Apple iOS URL Schemes Handling Security Bypass Vulnerability

Bugtraq ID:	44746
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 09 2010 12:00AM
Updated:	Nov 09 2010 12:00AM
Credit:	Niesh Dhanjani
Vulnerable:	Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2
Not Vulnerable:

Apple iOS URL Schemes Handling Security Bypass Vulnerability

Apple iOS is prone to a security-bypass vulnerability that may result in the execution of arbitrary applications on an affected device.

An attacker can invoke arbitrary applications on an affected device by enticing an unsuspecting user to visit a specially crafted webpage that contains an arbitrary URL Scheme. Consequences to the user will vary depending on which application is invoked.

Apple iOS URL Schemes Handling Security Bypass Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user into visiting a specially crafted webpage with an affected device's browser.

Apple iOS URL Schemes Handling Security Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple iOS URL Schemes Handling Security Bypass Vulnerability

References:

• Apple Homepage (Apple)
  
• Insecure Handling of URL Schemes in Apple's iOS (Nitesh Dhanjani)
  
• iPhone Homepage (Apple)