APPLE-SA-2008-09-12 iPhone v2.1 [Telecom]

Monty Solomon · 2008-09-14T14:10:43+00:00

APPLE-SA-2008-09-12 iPhone v2.1iPhone v2.1 is now available and addresses the following issues:Application SandboxCVE-ID: CVE-2008-3631Available for: iPhone v2.0 through v2.0.2Impact: An application may be able to read another application'sfilesDescription: The Application Sandbox does not properly enforceaccess restrictions between third-party applications. This may allowa third-party application to read files in another third-partyapplication's sandbox, and lead to the disclosure of sensitiveinformation. This update addresses the issue by enforcing the properaccess restrictions between application sandboxes. Credit to NicolasSeriot of Sen:te and Bryce Cogswell for reporting this issue. Thisissue does not affect iPhone versions prior to v2.0.CoreGraphicsCVE-ID: CVE-2008-1806, CVE-2008-1807, CVE-2008-1808Available for: iPhone v1.0 through v2.0.2Impact: Multiple vulnerabilities in FreeType v2.3.5Description: Multiple vulnerabilities exist in FreeType v2.3.5, themost serious of which may lead to arbitrary code execution whenaccessing maliciously crafted font data. This update addresses theissue by incorporating the security fixes from version 2.3.6 ofFreeType. Further information is available via the FreeType site atCVE-ID: CVE-2008-1447Available for: iPhone v1.0 through v2.0.2Impact: mDNSResponder is susceptible to DNS cache poisoning and mayreturn forged informationDescription: mDNSResponder provides translation between host namesand IP addresses for applications that use its unicast DNS resolutionAPI. A weakness in the DNS protocol may allow a remote attacker toperform DNS cache poisoning attacks. As a result, applications thatrely on mDNSResponder for DNS may receive forged information. Thisupdate addresses the issue by implementing source port andtransaction ID randomization to improve resilience against cachepoisoning attacks. Credit to Dan Kaminsky of IOActive for reportingthis issue.NetworkingCVE-ID: CVE-2008-3612Available for: iPhone v2.0...

Sep 14, 2008 0 Replies

Rate this thread:

Monty Solomon 17 years ago

Vote

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required

APPLE-SA-2008-09-12 iPhone v2.1 [Telecom]

Related discussions

APPLE-SA-2008-07-11 iPhone 2.0 and iPod touch 2.0

APPLE-SA-2009-06-17-1 iPhone OS 3.0 Software Update

APPLE-SA-2011-07-15-2 iOS 4.2.9 Software Update for iPhone [telecom]

Join the Discussion

Didn't find your answer?