Just when you think they can’t pull another one off, Apple does it again. No, we’re not talking about killer consumer electronics products, we’re talking about security updates of record-setting girth.
Only 45 of the 85 vulnerability fixes described in Apple’s latest iOS security advisory apply to the new iOS 4.2 version. iOS 3.2 through 3.2.2 for iPad incorporates another 40 fixes on top of those. 8 of the vulnerability fixes for iOS also affect Apple TV and are fixed in the new version 4.1 of that product.
It’s always fun to look for the oldest vulnerability listed by Apple and this update is no exception. CVE-2009-1707, revealed to the public on 6/10/2009 and just fixed today, describes an error which could allow a user with physical access to the device to view stored web site passwords. It’s not the most serious bug, but 17 months+ is a long time.
But many of the other vulnerabilities are classic critical bugs where reading a file can lead to remote code execution. Normal users run in a less privileged mode, but combined with CVE-2010-3830 (“Malicious code may gain system privileges“), a more severe compromise is possible.
Time to go to iTunes and apply updates.
– on Security Watch
