Apple has finally released the highly-anticipated iOS 4.2. While the attention around iOS 4.2 has been focused on the enhancements and new features -- particularly for the iPad, the update also fixes more than 80 vulnerabilities in the iPhone, iPod, and iPad.
It is common knowledge that iOS 4.2 introduces features like multitasking -- or at least Apple's pseudo version of multitasking -- a unified e-mail inbox, and the ability to organize apps by grouping them in folders to the iPad. It also includes a variety of enhancements aimed at IT admins that make it easier to manage and protect iPads connected to a corporate network. The massive barrage of security updates, however, flew in under the radar.
It's not that Apple is unwilling to admit that there are security issues, but Apple policy dictates that the vulnerabilities not be publicly disclosed until the patch is available. An Apple Web page detailing the security updates in iOS 4.2 explains, "For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available."
So, now that iOS 4.2 is out and the "patches or releases are available" it is safe to let you know that your iPhone, iPod, and iPad have been virtually Swiss cheese from a security standpoint. The iPhone and iPad are both now protected against more than 80 vulnerabilities -- many with critical security implications -- that most users were not even aware existed two days ago.
For example, viewing a PDF file is a relatively common task for an iPhone or iPad. According to Apple, it is also a potentially risky task on pre-iOS 4.2 devices. "A heap buffer overflow exists in FreeType's handling of TrueType opcodes [CVE-2010-3814]. Viewing a PDF document with maliciously crafted embedded fonts may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking."
If you have surfed the Web on an iPhone or iPad, you might be interested to learn that a vast array of flaws exist that could allow an attacker to execute arbitrary malicious code on your device. There is also a vulnerability which reveals your surfing history. "A design issue exists in WebKit's handling of the CSS :visited pseudo-class. A maliciously crafted website may be able to determine which sites a user has visited. This update limits the ability of web pages to style pages based on whether links are visited."
These are just a few examples. Many of the more than 80 flaws addressed in iOS 4.2 have very serious security implications. While the general public wasn't aware of these flaws, attackers probably were. If they weren't they are now -- so the clock is ticking to get the iOS 4.2 update applied before malicious developers find ways to exploit these vulnerabilities.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.