New research has concluded that the Safari browser of the iPhone 1.1.4 is vulnerable to attacks, which may lead to service denial and in turn, result in a system crash.

This design flaw was detected by the researchers at Radware, an application delivery solutions company, earlier this week. The researches say the flaw triggers a series of “memory allocation operations on its memory pool”, which then triggers another different bug within its garbage collector.

To exploit Safari’s vulnerability, an iPhone user would have to open any malicious HTML pages that contain Javascript, usually as a social engineering tactic like e-mail phishing. The Radware researchers say that in a worst-case scenario, the users would experience a denial of service attack, which could result in crash of the entire Safari browser. Once the browser crashes, its malfunction could escalate to a point of paralyzing the entire iPhone.

Researchers say that each time your iPhone crashes, the device creates a log

file dump, which could possibly fill up the entire memory of your iPhone. Since the itunes does not allow file system navigation, users cannot fix the problem by themselves.

“While vendors are struggling to push new products and applications, it is evident that security still remains a secondary concern,” said Itzik Kitler, Radware security operation center manager, in a written statement. “Hackers continue to misappropriate other people’s software and their job is made easier by design flaws embedded into software products.”

Although this vulnerability is present, experts say it would likely change as the iPhone becomes more widely used and marketshares increase.

“Though it looks like a nuisance, the fact is that a more sophisticated hacker could use iPhone vulnerabilities to shut services down or install malware,” said Ron Meyran, product marketing manager for Radware, via e-mail from Israel. “iPhone is about user mobility, which in turn exposes users to attacks and bypasses the security perimeter deployed by enterprises.”

Related Posts

Security firm claims first iPhone exploit

Security Firm SPI Labs warn against using iPhone web dialer

Lotus Notes support now available for the iPhone

Don’t throw your iPhones just yet, fix is now on its way

VideoNEXT offers security management software for the iPhone