iOS 6.1.3 : salve de correctifs contre le jailbreak Evasi0n

Les auteurs du dernier jailbreak Evasi0n sont crédités à de multiples reprises dans les deux mises à jours iOS et pour Apple TV distribuées aujourd'hui. Une pratique courante - chez Apple comme ailleurs - dans ce contexte. Ainsi, iOS 6.1.3 contient six correctifs, dont la paternité de la découverte est attribuée aux evad3rs pour 4 d'entre eux. Autant de failles de sécurités exploitées par leur jailbreak qui sont refermées (lire aussi Jailbreak : Apple cherche à bloquer evasi0n). Quant aux 3 correctifs de la mise à jour 5.2.1 de l'Apple TV, les evad3rs sont de nouveau à l'honneur et pour la totalité, puisqu'il s'agit de bugs identiques (lire Comment le jailbreak Evasi0n fonctionne).

dyld Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later Impact: A local user may be able to execute unsigned code Description: A state management issue existed in the handling of Mach-O executable files with overlapping segments. This issue was addressed by refusing to load an executable with overlapping segments. CVE-ID CVE-2013-0977 : evad3rs Kernel Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later Impact: A local user may be able to determine the address of structures in the kernel Description: An information disclosure issue existed in the ARM prefetch abort handler. This issue was addressed by panicking if the prefetch abort handler is not being called from an abort context. CVE-ID CVE-2013-0978 : evad3rs Lockdown Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later Impact: A local user may be able to change permissions on arbitrary files Description: When restoring from backup, lockdownd changed permissions on certain files even if the path to the file included a symbolic link. This issue was addressed by not changing permissions on any file with a symlink in its path. CVE-ID CVE-2013-0979 : evad3rs USB Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later Impact: A local user may be able to execute arbitrary code in the kernel Description: The IOUSBDeviceFamily driver used pipe object pointers that came from userspace. This issue was addressed by performing additional validation of pipe object pointers. CVE-ID CVE-2013-0981 : evad3rs

Sur le même sujet : - Mise à jour iOS 6.1.3 - Mise à jour du système de l'Apple TV - Interview jailbreak iOS 6 : pod2g, hacker ouvert