iOS 4.2 includes massive security update for iPad and iPhone

All of the attention has been focused on the enhancements, while more than 80 security fixes flew in under the radar.

Apple has finally released the highly-anticipated iOS 4.2. While the attention around iOS 4.2 has been focused on the enhancements and new features -- particularly for the iPad, the update also fixes more than 80 vulnerabilities in the iPhone, iPod, and iPad.

It is common knowledge that iOS 4.2 introduces features like multitasking -- or at least Apple's pseudo version of multitasking -- a unified e-mail inbox, and the ability to organize apps by grouping them in folders to the iPad. It also includes a variety of enhancements aimed at IT admins that make it easier to manage and protect iPads connected to a corporate network. The massive barrage of security updates, however, flew in under the radar.

It's not that Apple is unwilling to admit that there are security issues, but Apple policy dictates that the vulnerabilities not be publicly disclosed until the patch is available. An Apple Web page detailing the security updates in iOS 4.2 explains, "For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available."

So, now that iOS 4.2 is out and the "patches or releases are available" it is safe to let you know that your iPhone, iPod, and iPad have been virtually Swiss cheese from a security standpoint. The iPhone and iPad are both now protected against more than 80 vulnerabilities -- many with critical security implications -- that most users were not even aware existed two days ago.

For example, viewing a PDF file is a relatively common task for an iPhone or iPad. According to Apple, it is also a potentially risky task on pre-iOS 4.2 devices. "A heap buffer overflow exists in FreeType's handling of TrueType opcodes [CVE-2010-3814]. Viewing a PDF document with maliciously crafted embedded fonts may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved bounds checking."

If you have surfed the Web on an iPhone or iPad, you might be interested to learn that a vast array of flaws exist that could allow an attacker to execute arbitrary malicious code on your device. There is also a vulnerability which reveals your surfing history. "A design issue exists in WebKit's handling of the CSS :visited pseudo-class. A maliciously crafted website may be able to determine which sites a user has visited. This update limits the ability of web pages to style pages based on whether links are visited."

These are just a few examples. Many of the more than 80 flaws addressed in iOS 4.2 have very serious security implications. While the general public wasn't aware of these flaws, attackers probably were. If they weren't they are now -- so the clock is ticking to get the iOS 4.2 update applied before malicious developers find ways to exploit these vulnerabilities.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags tabletsAppleoperating systemssoftwareapple iphoneapple ipadiphone 4patches & driversMac OSiOS 4.2Apple iOS 4.2

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tony Bradley

PC World (US online)
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?