iPhone Theme Store

Today, Apple released firmware 3.0.1. The firmware was released in order to fix the SMS bug that leaves all iPhones vulnerable to attack. Like with all firmware upgrades, you will want to hold off on upgrading if you currently have a jailbroke iPhone or iPod Touch. The Dev-Team hasn’t released any info about a new jailbreak but, we will keep our eyes open for any info from them. Below is info from Apple about the new firmware.

Apple’s Info about 3.0.1 Upgrade

Summary
This document describes the security content of iPhone OS 3.0.1.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see “How to use the Apple Product Security PGP Key.”

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see “Apple Security Updates.”

Products Affected
iPhone, Product Security

iPhone OS 3.0.1
*CoreTelephony
CVE-ID: CVE-2009-2204

Available for: iPhone OS 1.0 through iPhone OS 3.0

Impact: Receiving a maliciously crafted SMS message may lead to an unexpected service interruption or arbitrary code execution

Description: A memory corruption issue exists in the decoding of SMS messages. Receiving a maliciously crafted SMS message may lead to an unexpected service interruption or arbitrary code execution. This update addresses the issue through improved error handling. Credit to Charlie Miller of Independent Security Evaluators, and Collin Mulliner of Technical University Berlin for reporting this issue.

See original document HERE.

Quote from Apple Rep.
“We appreciate the information provided to us about SMS vulnerabilities which affect several mobile phone platforms. This morning, less than 24 hours after a demonstration of this exploit, we’ve issued a free software update that eliminates the vulnerability from the iPhone. Contrary to what’s been reported, no one has been able to take control of the iPhone to gain access to personal information using this exploit.”

Source:
Apple Releases Firmware 3.0.1