Pwn2own Charlie Miller Mobile Safari Exploit Not Fixed in iOS 4.3.1

We all know that the Cupertino, California-based apple is busy in patching / fixing jailbreak exploits and vulnerabilities on their iOS devices. We already reported that Apple already fixed the unreleased SHAtter exploit and the Limera1n hardware exploit used in numerous jailbreak tool on their iOS 4.3 and iPad 2. And recently, Apple releases the iOS 4.3.1 and fixed the exploit in iPad 2 that was being developed by Comex – the iPhone hacker / developer behind the JailbreakMe and Sprit jailbreak tool.

But fortunately, the iOS 4.3.1 does not fix the pwn2own bug that was discovered by Charlie Miller during the Pwn2own hacking contest where he successfully jailbreaks the recently released iOS 4.3 running on the fourth generation iPhone using the newly discovered Mobile Safari exploit. Miller tweeted the following:

“iOS 4.3.1 does not fix the pwn2own bug. It’s weird they fixed it in the next os x update after the contest, but not the next iPhone update.

More time for the bad guys to get their bindiff->iPhone exploit workflow going.”

Folks over at iClarified explain how the exploit works:

“The attack simply required that the target iPhone surfs to a rigged web site. On first attempt at the drive-by exploit, the iPhone browser crashed but once it was relaunched, Miller was able to hijack the entire address book.”

So, since this method is quite similar with Comex’s JailbreakMe, Comex may use this exploit to jailbreak the iPad 2 and he may develop it to JailbreakMe 3.0. Stay tuned!