When Apple released iOS 8.1.3 update, it was expected to fixed 33 security flaws in its iOS 8, including one that reportedly kills the exploits used by TaiG Jailbreak, according to MacRumors.
Among the fixes, the update, which is available for iPhone 4S, 5th generation iPod touch and iPad2 (and later) devices, added path checks to fix a vulnerability (CVE-2014-4480) that would allow attackers access to protected areas of the filesystem through a malicious afc command; addressed integer (CVE-2014-4481) and buffer (CVE-2014-4483) overflow issues that could lead to app termination or arbitrary code execution when a malicious PDF is opened by improving bounds checking; and bettered segment size validation to fix a flaw (CVE-2014-4455) in the way Mach-O executable files that could let a local user execute unsigned code.
Also, the update included a fix for an information disclosure issue (CVE-2014-4491) in the way APIs are handled in relationship to kernel extensions where responses containing an OSBundleMachOHeaders key may have included kernel addresses, allowing hackers to bypass address space layout randomization. Apple fixed the problem by "unsliding the addresses before returning them. "
Apple also improved filtering of URLs opened by the iTunes Store to prevent a website from getting around sandbox restrictions(CVE-2014-8840).
The update also improved stability and performance, the release noted, including reducing the storage needed to do a software update and fixing an issue that kept some users from entering Apple ID passwords for Messages and FaceTime.
Among the fixes, the update, which is available for iPhone 4S, 5th generation iPod touch and iPad2 (and later) devices, added path checks to fix a vulnerability (CVE-2014-4480) that would allow attackers access to protected areas of the filesystem through a malicious afc command; addressed integer (CVE-2014-4481) and buffer (CVE-2014-4483) overflow issues that could lead to app termination or arbitrary code execution when a malicious PDF is opened by improving bounds checking; and bettered segment size validation to fix a flaw (CVE-2014-4455) in the way Mach-O executable files that could let a local user execute unsigned code.
Also, the update included a fix for an information disclosure issue (CVE-2014-4491) in the way APIs are handled in relationship to kernel extensions where responses containing an OSBundleMachOHeaders key may have included kernel addresses, allowing hackers to bypass address space layout randomization. Apple fixed the problem by "unsliding the addresses before returning them. "
Apple also improved filtering of URLs opened by the iTunes Store to prevent a website from getting around sandbox restrictions(CVE-2014-8840).
The update also improved stability and performance, the release noted, including reducing the storage needed to do a software update and fixing an issue that kept some users from entering Apple ID passwords for Messages and FaceTime.
Comments
Post a Comment