Apple Mobile Safari for iOS 4.2.1 Unspecified Remote Code Execution Vulnerability

Bugtraq ID:	46832
Class:	Unknown
CVE:	CVE-2011-1417
Remote:	Yes
Local:	No
Published:	Mar 10 2011 12:00AM
Updated:	Mar 19 2015 09:11AM
Credit:	Charlie Miller and Dion Blazakis
Vulnerable:	Apple Pages for iOS 0 Apple Mac OS X Server 10.6.6 Apple Mac OS X Server 10.6.5 Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X Server 10.6 Apple Mac OS X Server 10.5 Apple Mac OS X 10.6.5 Apple Mac OS X 10.6.4 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5 Apple Mac OS X 10.6 Apple Mac OS X 10.5 Apple iWork 9.0.5 Apple iWork 9.0.4 Apple iWork 9.0.3 Apple iWork 9.0.2 Apple iWork 9.0.1 Apple iWork 9.0 Apple iPod Touch 0 Apple iPhone 4.0 Apple iPhone 0 Apple iPad 0 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2 beta Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0
Not Vulnerable:	Apple Pages for iOS 1.5 Apple Mac Os X Server 10.6.7 Apple iWork 9.1 Apple iOS 4.3.2 Apple iOS 4.2.7

Apple Mobile Safari for iOS 4.2.1 Unspecified Remote Code Execution Vulnerability

Apple Mobile Safari for iOS is prone to an unspecified remote code-execution vulnerability.

An attacker can exploit this issue by enticing an unsuspecting user into viewing a specially crafted website. A successful exploit will result in the execution of arbitrary code in the context of the user running the affected application. Failed exploits will likely result in a denial-of-service condition.

Apple iOS 4.3 and earlier are vulnerable.

NOTE: Due to memory protections in place in iOS 4.3, code execution will be difficult.

Apple Mobile Safari for iOS 4.2.1 Unspecified Remote Code Execution Vulnerability

This issue was successfully exploited at CanSecWest's 2011 Pwn2Own contest. The exploit is not known to be public or in the wild.

Apple Mobile Safari for iOS 4.2.1 Unspecified Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.


Apple Mac OS X Server 10.6

• Apple MacOSXServerUpdCombo10.6.7.dmg
  For Mac OS X Server v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple iWork 9.0.1

• Apple iWork9.1Update.dmg
  http://www.apple.com/support/downloads/

Apple iWork 9.0.4

• Apple iWork9.1Update.dmg
  http://www.apple.com/support/downloads/

Apple iWork 9.0

• Apple iWork9.1Update.dmg
  http://www.apple.com/support/downloads/

Apple iWork 9.0.2

• Apple iWork9.1Update.dmg
  http://www.apple.com/support/downloads/

Apple iWork 9.0.3

• Apple iWork9.1Update.dmg
  http://www.apple.com/support/downloads/

Apple iWork 9.0.5

• Apple iWork9.1Update.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.5.8

• Apple SecUpdSrvr2011-001.dmg
  For Mac OS X Server v10.5.8
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.5.8

• Apple SecUpd2011-001.dmg
  For Mac OS X v10.5.8
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.1

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.1

• Apple MacOSXServerUpdCombo10.6.7.dmg
  For Mac OS X Server v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.2

• Apple MacOSXServerUpdCombo10.6.7.dmg
  For Mac OS X Server v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.2

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.3

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.3

• Apple MacOSXServerUpdCombo10.6.7.dmg
  For Mac OS X Server v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.4

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.4

• Apple MacOSXServerUpdCombo10.6.7.dmg
  For Mac OS X Server v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.5

• Apple MacOSXServerUpdCombo10.6.7.dmg
  For Mac OS X Server v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.5

• Apple MacOSXUpdCombo10.6.7.dmg
  For Mac OS X v10.6 - v10.6.5
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.6

• Apple MacOSXServerUpd10.6.7.dmg
  For Mac OS X Server v10.6.6
  http://www.apple.com/support/downloads/

Apple Mobile Safari for iOS 4.2.1 Unspecified Remote Code Execution Vulnerability

References:

• Charlie Miller wins Pwn2Own again with iPhone 4 exploit (Ryan Naraine)
  
• iOS Homepage (Apple)
  
• iPhone Product Page (Apple)
  
• ZDI-11-109 (Pwn2Own) Apple Safari OfficeArtBlip Parsing Remote Code Execution Vu (Zero Day Initiative)