Apple Fixes Bugs To Give iCloud A Clean Start

Coinciding with the launch of the new iCloud service, Apple has rolled out massive updates fixing scores of security vulnerabilities in Mac OS X, iOS and related software.

The latest mobile operating system, iOS 5, requires the latest version of iTunes to install. Apple released a new version of its iTunes software for Windows on 11 October. If those two major upgrades were not enough, Apple also updated the Mac OS X Lion operating system with 10.7.2. A security update for Snow Leopard users, 10.6, is also available.

Strained Apple Resources

Users trying to access so many updates so close together are putting a strain on Apple servers, resulting in long download times and strange error messages when trying to install, according to irate users on Twitter and Apple support forums.

The upgrades are necessary for users interested in using iCloud to synchronise music, photos, documents and other files across their iPhone, iPad or iPod Touch and the Mac desktop. The latest iTunes, version 10.5, is necessary to upgrade to newer models of the iPhone, iPad and iPod Touch to iOS 5. Both the Mac and Windows versions of iTunes have all the features necessary to take advantage of iCloud support, wireless synchronisation and iOS 5.

The iTunes 10.5 for Windows update patched 79 security vulnerabilities in a slew of components, including WebKit, ColorSync, CoreFoundation, CoreAudio, CoreMedia and ImageIO, according to Apple’s advisory. WebKit alone accounted for 73 bugs that Apple fixed in this version of iTunes. The framework is a core part of iTunes and the Safari Web browser and all but one of them were memory corruption vulnerabilities. Several of the bugs, if exploited, could have resulted in an attacker remotely executing code on the affected Mac. Other WebKit issues would have resulted in denial-of-service conditions or crashed iTunes, according to Apple.

Apple fixed the security issues in iTunes only in the Windows version, and rolled the fixes in to the OS X updates for Mac users.

In the Mac OS X 10.7.2 update and the update for 10.6 (Snow Leopard), Apple fixed 75 known vulnerabilities in the operating system, Chester Wisniewski, senior security advisor at Sophos, told eWEEK. Most could lead to arbitrary code execution while others could result in denial of service or escalation of privileges, Wisniewski said.

Lion Vulnerabilities Tamed

Apple addressed “quite a few important security issues,” including the vulnerabilities with Open Directory that had been introduced this summer with the release of Lion, the latest Mac OS X operating system. The various flaws in Open Directory allowed people to read other users’ password hashes, change passwords without having to know the old password, and logging into the system without a password, according to Wisniewski. The OS X update also fixed how Web cookies are stored and handled so that malicious sites could no longer read information stored on them.

Apple also released a new version of the Safari Web browser for Lion and Snow Leopard. Wisniewski estimated there were approximately another 70 security flaws fixed in the browser update.

Apple also removed the DigiNotar certificates from its mobile devices in iOS 5. While the company had removed the embattled certificate authority from the desktop last month after reports emerged of attackers compromising DigiNotar to issue fraudulent SSL certificates for major Websites, mobile devices running Safari had remained unprotected.

There is already a jailbreak available for iOS5. At the moment, only a tethered jailbreak exists for iOS 5 running on iPhone 4, 3GS, iPad and iPod Touch. A tethered jailbreak means the user has to connect the mobile device to the computer to run the code. An untethered jailbreak is expected shortly, according to rumours.