Sunday, July 17, 2011

Download iOS 4.3.4 / 4.2.9 IPSW for iPhone, iPad, iPod touch

Apple is making good on its promise to close a hole that posed security risks to iOS customers by releasing two separate software updates for users of GSM and CDMA iPhones and iPads, as well as iPod touch players.

iOS 4.3.4 and iOS 4.2.9 fix a security vulnerability associated with viewing malicious PDF files.

As avid the readers will recall, this flaw allowed jailbreak artist Comex (of the iPhone Dev Team) to update his web-based JailbreakMe hack in order to support devices running all iOS 4.3.x versions through iOS 4.3.3.

For those who are currently jailbroken, iOS 4.3.4 / 4.2.9 closes that PDF hole, effectively removing the jailbreak as well.

There is also a way to eliminate the PDF vulnerability and preserve one’s jailbreak by downloading a patch from Cydia.

On its Support web site, Apple talks more broadly about the security content of iOS 4.2.9 / 4.3.4 Software Update for iPhone.

These two knowledge base articles reveal that Apple’s latest iOS updates patch not one, but three bugs in the latest firmware version for iPhones, iPads, and iPod touch devices.

There are actually two ways to cause unexpected application termination or arbitrary code execution by means of viewing a maliciously crafted PDF file.

The door is opened by a buffer overflow in FreeType's handling of TrueType font files, as well as a signedness issue that exists in FreeType's handling of Type 1 fonts.

A third bug affecting IOMobileFrameBuffer is present on iOS 4.2.5 through 4.2.8 for iPhone 4 (CDMA model), as well as for iOS 3.0 through 4.3.3 for iPhone 3GS and iPhone 4 (GSM model), iOS 3.1 through 4.3.3 for iPod touch (3rd generation) and later, iOS 3.2 through 4.3.3 for iPad.

“An invalid type conversion issue exists in the use of IOMobileFrameBuffer queueing primitives, which may allow malicious code running as the user to gain system privileges,” the security advisory explains.

This is one flaw that jailbroken users cannot currently patch and preserve their jailbreak too.

Download iOS 4.2.9 / 4.3.4 for iPhone / iPod touch (Free)

Download iOS 4.3.4 for iPad GSM / CDMA (Free)