Apple hasn’t released many security updates in the last couple of months, despite some high-profile discussion in the tech press about vulnerabilities in their popular mobile software. Most notably, Jonathan Zdziarski’s paper on back doors and attack points in iOS generated a good deal of controversy, and a presentation from Georgia Tech researchers at Black Hat USA at the end of July discussed multiple unpatched vulnerabilities in iOS.  Nonetheless, Apple issued no patches at all in July and only one – a fix for Safari running on OS X – in August.

This month, though, the gates opened and a whole pile of security updates from Apple spilled out. On September 17, the company released seven updates, which might not sound like a lot until you dig down and realize that the patches address 55 different CVEs. Common Vulnerabilities and Exposures numbers are used as identifiers for security vulnerabilities across the IT industry.

There are two patches for OS X Server, one for Safari running on OS X Mountain Lion and Mavericks, and Xcode update, and even one for Apple TV.  But most would agree that the most important update, given the scope of Apple’s smart phone market penetration, is the patch for iOS, which updates the mobile OS to iOS 8. We’ll cover the others in more detail in our monthly Third Party Patch Roundup at the end of the month, but the iOS update merits special attention.

The iOS 8 update pertains to iPhone 4, 5 and 6, iPod Touch 5^th generation and later, and the iPad 2 and later. It’s not just a security fix; it also adds new features such as an improved keyboard, “family sharing” capabilities, a new Photos app and more. Apple, on their web site, calls it “the biggest iOS release ever.” It also came with some problems, and five days after release, The Register reported that fewer than half of iOS users had applied the update.

Apple disclosed 53 vulnerabilities in iOS that are addressed by the iOS update. And by the way, if you own an iDevice running iOS 7 or earlier, the only way to protect yourself from these vulnerabilities is to upgrade to iOS 8, since Apple generally doesn’t issue fixes for its older operating systems when it releases a new one. The expectation is that everybody will upgrade. Given the severity of some of the vulnerabilities, not upgrading would put you in a risky position. Now that the vulnerabilities have been disclosed, attackers can easily engineer exploits to target them. That creates a dilemma for those who are concerned about some of the effects of the upgrade.

The most serious of the iOS flaws allow for remote code execution with root, kernel or system privileges. Vulnerabilities in the Webkit browser engine can enable an attacker to exploit a device that accesses a specially crafted malicious web site. Other vulnerabilities can be used by an attacker to install unverified apps or to shut down or restart the phone. There’s one that an attacker could use to bypass ASLR (Address Space Layout Randomization) and a vulnerable wi-fi authentication protocol (LEAP) by which an attacker could intercept wireless network credentials.

Even the weather app had a vulnerability, one that resulted in the disclosure of location information, which was sent to the app unencrypted. There are vulnerabilities that could allow mail credentials, text messages, and email attachments to be accessed without authorization, and one that could bypass the screen lock feature.  All in all, it’s an impressive collection of security issues.

An interesting side note is that some of the serious vulnerabilities have been present and known since 2013. Microsoft is often criticized for not addressing vulnerabilities promptly, but that is obviously a problem that’s not confined to any one software vendor.

Here is the whole list of security issues that are addressed by iOS 8:

• 802.1X –  attackers could have impersonated a WiFi access point, offered to authenticate with LEAP, broken the MS-CHAPv1 hash, and used the derived credentials to authenticate to the intended access point even if that access point supported stronger authentication methods. This issue was addressed by disabling LEAP by default.
•  Accounts – An issue existed in the access control logic for accounts. A sandboxed application could get information about the currently-active iCloud account, including the name of the account. This issue was addressed by restricting access to certain account types from unauthorized applications.
• Accessibility – A logic issue existed in AssistiveTouch’s handling of events, which resulted in the screen not locking. This issue was addressed through improved handling of the lock timer.
• Accounts Framework – An attacker with access to an iOS device may access sensitive user information from logs. This issue was addressed by logging less information.
• Address Book – The address book was encrypted with a key protected only by the hardware UID. This issue was addressed by encrypting the address book with a key protected by the hardware UID and the user’s passcode.
• App Installation – A race condition existed in App Installation. An attacker with the capability of writing to /tmp may have been able to install an unverified app. This issue was addressed by staging files for installation in another directory.
• App Installation – A path traversal issue existed in App Installation. A local attacker could have retargeted code signature validation to a bundle different from the one being installed and cause installation of an unverified app. This issue was addressed by detecting and preventing path traversal when determining which code signature to verify.
• Assets – A validation issue existed in the handling of update check responses. Spoofed dates from Last-Modified response headers set to future dates were used for If-Modified-Since checks in subsequent update requests. This issue was addressed by validation of the Last-Modified header.
• Bluetooth – Bluetooth was enabled automatically after upgrading iOS. This was addressed by only turning on Bluetooth for major or minor version updates.
• Certificate Trust Policy – The certificate trust policy was updated. The complete list of certificates may be viewed at http://support.apple.com/kb/HT5012.
• CoreGraphics – An integer overflow existed in the handling of PDF files. This issue was addressed through improved bounds checking.
• CoreGraphics – An out of bounds memory read existed in the handling of PDF files. This issue was addressed through improved bounds checking.
• Data Detectors – Tapping on a FaceTime link in Mail would trigger a FaceTime audio call without prompting. Mail did not consult the user before launching facetime-audio:// URLs. This issue was addressed with the addition of a confirmation prompt.
• Foundation – An application using NSXMLParser may be misused to disclose information. An XML External Entity issue existed in NSXMLParser’s handling of XML. This issue was addressed by not loading external entities across origins.
• Home & Lock Screen – The private API for determining the frontmost app did not have sufficient access control. This issue was addressed through additional access control.
• iMessage – Attachments may persist after the parent iMessage or MMS is deleted. A race condition existed in how attachments were deleted. This issue was addressed by conducting additional checks on whether an attachment has been deleted.
• IOAcceleratorFamily – An application may cause an unexpected system termination. A null pointer dereference existed in the handling of IOAcceleratorFamily API arguments. This issue was addressed through improved validation of IOAcceleratorFamily API arguments.
• IOAcceleratorFamily – The device may unexpectedly restart. A NULL pointer dereference was present in the IntelAccelerator driver. The issue was addressed by improved error handling.
• IOHIDFamily – A malicious application may be able to read kernel pointers, which can be used to bypass kernel address space layout randomization. An out-of-bounds read issue existed in the handling of an IOHIDFamily function. This issue was addressed through improved bounds checking.
• IOHIDFamily – A malicious application may be able to execute arbitrary code with system privileges. A heap buffer overflow existed in IOHIDFamily’s handling of key-mapping properties. This issue was addressed through improved bounds checking.
• IOHIDFamily – A malicious application may be able to execute arbitrary code with system privileges. A null pointer dereference existed in IOHIDFamily’s handling of key-mapping properties. This issue was addressed through improved validation of IOHIDFamily key-mapping properties.
• IOHIDFamily – A malicious application may be able to execute arbitrary code with kernel privileges. An out-of-bounds write issue existed in the IOHIDFamily kernel extension. This issue was addressed through improved bounds checking.
• IOKit – A malicious application may be able to read uninitialized data from kernel memory. An uninitialized memory access issue existed in the handling of IOKit functions. This issue was addressed through improved memory initialization
• IOKit – A malicious application may be able to execute arbitrary code with system privileges. Description: A validation issue existed in the handling of certain metadata fields of IODataQueue objects. This issue was addressed through improved validation of metadata.
• IOKit – A malicious application may be able to execute arbitrary code with system privileges. A validation issue existed in the handling of certain metadata fields of IODataQueue objects. This issue was addressed through improved validation of metadata.
• IOKit – A malicious application may be able to execute arbitrary code with system privileges. An integer overflow existed in the handling of IOKit functions. This issue was addressed through improved validation of IOKit API arguments.
• Kernel – A local user may be able to determine kernel memory layout. Multiple uninitialized memory issues existed in the network statistics interface, which led to the disclosure of kernel memory content. This issue was addressed through additional memory initialization.
• Kernel – A person with a privileged network position may cause a denial of service. A race condition issue existed in the handling of IPv6 packets. This issue was addressed through improved lock state checking.
• Kernel – A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel. A double free issue existed in the handling of Mach ports. This issue was addressed through improved validation of Mach ports.
• Kernel – A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel. Description: An out-of-bounds read issue existed in rt_setgate. This may lead to memory disclosure or memory corruption. This issue was addressed through improved bounds checking.
• Kernel – Some kernel hardening measures may be bypassed. Description: The random number generator used for kernel hardening measures early in the boot process was not cryptographically secure. Some of its output was inferable from user space, allowing bypass of the hardening measures. This issue was addressed by using a cryptographically secure algorithm.
• Libnotify – A malicious application may be able to execute arbitrary code with root privileges. An out-of-bounds write issue existed in Libnotify. This issue was addressed through improved bounds checking.
• Lockdown – A device can be manipulated into incorrectly presenting the home screen when the device is activation locked. An issue existed with unlocking behavior that caused a device to proceed to the home screen even if it should still be in an activation locked state. This was addressed by changing the information a device verifies during an unlock request.
• Mail – Login credentials can be sent in plaintext even if the server has advertised the LOGINDISABLED IMAP capability. Description: Mail sent the LOGIN command to servers even if they had advertised the LOGINDISABLED IMAP capability. This issue is mostly a concern when connecting to servers that are configured to accept non-encrypted connections and that advertise LOGINDISABLED. This issue was addressed by respecting the LOGINDISABLED IMAP capability.
• Mail – A person with physical access to an iOS device may potentially read email attachments. Description: A logic issue existed in Mail’s use of Data Protection on email attachments. This issue was addressed by properly setting the Data Protection class for email attachments.
• Profiles – Voice Dial is unexpectedly enabled after upgrading iOS. Description: Voice Dial was enabled automatically after upgrading iOS. This issue was addressed through improved state management.
• Safari – User credentials may be disclosed to an unintended site via autofill. Description: Safari may have autofilled user names and passwords into a subframe from a different domain than the main frame. This issue was addressed through improved origin tracking.
• Safari – An attacker with a privileged network position may intercept user credentials. Description: Saved passwords were autofilled on http sites, on https sites with broken trust, and in iframes. This issue was addressed by restricting password autofill to the main frame of https sites with valid certificate chains.
• Sandbox Profiles – Apple ID information is accessible by third-party apps. Description: An information disclosure issue existed in the third-party app sandbox. This issue was addressed by improving the third-party sandbox profile.
• Settings – Text message previews may appear at the lock screen even when this feature is disabled. Description: An issue existed in the previewing of text message notifications at the lock screen. As a result, the contents of received messages would be shown at the lock screen even when previews were disabled in Settings. The issue was addressed through improved observance of this setting.
• Syslog – A local user may be able to change permissions on arbitrary files. Description: syslogd followed symbolic links while changing permissions on files. This issue was addressed through improved handling of symbolic links.
• Weather – Location information was sent unencrypted. Description: An information disclosure issue existed in an API used to determine local weather. This issue was addressed by changing APIs.
• WebKit – A malicious website may be able to track users even when private browsing is enabled. Description: A web application could store HTML 5 application cache data during normal browsing and then read the data during private browsing. This was addressed by disabling access to the application cache when in private browsing mode.
• WebKit – Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution. Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling.
• WiFi – A device may be passively tracked by its WiFi MAC address. Description: An information disclosure existed because a stable MAC address was being used to scan for WiFi networks. This issue was addressed by randomizing the MAC address for passive WiFi scans.