11

Apple released iOS 7.0.6 and 6.1.6 to patch a specific SSL/TLS security bug.

I can't find anything official about iOS 5. Does iOS 5 have the same bug?

Please cite your answer.

11

ZDNet says :

iOS 5 and Mac OS X 10.8 never had the bug

8

Same manual test with gotofail.com

  • iOS 4.1 = Safe
  • iOS 5.1.1 = Safe
  • iOS 6.1.3 = Vulnerable
  • iOS 7.0.4 + (SSLPatch) = Safe :)

According to SSLPatch you are vulnerable from iOS 6.0 to iOS 6.1.5 and from iOS 7.0 to iOS 7.0.5.

  • 2
    last statement is somewhat incorrect since 6.1.6 has the fix – Jess Feb 24 '14 at 23:20
5

You can visit gotofail.com from Safari in iOS 5 and check yourself.

  • Is that site safe to go to? – Jess Feb 24 '14 at 13:25
  • 2
    Presumably, yes. But for an even simpler test, try imperialviolet.org:1266 (note the https if you type it in manually!) It doesn't run any JavaScript; it's simply configured with example of a forged SSL certificate and will return plain text explaining the vulnerability if it is indeed present. See imperialviolet.org/2014/02/22/applebug.html for the details. – zigg Feb 24 '14 at 13:50
5

Jeffrey Grossman (@Jeffrey903) found that the bug came in with iOS 6, which means that iOS 5 and earlier builds are not affected:

I have confirmed that the SSL vulnerability was introduced in iOS 6.0. It is not present in 5.1.1 and is in 6.0 (22 Feb 2014 at 5:11 PM)

He tested for the bug on a variety of earlier devices and versions:

Not sure about 7.1 (device at office). So far I’ve tested 2.2, 2.2.1, 3.0, 3.1.3, 4.3.5, 5.1.1, 6.0, 6.1.3, 7.0.4, 7.0.6 (22 Feb 2014 at 5:13 PM)

I tested the iOS SSL vulnerability using http://gotofail.com on these 16 devices. (22 Feb 2014 at 6:36PM)

I don’t know if he was the first to spot it, but I’m willing to trust his testing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .