Apple on Friday issued an update for iTunes 8 that specifically addresses problems experienced by Windows Vista users, and issued general recommendations for Windows XP and Vista users experiencing sync issues with iPhone and iPod touch devices.
Since its release earlier in the week, iTunes 8 has bedeviled some Windows Vista users with the so-called blue screen of death, or BSOD, and other issues. Speculation has focused on an incompatibility with USB devices, such as Webcams and printers.
In a support post, Apple recommends that Windows Vista users experiencing difficulty should uninstall iTunes 8 and, after rebooting the computer, reinstall the updated application. (You can download the updated iTunes 8 for Windows from CNET's Download.com.)
Also on Friday, Apple posted recommendations regarding problems experienced by Windows XP and Windows Vista users when syncing the iPhone or iPod Touch devices containing saved photos. Apple says that "while any driver software could be a factor, updating the software drivers for Logitech QuickCam/Webcam products, Lexmark scanners, and some built-in media card reader drivers on the computer may solve this issue in a majority of cases."
On Tuesday, Apple released iPod Touch version 2.1 to address several security issues. Among them are the DNS vulnerabilities first reported by Dan Kaminsky of IOActive in July. Other issues include vulnerabilities in Webkit, CoreGraphics, and the Application Sandbox.
Earlier on Tuesday, Apple released updates to its QuickTime media player.
Apple notes that this update is only available through iTunes as part of the iPod Touch updating process and will not appear in your computer's Software Update application, nor can it be found on the Apple Downloads site.
Application Sandbox
This patch affects users of iPod Touch v2.0 through v2.0.2. The update addresses the information disclosure vulnerability detailed within CVE-2008-3631. Apple says "the Application Sandbox does not properly enforce access restrictions between third-party applications. This may allow a third-party application to read files in another third-party application's sandbox and lead to the disclosure of sensitive information." Apple credits Nicolas Seriot of Sen:te and Bryce Cogswell for reporting the vulnerability. This issue does not affect iPod Touch versions prior to v2.0.
CoreGraphics
This patch affects users of iPod Touch v1.1 through v2.0.2. The update addresses the FreeType v2.3.5 vulnerabilities within CVE-2008-1806, CVE-2008-1807, CVE-2008-1808. Apple says the most serious of these vulnerabilities may lead to arbitrary code execution when accessing maliciously crafted font data.
mDNSResponder
This patch affects users of iPod Touch v1.1 through v2.0.2. The update addresses the cache poisoning vulnerability within CVE-2008-1447. Apple explains that mDNSResponder provides translation between host names and IP addresses for applications that use its unicast DNS resolution API. A weakness in the DNS protocol may allow a remote attacker to perform DNS cache poisoning attacks. As a result, applications that rely on mDNSResponder for DNS may receive forged information.
Networking
This patch affects users of CVE-2008-3612. The update addresses the memory corruption issue vulnerability details within CVE-2008-3626. Apple says the TCP initial sequence numbers are sequentially generated. Predictable initial sequence numbers may allow a remote attacker to create a spoofed TCP connection or insert data into an existing TCP connection.
WebKit
This patch affects users of iPod Touch v1.1 through v2.0.2. The update addresses a vulnerability detailed within CVE-2008-3632. Apple says that a use-after-free issue exists in WebKit's handling of CSS import statements. Visiting a maliciously crafted Web site may lead to an unexpected application termination or arbitrary code execution.
Updated 12:05 p.m. PDT Friday to correct where the update is available. It is available through iTunes.
On Friday, Apple released iPhone 2.0 and iPod Touch 2.0 firmware that includes several security fixes for Safari and WebKit. Several of the Safari fixes have been previously issued for Mac OS X and Windows. The update, APPLE-SA-2008-07-11, is only available through iTunes.
This update will not appear in your computer's Software Update application or on the Apple Downloads site. The patches may take up to one week to be detected, depending on the day a device checks. A manual update can be accomplished by using the "Check for Update" button within iTunes.
CFNetwork
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses CVE-2008-0050, a spoofing vulnerability. Apple says " A malicious HTTPS proxy server may return arbitrary data to CFNetwork in a 502 Bad Gateway error, which could allow a secure website to be spoofed. This update addresses the issue by not returning the proxy-supplied data on an error condition."
Kernel
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-0177. Apple explains: "An undetected failure condition exists in the handling of packets with an IPComp header. Sending a maliciously crafted packet to a system configured to use IPSec or IPv6 may cause an unexpected device reset. This update addresses the issue by properly detecting the failure condition."
Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-1588. Apple explains: "When Safari displays the current URL in the address bar, Unicode ideographic spaces are rendered. This allows a maliciously crafted website to direct the user to a spoofed site that visually appears to be a legitimate domain. This update addresses the issue by not rendering Unicode ideographic spaces in the address bar."
Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability within CVE-2008-1589. Apple says " When Safari accesses a website that uses a self-signed or invalid certificate, it prompts the user to accept or reject the certificate. If the user presses the menu button while at the prompt, then on the next visit to the site, the certificate is accepted with no prompt. This may lead to the disclosure of sensitive information." Apple credits Hiromitsu Takagi with reporting this vulnerability.
Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the arbitrary code execution vulnerability within CVE-2008-2303. Apple explains "A signedness issue in Safari's handling of JavaScript array indices may result in an out-of-bounds memory access. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of JavaScript array indices." Apple credits SkyLined of Google for reporting the vulnerability.
Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the cross-site scripting vulnerability details within CVE-2006-2783. Apple explains "Safari ignores Unicode byte order mark sequences when parsing web pages. Certain websites and web content filters attempt to sanitize input by blocking specific HTML tags. This approach to filtering may be bypassed and lead to cross-site scripting when encountering maliciously-crafted HTML tags containing byte order mark sequences. This update addresses the issue through improved handling of byte order mark sequences." Apple credits Chris Weber of Casaba Security for reporting the vulnerability.
Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-2307. Apple says "A memory corruption issue exists in WebKit's handling of JavaScript arrays. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution." Apple credits James Urquhart for reporting the vulnerability.
Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-2317. Apple explains "A memory corruption issue exists in WebCore's handling of style sheet elements. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue through improved garbage collection." Apple credits Peter Vreudegnhil working with the TippingPoint Zero Day Initiative for reporting the vulnerability.
Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2007-6284. Apple says "A memory consumption issue exists in the handling of XML documents containing invalid UTF-8 sequences, which may lead to a denial of service."
Safari
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-1767. Apple says "A memory corruption issue exists in the libxslt library. Viewing a maliciously crafted HTML page may lead to an unexpected application termination or arbitrary code execution." Apple credits Anthony de Almeida Lopes of Outpost24 AB, and Chris Evans of Google Security Team for reporting the vulnerability.
WebKit
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-1590. Apple says "A memory corruption issue exists in JavaScriptCore's handling of runtime garbage collection. Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution." Apple credits Itzik Kotler and Jonathan Rom of Radware for reporting the vulnerability.
WebKit
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-1025. Apple says "An issue exists in WebKit's handling of URLs containing a colon character in the host name. Accessing a maliciously crafted URL may lead to a cross-site scripting attack. This update addresses the issue through improved handling of URLs." Apple credits Robert Swiecki of the Google Security Team, and David Bloom for reporting the vulnerability.
WebKit
This patch affects users of iPhone v1.0 through v1.1.4, and iPod Touch v1.1 through v1.1.4. The update addresses the vulnerability detailed within CVE-2008-1026. Apple says "A heap buffer overflow exists in WebKit's handling of JavaScript regular expressions. The issue may be triggered via JavaScript when processing regular expressions with large, nested repetition counts. This may lead to an unexpected application termination or arbitrary code execution." Apple credits Charlie Miller of Independent Security Evaluators for reporting the vulnerability.
- prev
- 1
- next
