miaubiz.

Two screen lock bypass issues are fixed, including one, a race condition with slide to dial gestures that could bypass the passcode lock, discovered by Roland Kohler of the German Federal Ministry of Economics and Technology, and an uncredited discovery that Siri's lock screen could be used to forward messages to an arbitrary user.

Another error, which allowed a malicious program to bypass the sandbox by exploiting an error in the handling of debug calls, has been fixed, with the error's discovery credited to the "2012 iOS Jailbreak Dream Team". A flaw in Private Browsing in Safari that recorded JavaScript pushState and replaceState methods in browser history has also been fixed. Other flaws fixed include information disclosure in CFNetwork with maliciously crafted URLs, an integer underflow when mounting disk images, an integer underflow when processing DNS records, and cross-origin issues with cookies and content which could enable cross-site scripting attacks.

iOS 5 devices have automatic update support, and the update should be available "over-the-air" or via iTunes. Users who wish to force the update can use the Settings app, select General and then Software Update, ensuring the device is fully charged or on charge. Full details of all the issues fixed are given in About the security content of iOS 5.1 Software Update.

Many of the same WebKit issues are fixed in the iTunes 10.6 update to mitigate the possibility that a man-in-the middle attack could be used while browsing Apple's iTunes Store to compromise a system. The iTunes 10.6 update is for Mac OS X and Windows systems and details of the fixes are available in About the security content of iTunes 10.6.

(djwm)