Apple iPhone SMS Application Remote Code Execution Vulnerability
BID:35569
Info
Apple iPhone SMS Application Remote Code Execution Vulnerability
| Bugtraq ID: | 35569 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-2204 CVE-2009-2315 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 02 2009 12:00AM |
| Updated: | Jul 31 2009 08:05PM |
| Credit: | Charlie Miller of Independent Security Evaluators, and Collin Mulliner of Fraunhofer SIT |
| Vulnerable: |
Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 1.1.4 Apple iPhone 1.1.3 Apple iPhone 1.1.2 Apple iPhone 1.1.1 Apple iPhone 1.0.2 Apple iPhone 1.0.1 Apple iPhone 3.0 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPhone 1.1 Apple iPhone 1 |
| Not Vulnerable: |
Apple iPhone 3.0.1 |
Discussion
Apple iPhone SMS Application Remote Code Execution Vulnerability
The Apple iPhone SMS application is prone to a remote code-execution vulnerability.
An attacker may exploit the issue to execute arbitrary code on vulnerable devices. Failed attacks will result in denial-of-service conditions.
Very few details are available regarding this issue. We will update this BID as more information emerges.
UPDATE (July 30, 2009): This BID was originally titled "Apple iPhone SMS Application Denial of Service Vulnerability"; it has been updated to reflect newly released information.
Versions prior to iPhone OS 3.0.1 are vulnerable.
The Apple iPhone SMS application is prone to a remote code-execution vulnerability.
An attacker may exploit the issue to execute arbitrary code on vulnerable devices. Failed attacks will result in denial-of-service conditions.
Very few details are available regarding this issue. We will update this BID as more information emerges.
UPDATE (July 30, 2009): This BID was originally titled "Apple iPhone SMS Application Denial of Service Vulnerability"; it has been updated to reflect newly released information.
Versions prior to iPhone OS 3.0.1 are vulnerable.
Exploit / POC
Apple iPhone SMS Application Remote Code Execution Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Exploitation of this issue to create a denial-of-service condition was demonstrated in a presentation in the SysScan conference in Singapore.
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Exploitation of this issue to create a denial-of-service condition was demonstrated in a presentation in the SysScan conference in Singapore.
Solution / Fix
Apple iPhone SMS Application Remote Code Execution Vulnerability
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
Apple iPhone SMS Application Remote Code Execution Vulnerability
References:
References:
- Alledged critical security vulnerability in iPhone SMS application (Heise Media)
- Fuzzing the Phone in your Phone (Collin Mulliner and Charlie Miller)
- How To Hijack 'Every iPhone In The World' (Andy Greenberg)
- iPhone Product Page (Apple)
- Researchers take control of iPhone via SMS (Eliinor Mills )
- About the security content of iPhone OS 3.0.1 (Apple)