Apple acknowledges evad3r jailbreakers found 4 of 6 exploits fixed with iOS 6.1.3

As noted by The Next Web, the security note that came along with Tuesday's iOS 6.1.3 release credited evad3rs with unearthing four of the six flaws fixed by update.

Evad3rs leveraged some of the exploits to create the evasi0n jailbreak, which allowed iPhone 5 and iPad mini owners to "liberate" their devices. The untethered app was downloaded seven million times in its first four days of availability, leveraging exploits within iOS to grant users greater control over system-level functions usually reserved for first-party apps.

The newest iOS 6.1.3 reportedly breaks evasi0n, as reported in February when a beta version of the update was found to patch the exploits used for the jailbreak, but co-creator David Wang said there may be enough remaining flaws in the operating system to create an entirely new liberation tool.

The exploits discovered by evad3rs:

CVE-2013-0977

dyld

Impact: A local user may be able to execute unsigned code

Description: A state management issue existed in the handling of

Mach-O executable files with overlapping segments. This issue was

addressed by refusing to load an executable with overlapping

segments.

CVE-2013-0978

Kernel

Impact: A local user may be able to determine the address of

structures in the kernel

Description: An information disclosure issue existed in the ARM

prefetch abort handler. This issue was addressed by panicking if the

prefetch abort handler is not being called from an abort context.

CVE-2013-0979

Lockdown

Impact: A local user may be able to change permissions on arbitrary

files

Description: When restoring from backup, lockdownd changed

permissions on certain files even if the path to the file included a

symbolic link. This issue was addressed by not changing permissions

on any file with a symlink in its path.

CVE-2013-0981

USB

Impact: A local user may be able to execute arbitrary code in the

kernel

Description: The IOUSBDeviceFamily driver used pipe object pointers

that came from userspace. This issue was addressed by performing

additional validation of pipe object pointers.

A security flaw that allowed for the bypassing of an iPhone's lock screen, which turned out to be a logic issue in handling emergency calls, was found by Christopher Heffley of theMedium.ca, while a WebKit bug was discovered by Nils and Jon from MWR Labs working with HP TippingPoint's Zero Day Initiative.