Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2011.0773
iOS Software Updates
26 July 2011
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Apple iOS
Publisher: Apple
Operating System: Apple iOS
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Provide Misleading Information -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2011-0228
Comment: This bulletin contains two (2) Apple security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2011-07-25-1 iOS 4.3.5 Software Update
iOS 4.3.5 Software Update is now available and addresses the
following:
Data Security
Available for:
iOS 3.0 through 4.3.4 for iPhone 3GS and iPhone 4 (GSM),
iOS 3.1 through 4.3.4 for iPod touch (3rd generation) and later,
iOS 3.2 through 4.3.4 for iPad
Impact: An attacker with a privileged network position may capture
or modify data in sessions protected by SSL/TLS
Description: A certificate chain validation issue existed in the
handling of X.509 certificates. An attacker with a privileged network
position may capture or modify data in sessions protected by SSL/TLS.
Other attacks involving X.509 certificate validation may also be
possible. This issue is addressed through improved validation of
X.509 certificate chains.
CVE-ID
CVE-2011-0228 : Gregor Kopf of Recurity Labs on behalf of BSI, and
Paul Kehrer of Trustwave's SpiderLabs
Installation note:
This update is only available through iTunes, and will not appear
in your computer's Software Update application, or in the Apple
Downloads site. Make sure you have an Internet connection and have
installed the latest version of iTunes from www.apple.com/itunes/
iTunes will automatically check Apple's update server on its weekly
schedule. When an update is detected, it will download it. When
the iPhone, iPod touch or iPad is docked, iTunes will present the
user with the option to install the update. We recommend applying
the update immediately if possible. Selecting Don't Install will
present the option the next time you connect your iPhone, iPod touch,
or iPad.
The automatic update process may take up to a week depending on the
day that iTunes checks for updates. You may manually obtain the
update via the Check for Updates button within iTunes. After doing
this, the update can be applied when your iPhone, iPod touch, or iPad
is docked to your computer.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update will be
"4.3.5 (8L1)".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (Darwin)
iQEcBAEBAgAGBQJOKaOnAAoJEGnF2JsdZQeeQQMIALAq3PesmBcGIB6z7OYonloO
Fp68K1GNYjYbNUOxgfDuBRrLwNSMDYfRSKDNvHW+rbbHEss7WIQzXQc7s3QEhZ6y
BYfZ8WyJTa3Pb3JRmoFSMjbZ35wFLs5vKnnOjurihaqewL6tLZr6j2PilBYZCsh2
DDMyIFus1VyXjpWoUmmt5Xt51xhDX8MnMXOrjJowBT+HLtGCzbYL6SIZbPbvU0LW
+50De5Ml6kag/CvI29MV1axBEPdcyNm+6YCQiRxLNnVP587aUeEUavNPy8sOBj3F
sAJFgsKdDNxxOrK31q4NZ9Nqks/v/St1thHLkj2wmLdiccfwv3SaQm+4npgShzc=
=xc9n
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2011-07-25-2 iOS 4.2.10 Software Update for iPhone
iOS 4.2.10 Software Update for iPhone is now available and addresses
the following:
Data Security
Available for: iOS 4.2.5 through 4.2.9 for iPhone 4 (CDMA)
Impact: An attacker with a privileged network position may capture
or modify data in sessions protected by SSL/TLS
Description: A certificate chain validation issue existed in the
handling of X.509 certificates. An attacker with a privileged network
position may capture or modify data in sessions protected by SSL/TLS.
Other attacks involving X.509 certificate validation may also be
possible. This issue is addressed through improved validation of
X.509 certificate chains.
CVE-ID
CVE-2011-0228 : Gregor Kopf of Recurity Labs on behalf of BSI, and
Paul Kehrer of Trustwave's SpiderLabs
Installation note:
This update is only available through iTunes, and will not appear
in your computer's Software Update application, or in the Apple
Downloads site. Make sure you have an Internet connection and have
installed the latest version of iTunes from www.apple.com/itunes/
iTunes will automatically check Apple's update server on its weekly
schedule. When an update is detected, it will download it. When
the iPhone is docked, iTunes will present the user with the option
to install the update. We recommend applying the update immediately
if possible. Selecting Don't Install will present the option the
next time you connect your iPhone.
The automatic update process may take up to a week depending on the
day that iTunes checks for updates. You may manually obtain the
update via the Check for Updates button within iTunes. After doing
this, the update can be applied when your iPhone is docked to your
computer.
To check that the iPhone has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update will be
"4.2.10 (8E600)".
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (Darwin)
iQEcBAEBAgAGBQJOKaO4AAoJEGnF2JsdZQeeZJAH/AgzQw32cHPdHMZMufmeTx7C
q0I1yzI+uF8HDERM8VfDg98rjVFbhcKKyeA1FNe1lGz79sIpo6Px4QubCRKyt2RW
FbLYNGlWNreNodBr8FhAQcVqYbHLogD1O/Y+MVeU9i4pVfO6gXFfaMHWZkaZDlZd
m9DLyPxAJ9uRtb9AYz3YL7Dp52YoW5yApSnpqV2dm5LE9L7ysvZ6inDOme0figAH
v8+MDE18x1Caw3n0f2cWd6Sz9jqjvIodgp8iYWMEYnsRUZtFlFyxbSQSJFeFq1Ul
y8N12gycPaWCJsqQyfFEruTcqHnV9kBVZV9TACT6UdtRkULXtsFEsqi6+8PI2mo=
=yzpz
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBTi434u4yVqjM2NGpAQJQdxAAgOArVLigx3fvEYAVfBSEabV69cgQ206y
6zIWWQdx/8ap/6TSL7UbR8QXPDW0HWfxCOOrl/Yu3dAy9Xfn23nb1iEC/U/sm8rZ
E/rkPySSUDJpOewKSigWiwsm8NZ7vo1U3zI1q4vtnVKY9MLzrJQXtHdtyzuscyD+
Z2JXx5o7Og4MDqWzYSOimibzCjgTyjTSfWaANkeJagmue59MR+Txdb0M2v5YJbwU
9HL9wZXWgayHq2LOOopfGHrc67RZm4GLaHqTElEEQeQ5A/ZsYw0nMlrFMcC1Ylef
TGJ+G4loAFGjbkuH+ZcCKy/ZVkbGKuE8mqkBxdHmjDPuWJAALhD3/u84UD2c1cs9
YsrVZnHJLzlMxeoRIM6oLezAw5FccyfzerfAMegqoByloAioWhxTIpajI85JwOPL
M6UTHuaHmZZWGWwj6YRTtXrVK5rZe8YDGaUcjONI1HZ7HXTEb0pQ+MDmOKXe0TdD
R1VcFdaxz58j3SqDe9eQFvpOuq4+7kyMoFIcWtufoO0sGDIIV0s3dEWEFGpB+CGe
1T5sPJZQy/QsF7a+LET90xJvrMQubhYPUSZ4Fj9HJRezLG+aGWV+9p5eVMk7IdNY
xZd4CR8KtXvl3TWaZ+gZh3jtTe8US69391ZuIwsolDNEzdAVB18NwMmWHx6pneqb
FaXEav9HMEw=
=5udG
-----END PGP SIGNATURE-----