Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Apple released iOS 7.0.6 and 6.1.6 to patch a specific SSL/TLS security bug.

I can't find anything official about iOS 5. Does iOS 5 have the same bug?

Please cite your answer.

share|improve this question
add comment

4 Answers

ZDNet says :

iOS 5 and Mac OS X 10.8 never had the bug

share|improve this answer
add comment

Same manual test with gotofail.com

  • iOS 4.1 = Safe
  • iOS 5.1.1 = Safe
  • iOS 6.1.3 = Vulnerable
  • iOS 7.0.4 + (SSLPatch) = Safe :)

According to SSLPatch you are vulnerable from iOS 6.0 to iOS 6.1.5 and from iOS 7.0 to iOS 7.0.5.

share|improve this answer
last statement is somewhat incorrect since 6.1.6 has the fix –  Jess Feb 24 at 23:20
My bad, now i made it correct. Thanks –  Tuss László Feb 25 at 0:25
add comment

You can visit gotofail.com from Safari in iOS 5 and check yourself.

share|improve this answer
Is that site safe to go to? –  Jess Feb 24 at 13:25
Presumably, yes. But for an even simpler test, try imperialviolet.org:1266 (note the https if you type it in manually!) It doesn't run any JavaScript; it's simply configured with example of a forged SSL certificate and will return plain text explaining the vulnerability if it is indeed present. See imperialviolet.org/2014/02/22/applebug.html for the details. –  zigg Feb 24 at 13:50
add comment

Jeffrey Grossman (@Jeffrey903) found that the bug came in with iOS 6, which means that iOS 5 and earlier builds are not affected:

I have confirmed that the SSL vulnerability was introduced in iOS 6.0. It is not present in 5.1.1 and is in 6.0 (22 Feb 2014 at 5:11 PM)

He tested for the bug on a variety of earlier devices and versions:

Not sure about 7.1 (device at office). So far I’ve tested 2.2, 2.2.1, 3.0, 3.1.3, 4.3.5, 5.1.1, 6.0, 6.1.3, 7.0.4, 7.0.6 (22 Feb 2014 at 5:13 PM)

I tested the iOS SSL vulnerability using http://gotofail.com on these 16 devices. (22 Feb 2014 at 6:36PM)

I don’t know if he was the first to spot it, but I’m willing to trust his testing.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.