Apple has responded to the security alert reported yesterday about the iPhone being vulnerable by SMS, where a hacker could lock up your iPhone, rending it useless, or even take control over it remotely.Apple has released a patch for the SMS vulnerability, available immediately on iTunes. The firmware update, labeled as 3.0.1, contains only an update for the SMS attack. In the description of the update on Apple.com describes the update as:
A memory corruption issue exists in the decoding of SMS messages. Receiving a maliciously crafted SMS message may lead to an unexpected service interruption or arbitrary code execution. This update addresses the issue through improved error handling. Credit to Charlie Miller of Independent Security Evaluators, and Collin Mulliner of Fraunhofer SIT for reporting this issue.
The update is available for all iPhone users, including first generation, iPhone 3G and iPhone 3GS.
Just a warning to all, this will undo and erase all jailbroken applications!
Just a warning to all, this will undo and erase all jailbroken applications!
boooo
The reason it is that size is because they never actually just change files with the update its a Firmware update with means they replace the whole Image of the OS on the system where as a patch for a program can only be the required files a firmware is a solid chunk that needs replacing.
Close
Might want to add that into the article.
Err, are you suggesting that companies have to pay researchers for them finding exploits?
Pay, no, but some sort of token, like a gift card or something wouldn't be bad for PR.
The timeliness of the fix and official credit to those that discovered the flaw is definitely a good thing.
The timeliness of the fix and official credit to those that discovered the flaw is definitely a good thing.
Yea... This could of been a very serious issue but it was brought up to Apple's attention and allowed the to fix it.
The timeliness of the fix and official credit to those that discovered the flaw is definitely a good thing.
When have Apple ever been worried about getting bad (or good for that matter) PR?
FWIW, about your complaint about updating iTunes, MOST software that I've ever downloaded required you to download a full installer for each new update, I really don't know of much that doesn't.
230MB is the size of the whole firmware, its an updated firmware, not a patch. "they" as in neowin calls it a patch, but its a whole OS with a new fix in it.
I not to recently tried out Itunes and it left a bad impression. Slow, laggy, and lacking applicaiton.
Because it also includes Quicktime (which is the backend for playing the audio and video in iTunes). It also has to have drivers and other files for every iPod as well as its built in CD burning function. Also has the Bonjour service included. It's also an international release, it doesn't include just English files in it. It roughly expands to a little over double the installer size between Quick Time and iTunes and everything it needs. Also note Quicktime is an international release as well as it contains more than one language project folders.
Maybe it was a botched firmware install when you updated to 3.0, and this one went better.
Maybe it was a botched firmware install when you updated to 3.0, and this one went better.
It would be ridiculously rare for it to be botched in this particular way. Not only are the images signed, but for that to be the only problem, wow, it would be a huge improbability.
Maybe 4.0 will be different, allowing smaller patches to be available, but with that comes numbers amounts of vulnerability holes in the software...
I don't think people are complaining that the fix is out (although it perhaps could have arrived sooner ideally).
Yes beta3 includes the fix (so I hear...)
Any other fixes at all?
Your tethering loophole will be fixed in 3.1
I guess I won't bother with 3.1 when that comes out as the tethering is hugely useful to me.
Your tethering loophole will be fixed in 3.1
I'm running 3.1 beta 3 and the tethering hack still works fine. :/
Hi there
No is not a patch for battery
cya
Just look at your forum and around the Internet are you blind or just ignoring the fact the software update may have been a sucess with the iPhone but it sure not the case with the iPod Touch.
Cya
Apple has publically acknowledged the two people who found this issue. That does not happen very often (you don't see those in Microsoft Update do you?). That's recognition enough don't you think?
Apple has publically acknowledged the two people who found this issue. That does not happen very often (you don't see those in Microsoft Update do you?). That's recognition enough don't you think?
No, they don't credit people on WU/MU, but they have issued props to the discovering parties quite a few times in the past.
apple really program in wierd ways, anyone knew that safari on the iphone/ipod uses the mail app to create bookmarks? noticed this due to the fact that 3.0 have problems with hidden apps :/
2. Seriously there should have been an update out much earlier adressing som other erros out there, like the random wifi/internet problems... me and a friend both have 16gb ipod touches, his cant use internet with 3.0 or barely with some luck, i just noticed the ipod touch can do over 1mbit/s download over wifi
http://en.wikipedia.org/wiki/Short_message_service
Larger content (Concatenated SMS, multipart or segmented SMS or "long sms") can be sent using multiple messages, in which case each message will start with a user data header (UDH) containing segmentation information. Since UDH is inside the payload, the number of characters per segment is lower: 153 for 7-bit encoding, 134 for 8-bit encoding and 67 for 16-bit encoding. The receiving handset is then responsible for reassembling the message and presenting it to the user as one long message. While the standard theoretically permits up to 255 segments,[27] 6 to 8 segment messages are the practical maximum, and long messages are often billed as equivalent to multiple SMS messages. See Concatenated SMS for more information. Some providers have offered length-oriented pricing schemes for SMSs, however, the phenomenon is disappearing.
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.