Apple on Monday issued a new patch that fixes a vulnerability that could allow an attacker to spoof an X.509 certificate used to encrypt web sessions on 4.3.4 iOS devices.
The vulnerability related to the way Apple validates X.509 certificates and could undermine secure socket layer (SSL) and Transport Layer Security (TLS) protected sessions, Apple warned on Monday.
The flaw was discovered by Gregor Kopf of Recurity Labs and Trustwave SSL researcher, Paul Kehrer.
"Paul discovered a method which allowed him to sign an SSL certificate which was viewed as valid by iOS," Trustwave's Spiderlabs explained.
"Using this technique, an attacker who is able to intercept traffic from a vulnerable iOS device can craft an SSL certificate, and subsequently capture and decrypt the traffic from applications which utilize this certificate. No notification is presented to the end user, which allows the attacker to perform this attack without detection."
The attack appears to undermine the X.509 certification process where various certificate authorities issue certificates that tie a public key to a designated name. Apple described the flaw as a “a certificate chain validation issue" that existed in the handling of X.509 certificates.
“An attacker with a privileged network position may capture or modify data in sessions protected by SSL/TLS,” Apple said.
The flaw affects iOS devices from 3.0 to 4.3.4 for iPhone 3GS and 4, iPods and iPads and the patch is only available through iTunes, according to a post on the Bugtraq mailing list.
“We recommend applying the update immediately if possible,” Apple advised, but flagged that it may take "a week" to roll out the patch under its automated update process within iTunes. At the latest that would be two days prior the August 4 Def Con 19 conference, where the researchers intend to reveal their findings. However, iOS device users could avoid the delay by clicking the “check for updates” button in iTunes, Apple said.
The new patch came a week and half after Apple released one for the PDF flaw which allowed iPhone users to jailbreak their devices.
Apple said it had addressed the current vulnerablity through “improved validation of X.509 certificate chains.”