Slashdot Mirror

← Back to Stories (view on slashdot.org)

iPhone Jailbreak Uses a PDF Display Vulnerability

Posted by kdawson on from the get-out-of-jail-free dept.

adeelarshad82 writes "Latest reports indicate that the website that 'jailbreaks' iPhones, iPads, and iPod Touches does so by means of a PDF-based vulnerability in OS X. PDF parsing and rendering is a core feature of OS X, and there have been several other vulnerabilities in the past in iOS CoreGraphics PDF components." As Gruber points out, the proper term for this is not "jailbreak," but "remote code exploit in the wild."

4 of 289 comments (clear)

  1. Re:Does not compute... by cbhacking · · Score: 0, Offtopic

    It's OK, on Apple products remote elevation-of-privilege exploits with remote code execution are only used for *GOOD* things, like giving you control of the shiny little handheld computer you bought.

    </sarcasm> just in case anybody was wondering.

    --
    There's no place I could be, since I've found Serenity...
  2. Re:PDF by Orestesx · · Score: 0, Offtopic

    +1 Funny

  3. not really that great a piece of work is it? by Serendip7 · · Score: 1, Offtopic
    This exploit was already fixed in OSX with a patch..

    http://support.apple.com/kb/HT4131

    Comex basically just diff'd what was fixed in the latest OSX patches against what was in the last iOS patch. Then read up on this patch that hasn't made it to iOS yet. FYI, this won't work if you have 4.1 beta or higher installed supposedly (cuz Apple already had the patch bundled up ready to go when they release the next build)...

    The real credit goes to Charlie Miller who found this problem in the first place.

    http://www.appleinsider.com/articles/10/08/03/browser_based_ios_jailbreak_utilizes_scary_pdf_security_hole.html

    The funny thing I found was that Charlie Miller was given credit by Apple in the patch note.. "Credit to Charlie Miller working with TippingPoint's Zero Day Initiative for reporting this issue." but then Charlie tweets about p[articular exploit.. "Very beautiful work,"... "Scary how it totally defeats Apple's security architecture."

  4. Treat it as Flash... by MessageDrivenBean · · Score: 0, Offtopic

    Dear mr. Jobs,

    You already killed Flash for iOS devices. Now it is time to kill PDF as well.

    Kinds regards,

    MessageDrivenBean.

    --
    Quisque verborum suorum optimus interpres...