Apple has released iOS 7.1.1, a minor update to the operating system for iPhone, iPad and iPod touch. This update addresses nineteen security issues: one impacting web site credentials, one which can be used to bypass kernel address space layout randomization, one involving a ‘triple handshake’ attack, and sixteen memory corruption issues in WebKit.
iOS 7.1.1 is available for: iPhone 4 and later, iPod touch (5th generation) and later, iPad 2 and later.
iOS 7.1.1 contains further improvements to Touch ID fingerprint recognition, fixes a bug that could impact keyboard responsiveness, and fixes an issue when using Bluetooth keyboards with VoiceOver enabled, in addition to multiple security updates.
Apple’s iOS security updates address the following vulnerabilities:
CVE-2014-1296 : An attacker in a privileged network position can obtain web site credentials. Set-Cookie HTTP headers would be processed even if the connection closed before the header line was complete. An attacker could strip security settings from the cookie by forcing the connection to close before the security settings were sent, and then obtain the value of the unprotected cookie. This issue was addressed by ignoring incomplete HTTP header lines.
CVE-2014-1320 : A local user can read kernel pointers, which can be used to bypass kernel address space layout randomization. A set of kernel pointers stored in an IOKit object could be retrieved from userland. This issue was addressed through removing the pointers from the object.
CVE-2014-1295 : An attacker with a privileged network position may capture data or change the operations performed in sessions protected by SSL. In a ‘triple handshake’ attack, it was possible for an attacker to establish two connections that had the same encryption keys and handshake, insert the attacker’s data in one connection, and renegotiate so that the connections may be forwarded to each other. To prevent attacks based on this scenario, Secure Transport was changed so that, by default, a renegotiation must present the same server certificate as was presented in the original connection.
This update is available directly on iOS devices (Settings > General > Software Update), or it can be downloaded and installed in iTunes when a device is connected to a computer.
