Apple patches 10 iPhone flaws
384357
Seven of the updates affect the MobileSafari browser within iPhones.
417891
Apple Computer (Nasdaq: AAPL) has issued a new security patch to mend seven vulnerabilities in its Mac OS X operating system.
574551
Apple updated iTunes to keep users from creating free iPhone ringtones--a workaround has already been posted.
363317
Mozilla has issued 10 patches including three for critical vulnerabilities.
608293
There is no need for serious alarm, but the exploit does appear to have been crafted before Apple Computer patched the flaw last week.
753754
(InfoWorld) - Users are reporting that a new update to Apple's iPhone is making previously unlocked iPhones unusable. The iPhone 1.1.1 update , released Thursday, breaks phones that have been hacked so that they work with providers other than AT&T, the only U.S. provider Apple has allowed to carry its mobile phones. In recent months, a number of software tools have been developed whichÂ allow iPhone users to break free of Apple's AT&T-only restriction, but Apple has said that it would fight any attempts to unlock the iPhone. Earlier this week the company released a warning that unlocked iPhones "will likely result in the modified iPhone becoming permanently inoperable when a future Apple-supplied iPhone software update is installed." Shortly after the Thursday update was released, users of unlocked iPhones began reporting problems. Security researcher Tom Ferris said the new software disabled a phone that had been unlocked using the open-source anySIM software in order to work on T-Mobile's wireless network. After the update, the iPhone was stuck with an error message and apparently unusable. "It kept saying 'unsupported SIM card,' even with the AT&T SIM card in it," he said. "You can turn the phone off or on, but we just can't figure out how to get past this 'SIM card not supported'," he said. SIM cards contain account information and are used to authenticate devices on certain types of mobile networks. Unlocked iPhones can use SIM cards from non-AT&T networks. Others were reporting similar problems on Thursday. The update also appears to disable the 'Jailbreak' hack which allows users to install unsupported software on the iPhone, Ferris said. After the 1.1.1 patch was installed, it wiped out all of the third-party applications he had installed on a second iPhone, he said. The new software is Apple's biggest iPhone update to date, andÂ it fixes a number of security flaws in the iPhone's browser, mail client, and Bluetooth networking server. The majority of the flaws do not appear to be critical, but the update fixes a larger number of bugs than the first iPhone update, released July 31. Hackers have said that the iPhone's browser and mail clients are the most likely sources of software flaws and this release bears that out. Apple fixed seven flaws in the Safari browser, two in the iPhone's mail client, and one Bluetooth bug with the release. The Bluetooth flaw could be the most serious -- Apple said that it could allow an attacker to run unauthorized code on the iPhone -- but because Bluetooth works over a range of just a few feet, the attacker would have to be standing near the victim for any exploit to work, said Andrew Storms, director of security operations with nCircle Network Security. Noted hacker HD Moore agreed that the Bluetooth flaw was serious. "The only bad issue here is the Bluetooth [flaw]," he said. "I will start working on this tonight." Though there may be some technical limitations to what an attacker could do by exploiting this bug, it "could be a nasty remote exploit," he added. Earlier this week,Â Moore added iPhone hacking capabilities to the Metasploit hacking toolÂ that he develops. The patch also fixes some cross-site scripting and JavaScript flaws in the browser that could also be serious, Storms said. These flaws could be exploited to make the browser run unauthorized JavaScript code, he said. Mobile phone users typically cannot update their own software, but Apple introduced this capability in the iPhone, which uses the update mechanism in the phone's iTunes music player. iTunes checks for these updates once per week, so it may take up to seven days for all iPhone users to see these updates. Apple advises users to install the update immediately.
156524
Blog: An exhaustive test of the iPhone has produced several bugs that will require fixes, but few that will cause problems with common tasks.
436749
Apple Inc. has released security updates for four vulnerabilities in Mac OS X and its Safari beta browser, marking the second time in just over a week that the company has had to fix the app.
535700
Apple released an update to its iPhone today that applies some critical bug fixes and adds some new features, such as the ability to buy iTunes songs over a Wi-Fi connection. It also delivered a message to users of unlocked devices.
750010
Apple Computer (Nasdaq: AAPL) has released a patch for its Macintosh OS X operating system that fixes 15 security problems in the software.
664794
Apple unveiled the year's fifth major security update for Mac OS X to patch 17 vulnerabilities.
467342
(InfoWorld) - Apple Computer Inc. has fixed a number of flaws in the software that ships with its personal computers, including a bug in its AirPort wireless drivers that was disclosed earlier this month. The AirPort flaw was disclosed on Nov. 1 by security researcher HD Moore. It affects Proxim Wireless Corp. Orinoco wireless cards used by PowerBook and iMac computers built between 1999 and 2003, he said. These cards, which were branded AirPort by Apple, shipped with eMac, iBook, iMac, PowerBook G3, PowerBook G4 and Power Mac G4 systems, Apple said in a note on the updates , posted Tuesday. The issue does not affect systems that use the AirPort Extreme cards, Apple said. Apple warned that this flaw could be used by an attacker to run unauthorized software on a victim's computer, but Moore's exploit code could only be used to cause a computer to crash, the security researcher said. Security researchers have been paying a lot of attention to wireless device drivers since August, when researchers David Maynor and Jon Ellch reported that they'd discovered a number of significant flaws in wireless drivers, including one that affected Apple's computers. Maynor and Ellch were later criticized because they demonstrated these flaws using a third-party wireless card rather than the one that ships with Apple's MacBook, and because the two hackers have not published the code used in their attack. Nevertheless, Apple patched a number of vulnerabilities in its wireless drivers last September, saying that these were discovered in an internal audit of the company's software. Apple's Tuesday update also fixes several issues in products that ship with OS X, including flaws in the ClamAV antivirus software, Perl, PHP (PHP Hypertext Preprocessor) and Samba. In total, 22 patches were released in this update, named 2007-007 by Apple. Â
445264
All your iPhone are belong to us Apple has issued a notice that unlocked iPhones could suffer permanent damage when they update the firmware, and reminded customers that such damage is not covered by the warranty.â¦
301124
Security tools maker Finjan Software warned on Wednesday that it hadfound as many as 10 security flaws in the last update to Microsoft&#39;s flagship operating system, Windows XP Service Pack 2. In a statement
494470
Apple rolls out four patches as Microsoft scrambles to head off a zero-day attack. Also: Routers at risk.
21234
Apple kept its rush of year-end security patches coming Monday, issuing a flurry of fixes for its Mac OS X operating system and the test version of its Safari browser.Monday&#39;s patches included a whopping 31 updates for the Apple operating system. The Mac OS X patches fix components ranging from the Address Book and iChat software to under-the-covers operating system components such as ColorSync, the IO Storage Family, and the Perl, Python and Ruby programming languages.Most of these flaws theoretically could be exploited by attackers to run unauthorized software on the Mac, although some of them had other security implications, such as allowing an attacker to gain access to sensitive information or download files to the computer without authorization.These updates are for the Mac OS X 10.4 and 10.5 operating systems, known as Tiger and Leopard, respectively.Apple also released a minor update to its Safari 3 beta code, which runs on Windows as well as Mac OS X, fixing a cross-site scripting security problem that affects Windows users.The patches come just days after&#160;Apple released a major update to its QuickTime media player and a Java security fix for the Mac OS X 10.4 operating system, code-named Tiger. The QuickTime flaw was particularly serious, as&#160;it had been exploited by online criminals since early December.With hackers and security researchers now paying more attention to Apple&#39;s products, the company&#39;s security team has been working overtime on bug fixes this year. Monday&#39;s patches were Apple&#39;s 35th and 36th security updates this year. In 2006, the company released just 22 sets of patches for its products.
543451
(InfoWorld) - Less than a week after CEO Steve Jobs said that Apple wouldÂ fight hacksÂ that unlocked the iPhone, the company said any modification, unlocks included, voids the phone's warranty. Saying it had found that many of the unlocking programs "cause irreparable damage to the iPhone's software," Apple spelled out the policy. "Users who make unauthorized modifications to the software on their iPhone violate their iPhone software license agreement and void their warranty," the company said in a statement. "The permanent inability to use an iPhone due to installing software is not covered under the iPhone's warranty." Several unlock hacks are circulating, including the free open-source anySIM unlock created byÂ iPhone Dev Team,Â andÂ iPhoneSIMFree,Â a commercial unlocking program that sells between $45 and $90 online. The unlocks let users insert a SIM card programmed with account data from another mobile provider so the phone can make calls on that carrier's network, rather than solely over AT&T's. Other mods, or modifications, let iPhone owners install their own ring tones -- Apple charges $0.99 on top of the usual $0.99 tune fee for a ring tone -- and add new software to the Apple-approved applications on the device. Apple also said it would issue an iPhone update this week, and hinted -- as expected -- that it will use firmware updates toÂ cripple unauthorized modifications.Â "Apple has discovered that many of the unauthorized iPhone unlocking programs ... will likely result in the modified iPhone becoming permanently inoperable when a future Apple-supplied iPhone software update is installed," the statement said. The coming update has been no secret. Shortly after Jobs unveiled the new iPod line and announced the $200Â iPhone price dropÂ that angered many early buyers, Apple confirmed that it would update the device to add new features, including the ability to buy tracks from the iTunes music store over Wi-Fi. Not surprisingly, Apple's policy didn't scare off those who have modified their iPhones. On the company's iPhone support forum, a user identified as ansuz07 said, "The percentage of iPhones that have become bricked from hacks is very low. Even those that experienced problems could be fixed by a simple restore. Apple is going to make it sound a lot worse than it actually is since they are the ones who don't want you to do it in the first place." ComputerworldÂ is an InfoWorld affiliate. Â