Apple has released security updates for iPhone, iPod touch, and iPad to address flaws in both PDF handling and I/O—these flaws had been exploited recently to create a Web-based jailbreak for the company’s portable devices. iOS 4.0.2 is available via iTunes for the iPhone and iPod touch, and iOS 3.2.2 patches the flaw for iPad owners.
The Web-based jailbreak relied on two vulnerabilities to work. A flaw in the open source FreeType library, used by iOS’s PDF rendering engine, could result in a stack buffer overflow when handling CFF font data. A specially crafted PDF, such as the one at jailbreakme.com, could exploit the flaw to execute arbitrary code.
Once the overflow happened, an integer overflow flaw in IOSurface could be exploited to elevate privileges from user to root. With elevated privileges, the code from jailbreakme.com then removed the security features that prevent unsigned code from running on an iOS-based device.
However, security researchers publicized the flaw shortly after the jailbreak was released, noting that the flaws could likewise be exploited for more malicious purposes by simply getting a user to visit a website. Apple quickly acknowledged the problem and promised a fix. The updates released today add additional bounds checking for both libraries.
An update on air video. It does change the compression based on your connection speed. I was streaming some videos at the house last night and while on wifi they looked like flawless HD videos. This is probably the coolest app I’ve seen yet.
Yeah, but I’m doubting how well the wifi compressed video would stream over 3g anyway. Like I said in the initial review… the 3g streaming was still very high quality, probably as much as you can push over 3g without getting a lot of drops.
I just notice a huge difference for example between WiFi and 3G on even YouTube. The 3GS and iPhone4 in theory can pull down like 200KBps at least over the air so it should be fine to do high quality video. Hulu+ looks great over 3G on the retina display so I know its possible.
I am inside a office complex too. Maybe I will check it out at lunch. I do remember downloading torrents to my iP4 over 3G pretty fast when I was on my porch.
My hand was forced today to get the iPhone4, my 3g now no longer recognizes on the computer and charges at less than slug pace when connected to the computer, that coupled with the home button being broke (did actually order the replacement) I decided to just get the 4.
Galleria Apple store had them in stock… one disadvantage is stock with 4.0.2 so no jailbreak since cannot downgrade without shsh blobs. Just a forewarning for anyone getting one you will be SOL with jailbreak for now.
Wow best iPhone mod yet. For anyone who likes the Android notification panel and wnats it on the iPhone, check out NotifyPro with the StatusBar plugin.
Works AWESOME for Push and SMS notifications. Here is some screenshots. This one is using the StatusBar plugin and also the Notifier Plugin. You swipe down on the status bar (or anyway you setup in Activator) and you can open the panel for all your notifications.
