iPhone OS 3.0.1

苹果公司刚推出新的iPhone OS 3.0.1版本的固件。这个固件修复了存在iPhone上的SMS漏洞。黑客只需要发送特别针对iPhone漏洞而制作的SMS就能造成iPhone宕机。官方上当然建议iPhone用户马上去安装这个最新占280MB的固件，需要iTunes8.2.1。

但是jailbreak的iPhone用户也要注意，升级后你的电话将变成正式版本，可能不能使用。

Apple’s Info about 3.0.1 Upgrade

Summary
This document describes the security content of iPhone OS 3.0.1.

For the protection of our customers, Apple does not disclose, discuss, or confirm security issues until a full investigation has occurred and any necessary patches or releases are available. To learn more about Apple Product Security, see the Apple Product Security website.

For information about the Apple Product Security PGP Key, see “How to use the Apple Product Security PGP Key.”

Where possible, CVE IDs are used to reference the vulnerabilities for further information.

To learn about other Security Updates, see “Apple Security Updates.”

Products Affected
iPhone, Product Security

iPhone OS 3.0.1
*CoreTelephony
CVE-ID: CVE-2009-2204

Available for: iPhone OS 1.0 through iPhone OS 3.0

Impact: Receiving a maliciously crafted SMS message may lead to an unexpected service interruption or arbitrary code execution

Description: A memory corruption issue exists in the decoding of SMS messages. Receiving a maliciously crafted SMS message may lead to an unexpected service interruption or arbitrary code execution. This update addresses the issue through improved error handling. Credit to Charlie Miller of Independent Security Evaluators, and Collin Mulliner of Technical University Berlin for reporting this issue.

If any of you have anything you’d like to add, please contribute by commenting below. Thanks!