Apple Releases Firmware 3.0.1

Apple Today, Apple released firmware 3.0.1. The firmware was released in order to fix the SMS bug that leaves all iPhones vulnerable to attack. Like with all firmware upgrades, you will want to hold off on upgrading if you currently have a jailbroke iPhone or iPod Touch. The Dev-Team hasn’t released any info about a new jailbreak but, we will keep our eyes open for any info from them. Below is info from Apple about the new firmware.

Apple’s Info about 3.0.1 Upgrade

Summary
This document describes the security content of iPhone OS 3.0.1.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see “How to use the Apple Product Security PGP Key.

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see “Apple Security Updates.

Products Affected
iPhone, Product Security

iPhone OS 3.0.1
*CoreTelephony
CVE-ID: CVE-2009-2204

Available for: iPhone OS 1.0 through iPhone OS 3.0

Impact: Receiving a maliciously crafted SMS message may lead to an unexpected service interruption or arbitrary code execution

Description: A memory corruption issue exists in the decoding of SMS messages. Receiving a maliciously crafted SMS message may lead to an unexpected service interruption or arbitrary code execution. This update addresses the issue through improved error handling. Credit to Charlie Miller of Independent Security Evaluators, and Collin Mulliner of Technical University Berlin for reporting this issue.

See original document HERE.

Quote from Apple Rep.
“We appreciate the information provided to us about SMS vulnerabilities which affect several mobile phone platforms. This morning, less than 24 hours after a demonstration of this exploit, we’ve issued a free software update that eliminates the vulnerability from the iPhone. Contrary to what’s been reported, no one has been able to take control of the iPhone to gain access to personal information using this exploit.”

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading...

Comments

  1. Mr. Lugosi says

    redsn0w-win_0.7.1 doesn’t “recognize” the 3.0.1 ispw. (Yeah, my bad, I accidentally messed up and should have tried 0_7.2, but I imagine it will have the same problem).

    • I read somewhere purplesnow still works with 3.0.1 ispw try that, good luck

    • Mr. Lugosi says

      It turns out that all I had to do was show it my 3.0 ispw, and it then jailbroke my phone. Now I’m having to reinstall all of the apps I got though Cydia because I didn’t think about that, but …. oh well.

      So… you can definitely upgrade and jailbreak it again with what is out there right now.

      You lose all of your jailbroken apps though, but I’ve already read where at least one person is planning to Cydia app that will work to copy your jailbroken apps into 3.0.1 and make this upgrade much easier. Probably worth waiting for unless you’re bored or paranoid, or just want to play around.