RETIRED: Apple iPhone prior to 3.1 and iPod touch Prior to 3.1.1 Multiple Vulnerabilities
BID:36326
Info
RETIRED: Apple iPhone prior to 3.1 and iPod touch Prior to 3.1.1 Multiple Vulnerabilities
| Bugtraq ID: | 36326 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Sep 09 2009 12:00AM |
| Updated: | Sep 09 2009 10:11PM |
| Credit: | Tobias Klein of trapkit.de, Allan Steven, Robert Duran, Jeff Beckham of PepsiCo, Joshua Levitsky, Michael Breton of Intel Corporation, Mike Karban of Edward Jones, Steve Moriarty of Agilent Technologies, Clickwise Software, Tony Kavadias, Charlie Miller of |
| Vulnerable: |
Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 1.1.4 Apple iPod Touch 1.1.3 Apple iPod Touch 1.1.2 Apple iPod Touch 1.1.1 Apple iPod Touch 3.0 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPod Touch 1.1 Apple iPod Touch 0 Apple iPhone 3.0.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 1.1.4 Apple iPhone 1.1.3 Apple iPhone 1.1.2 Apple iPhone 1.1.1 Apple iPhone 1.0.2 Apple iPhone 1.0.1 Apple iPhone 3.0 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPhone 1.1 Apple iPhone 1 Apple iPhone 0 |
| Not Vulnerable: |
Apple iPod Touch 3.1.1 Apple iPhone 3.1 |
Discussion
RETIRED: Apple iPhone prior to 3.1 and iPod touch Prior to 3.1.1 Multiple Vulnerabilities
Apple iPhone and iPod touch are prone to multiple vulnerabilities:
1. A heap-based buffer-overflow vulnerability.
2. A security-bypass vulnerability.
3. An access-validation vulnerability.
4. A heap-based buffer-overflow vulnerability.
5. A null-pointer dereference vulnerability.
6. An information-disclosure vulnerability.
7. An information-disclosure vulnerability.
Successfully exploiting these issues may allow attackers to crash the affected device, bypass security restrictions, obtain sensitive information, or execute arbitrary code. Other attacks are also possible.
These issues affect the following:
iPhone OS 1.0 through 3.0.1
iPhone OS for iPod touch 1.1 through 3.0
This BID is being retired as the following records exist to better document the issues:
36335 Apple iPhone and iPod touch UIKit Deleted Password Character Information Disclosure Vulnerability
36336 Apple iPhone prior to 3.1 SMS Message NULL-Pointer Dereference Vulnerability
36337 Apple iPhone and iPod Touch MobileMail Component Delete Mail Access Validation Vulnerability
36338 Apple iPhone and iPod Touch MP3 and AAC File Heap Buffer Overflow Vulnerability
36339 Apple iPhone and iPod touch Safari Referer Header Information Disclosure Vulnerability
36341 Apple iPhone and iPod Touch Recovery Mode Command Parsing Heap Buffer Overflow Vulnerability
36342 Apple iPhone and iPod touch Exchange Support Component Security Bypass Vulnerability
Apple iPhone and iPod touch are prone to multiple vulnerabilities:
1. A heap-based buffer-overflow vulnerability.
2. A security-bypass vulnerability.
3. An access-validation vulnerability.
4. A heap-based buffer-overflow vulnerability.
5. A null-pointer dereference vulnerability.
6. An information-disclosure vulnerability.
7. An information-disclosure vulnerability.
Successfully exploiting these issues may allow attackers to crash the affected device, bypass security restrictions, obtain sensitive information, or execute arbitrary code. Other attacks are also possible.
These issues affect the following:
iPhone OS 1.0 through 3.0.1
iPhone OS for iPod touch 1.1 through 3.0
This BID is being retired as the following records exist to better document the issues:
36335 Apple iPhone and iPod touch UIKit Deleted Password Character Information Disclosure Vulnerability
36336 Apple iPhone prior to 3.1 SMS Message NULL-Pointer Dereference Vulnerability
36337 Apple iPhone and iPod Touch MobileMail Component Delete Mail Access Validation Vulnerability
36338 Apple iPhone and iPod Touch MP3 and AAC File Heap Buffer Overflow Vulnerability
36339 Apple iPhone and iPod touch Safari Referer Header Information Disclosure Vulnerability
36341 Apple iPhone and iPod Touch Recovery Mode Command Parsing Heap Buffer Overflow Vulnerability
36342 Apple iPhone and iPod touch Exchange Support Component Security Bypass Vulnerability
Exploit / POC
RETIRED: Apple iPhone prior to 3.1 and iPod touch Prior to 3.1.1 Multiple Vulnerabilities
Some of these issues may not require specific exploit code and may be trivial to exploit.
Currently we are not aware of any working exploits for issues that may require exploit code. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Some of these issues may not require specific exploit code and may be trivial to exploit.
Currently we are not aware of any working exploits for issues that may require exploit code. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
RETIRED: Apple iPhone prior to 3.1 and iPod touch Prior to 3.1.1 Multiple Vulnerabilities
Solution:
The vendor has released an advisory and fixes. Please see the references for details.
Solution:
The vendor has released an advisory and fixes. Please see the references for details.
References
RETIRED: Apple iPhone prior to 3.1 and iPod touch Prior to 3.1.1 Multiple Vulnerabilities
References:
References:
- iPhone Product Page (Apple)
- iPod touch Product Page (Apple)