Home ›

iPhone OS 3.0 Mail Security Hole Revealed

Submitted by Chris Barylick on August 17, 2009 - 2:33pm.
in

A potential security hole in the iPhone OS 3.0 and 3.0.1 firmware has just surfaced via a YouTube video in which the host describes how, by searching for the title of a deleted message, the resulting screen displays two copies of the message; when either is selected for the first time, Mail crashes. According to MacNN, when the messages are selected a second time however, an iPhone will either display the original text, or a warning saying "This message cannot be displayed because of the way it is formatted."

The copied message also warns that it is "only partially downloaded," and presents a malfunctioning button to download the remaining part of the e-mail. The bug further displays opened messages in either the Deleted Messages folder or the Inbox as "1 of 0."

The poster of the video says he suspects the device is reaching back to an e-mail server, but was able to disprove this by completely emptying his POP account. The bug is believed to be long-standing, as a result of finding e-mails deleted months ago:

Apple has yet to offer an official comment on this issue.

Submitted by iPhown on August 17, 2009 - 3:21pm.
Just tried on my 3GS on 3.0 and didn't see the message in Spotlight. Maybe it's just an iPod thing.

EDIT: It does find my deleted messages but it doesn't crash Mail. And even though there were only 6 emails in my Hotmail inbox, it said 7 of 7 when I opened the message, not 7 of 6.

Submitted by foamysking on August 17, 2009 - 9:55pm.
well ive had som experience with this bug on my iphone since 3.0 launched and the only email account type that is immune is exchange because the messages are not stored localy so when there gone from the server they are gone for good
(it dosent crash for me)

another way to crush the bug is turn off mail searching in Settings > Gerenal > Home > Search Results > and tap mail to turn it off(unchecked) and that kinda fixes it to the point where it wont be searched

i have confirmed issue on two diffrent pop accounts, mobile me, yahoo, gmail, and aol accounts