Apple iPhone and iPod Touch MP3 and AAC File Heap Buffer Overflow Vulnerability
BID:36338
Info
Apple iPhone and iPod Touch MP3 and AAC File Heap Buffer Overflow Vulnerability
| Bugtraq ID: | 36338 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2009-2206 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Sep 09 2009 12:00AM |
| Updated: | Sep 14 2009 08:31PM |
| Credit: | Tobias Klein of trapkit.de |
| Vulnerable: |
Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 1.1.4 Apple iPod Touch 1.1.3 Apple iPod Touch 1.1.2 Apple iPod Touch 1.1.1 Apple iPod Touch 3.0 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPod Touch 1.1 Apple iPod Touch 0 Apple iPhone 3.0.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 1.1.4 Apple iPhone 1.1.3 Apple iPhone 1.1.2 Apple iPhone 1.1.1 Apple iPhone 1.0.2 Apple iPhone 1.0.1 Apple iPhone 3.0 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPhone 1.1 Apple iPhone 1 Apple iPhone 0 |
| Not Vulnerable: |
Apple iPod Touch 3.1.1 Apple iPhone 3.1 |
Discussion
Apple iPhone and iPod Touch MP3 and AAC File Heap Buffer Overflow Vulnerability
Apple iPhone and iPod touch are prone to a heap-based buffer-overflow vulnerability.
Successful exploits may allow an attacker to execute arbitrary code on a vulnerable device. Failed attacks will cause denial-of-service conditions.
This issue was previously covered in BID 36326 (Apple iPhone prior to 3.1 and iPod touch Prior to3.1.1 Multiple Vulnerabilities) but has been given its own record to better document it.
This issue affects the following:
iPhone OS 1.0 through 3.0.1
iPhone OS for iPod touch 1.1 through 3.0
Apple iPhone and iPod touch are prone to a heap-based buffer-overflow vulnerability.
Successful exploits may allow an attacker to execute arbitrary code on a vulnerable device. Failed attacks will cause denial-of-service conditions.
This issue was previously covered in BID 36326 (Apple iPhone prior to 3.1 and iPod touch Prior to3.1.1 Multiple Vulnerabilities) but has been given its own record to better document it.
This issue affects the following:
iPhone OS 1.0 through 3.0.1
iPhone OS for iPod touch 1.1 through 3.0
Exploit / POC
Apple iPhone and iPod Touch MP3 and AAC File Heap Buffer Overflow Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Apple iPhone and iPod Touch MP3 and AAC File Heap Buffer Overflow Vulnerability
Solution:
The vendor has released an advisory and fixes. Please see the references for details.
Solution:
The vendor has released an advisory and fixes. Please see the references for details.
References
Apple iPhone and iPod Touch MP3 and AAC File Heap Buffer Overflow Vulnerability
References:
References:
- Apple iPhone OS AudioCodecs Heap Buffer Overflow (Tobias Klein)
- iPhone Product Page (Apple)
- iPod touch Product Page (Apple)
- [TKADV2009-007] Apple iPhone OS AudioCodecs Heap Buffer Overflow (Tobias Klein