Your favorite Apple, iPhone, iPad, iOS, Jailbreak, and Cydia site.
08-11-2011, 03:12 PM #1
Cydia Package isslfix Fixes SSL Vulnerability For iOS < 4.3.5
With the release of JailbreakMe 3.0 and Apple's response, iOS has been updated twice in order to patch the JailbreakMe exploit and other vulnerabilities. As mentioned in the iOS 4.3.4 article, updating to iOS 4.3.4 is not recommended as it only fixes the PDF exploit that JailbreakMe used. From there, Apple once again released a new version, 4.3.5, to patch other issues that were found. Although redsn0w is now able to jailbreak both 4.3.4 and 4.3.5, it is also not recommended as you will have to deal with a tethered jailbreak.
Now: In Apple's current releases, there were things that were patched that were actually "legitimate" fixes (not in response to JailbreakMe 3.0). The problem is, if you're sticking jailbroken, you aren't able to get this security updates without having to upgrade and lose an untethered jailbreak. This issue has now been solved by jan0 (@0naj) who recently released a package called "isslfix" on Cydia.
In the most basic terms, isslfix patches an SSL vulnerability known as CVE-2011-0228 without having to upgrade to the latest firmwares. All you simply need to do is install isslfix from Cydia and you will have the same protection that the later iOS firmwares offer.
More detailed information can be found at jan0's GitHub page, along with information on how to check to see if you're vulnerable or not and how to deal with issues if they do arise.
Read this article from The Recurity Lablog that explains the CVE-2011-0228 vulnerability:
You have two options to install isslfix:
- Install isslfix directly off Cydia from the BigBoss repo
- Install the isslfix .deb file and follow the installation instructions in the Readme on the GitHub page
Note: Rebooting your device will be required after installation.
To test and see if you're vulnerable (or if you're protected with this package), visit the following website on your iDevice:
If what comes up looks anything like the picture below (showing the HTTPS), you're vulnerable.
However, if it gives you a warning and a "Continue" screen before viewing the page, that means you're protected.
Note: The iOS 5 beta already patches this so there is no need to install isslfix on any iOS 5 beta firmware.
If you wish to read support documents from Apple discussing the different security updates from the firmwares at hand, read below:
Keep up to date on information about this new fix by following jan0 on Twitter.
Source(s): jan0 - GitHub, jan0, Apple, The Recurity Lablog
Last edited by Joshua Tucker; 08-11-2011 at 04:15 PM.
08-11-2011, 03:44 PM #2
08-11-2011, 03:50 PM #3
can somebody explain this in plain English if this is a necessary fix and why?
08-11-2011, 04:00 PM #4
08-11-2011, 04:08 PM #5
I keep getting the server can not be found when I try and access the link above.
08-11-2011, 04:13 PM #6
08-11-2011, 04:24 PM #7
Nice work 0naj
And nice write-up Josh
08-11-2011, 04:59 PM #8
The Following User Says Thank You to Joshua Tucker For This Useful Post:
08-11-2011, 05:18 PM #9
Nicely done! It works!
08-11-2011, 05:39 PM #10
This package is now available on BigBoss...
Click me on your jailbroken iDevice!
This exploit is based off the fact that intermediate X.509 certificates are not fully validated by iOS before being declared valid--specifically the "Basic Constraints" field.
One of the X.509 certificate's fields is "Basic Constraints" which contains things such as what the certificate is valid for (e.g., code signature, S/MIME, SSL/TLS, etc.) and whether or not the certificate represents a Certificate Authority.
The iSSL certificate (issued by iCA, one of Apple's cert authorities) Basic Constraints field reads:
Not Critical Is a Certificate Authority Maximum number of intermediate CAs: unlimited
Since all iOS applications rely on the same framework (securityd) to access SSL/TLS connections, one fake certificate, set to accept any server (*.*, *.*.* etc.) could be used to intercept any and all data sent by the iPhone to a server of the exploiter's choice (a Man in the Middle attack).
Last edited by Orby; 08-11-2011 at 05:41 PM.
08-11-2011, 05:43 PM #11
Thanks, downloaded the pkg, checked and not vulnerable. (it asked to continue)
08-11-2011, 06:01 PM #12
I am so glad that the updates in the future will not rely on restore's.
08-11-2011, 06:50 PM #13
I get 403 forbidden error. Am I protected?
08-11-2011, 06:53 PM #14
08-11-2011, 09:00 PM #15
Note about iOS5 beta part of the OP: If you are on iOS beta 3 or lower jailbroken (some JB-ed 3GS with the 6.15.00 iPad baseband can't do beta 4-5 until SB is updated), then you're still vulnerable and should also install this patch.
I tried the site and found it to be true for beta 3.Member of the hackint0sh forums.
HowardForums Member: Haas_Dave
08-11-2011, 09:14 PM #16
08-11-2011, 09:26 PM #17
i using 4.3.3 JB and just follow install issl.recurity
the outcome is same with the image that post.
without error did it mean i`m vulnerable?
08-11-2011, 09:39 PM #18
Last edited by ronw; 08-11-2011 at 09:42 PM.
08-12-2011, 02:09 AM #19
Should we install if we're on 4.2.1?64 GB iPhone 4S on 5.1.1 Jailbroken & Unlocked
64 GB iPad 3 on 5.1.1 Jailbroken
08-12-2011, 02:38 AM #20
The Following User Says Thank You to xclusiveiphone For This Useful Post:
Mista Brothason (08-12-2011)