iOS 7.0.6 / iOS 6.1.6 is now available

The fact they released this news last thing on a Friday probably means the bug is very serious, and that users should update as soon as possible.
 
I just wish they release iOS 7.1 sooner. I have lots of bugs that I know are fixed in the 7.1 beta versions.
 
theheyes said:
The fact they released this news last thing on a Friday probably means the bug is very serious, and that users should update as soon as possible.
Click to expand...

For those interested in programming, have a look at the old source code http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c?txt and specifically line 631.

The first goto is bound to the if statement above, but the second goto isn't conditional and will always be executed. Result is that the SSL/TLS signature verification will never fail :eek:.

Lesson for programmers = Never use if statements without curly braces! :p
 
Westyfield2 said:
The first goto is bound to the if statement above, but the second goto isn't conditional and will always be executed. Result is that the SSL/TLS signature verification will never fail :eek:.
Click to expand...

It's a schoolboy error but these things happen. The sloppiness with regards to testing is less forgivable but again, it happens. Nothing is perfect.

The company response when something like this does occur is what you should really make a judgement on. Which so far has been minimal unfortunately.
 
Still vulnerable in certain situations with the patch though (root apps/tweaks; like iFile or Cydia) and obviously safe mode too - but for 95% of situations it's a good solution. I use Cydia for purchasing via PayPal so it's not safe enough for me, so I updated to 7.0.6 and re-jailbroke.

Also, I see there's another security flaw that's just come to light:

Newly Discovered Flaw In iOS Makes It Possible To Covertly Log Keystrokes
 
Westyfield2 said:
For those interested in programming, have a look at the old source code http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c?txt and specifically line 631.

The first goto is bound to the if statement above, but the second goto isn't conditional and will always be executed. Result is that the SSL/TLS signature verification will never fail :eek:.

Lesson for programmers = Never use if statements without curly braces! :p
Click to expand...

Actually, this is one of the reasons why I can't warm to Python. Curly braces beats indentations any day of the week.
 
Anyone else had random message issues with this?
We've just done one of the iPhones in the office and theres a load of text messages gone missing...
 
You must log in or register to reply here.
Back
Top Bottom