USA Today’s Byron Acohido is reporting that Apple plans to rush out a patch for the drive-by download flaw that allows jailbreaking if an iPhone, iPad or iPod Touch device simply surfs to a web site.
“The patch is completed, Apple spokeswoman Natalie Kerris said in an interview. But Kerris said on Friday that she was not able to give a time frame for its public release,” Acohido wrote.
The vulnerability, in the way Apple’s iOS processes CFF fonts, could lead to remote code execution. I
Here’s the gist of the issue, from a US-CERT advisory:
By causing an application that uses FreeType to parse a specially-crafted CFF font, a remote, unauthenticated attacker may be able to execute arbitrary code on a vulnerable system. This can occur as the result of opening a PDF document or viewing a web page.
In the jailbreakme.com exploits, this flaw is being combined with a privilege escalation issue to get around Apple’s security mechanisms.
