Apple iPhone and iPod touch MPEG-4 Video Codec Denial of Service Vulnerability

Bugtraq ID:	35433
Class:	Input Validation Error
CVE:	CVE-2009-0959
Remote:	Yes
Local:	No
Published:	Jun 17 2009 12:00AM
Updated:	Jun 19 2009 11:09PM
Credit:	Si Brindley
Vulnerable:	Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 1.1.4 Apple iPod Touch 1.1.3 Apple iPod Touch 1.1.2 Apple iPod Touch 1.1.1 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPod Touch 1.1 Apple iPod Touch 0 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 1.1.4 Apple iPhone 1.1.3 Apple iPhone 1.1.2 Apple iPhone 1.1.1 Apple iPhone 1.0.2 Apple iPhone 1.0.1 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPhone 1.1 Apple iPhone 1 Apple iPhone 0
Not Vulnerable:	Apple iPod Touch 3.0 Apple iPhone 3.0

Apple iPhone and iPod touch MPEG-4 Video Codec Denial of Service Vulnerability

Apple iPhone and iPod touch are prone to a denial-of-service vulnerability.

Successfully exploiting this issue may allow an attacker to reset a device.

NOTE: This issue was previously covered in BID 35414 (Apple iPhone and iPod touch Prior to Version 3.0 Multiple Vulnerabilities), but has been assigned its own record to better document it.

Apple iPhone and iPod touch MPEG-4 Video Codec Denial of Service Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple iPhone and iPod touch MPEG-4 Video Codec Denial of Service Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for details.

Apple iPhone and iPod touch MPEG-4 Video Codec Denial of Service Vulnerability

References:

• iPhone Product Page (Apple)
  
• iPod touch Product Page (Apple)