11

Apple released iOS 7.0.6 and 6.1.6 to patch a specific SSL/TLS security bug.

I can't find anything official about iOS 5. Does iOS 5 have the same bug?

Please cite your answer.

11

ZDNet says :

iOS 5 and Mac OS X 10.8 never had the bug

| improve this answer | |
8

Same manual test with gotofail.com

  • iOS 4.1 = Safe
  • iOS 5.1.1 = Safe
  • iOS 6.1.3 = Vulnerable
  • iOS 7.0.4 + (SSLPatch) = Safe :)

According to SSLPatch you are vulnerable from iOS 6.0 to iOS 6.1.5 and from iOS 7.0 to iOS 7.0.5.

| improve this answer | |
  • 2
    last statement is somewhat incorrect since 6.1.6 has the fix – Jess Feb 24 '14 at 23:20
5

You can visit gotofail.com from Safari in iOS 5 and check yourself.

| improve this answer | |
  • Is that site safe to go to? – Jess Feb 24 '14 at 13:25
  • 2
    Presumably, yes. But for an even simpler test, try imperialviolet.org:1266 (note the https if you type it in manually!) It doesn't run any JavaScript; it's simply configured with example of a forged SSL certificate and will return plain text explaining the vulnerability if it is indeed present. See imperialviolet.org/2014/02/22/applebug.html for the details. – zigg Feb 24 '14 at 13:50
5

Jeffrey Grossman (@Jeffrey903) found that the bug came in with iOS 6, which means that iOS 5 and earlier builds are not affected:

I have confirmed that the SSL vulnerability was introduced in iOS 6.0. It is not present in 5.1.1 and is in 6.0 (22 Feb 2014 at 5:11 PM)

He tested for the bug on a variety of earlier devices and versions:

Not sure about 7.1 (device at office). So far I’ve tested 2.2, 2.2.1, 3.0, 3.1.3, 4.3.5, 5.1.1, 6.0, 6.1.3, 7.0.4, 7.0.6 (22 Feb 2014 at 5:13 PM)

I tested the iOS SSL vulnerability using http://gotofail.com on these 16 devices. (22 Feb 2014 at 6:36PM)

I don’t know if he was the first to spot it, but I’m willing to trust his testing.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .