Apple iOS for iPhone/iPad/iPod touch Local Privilege Escalation Vulnerability

Bugtraq ID:	48701
Class:	Boundary Condition Error
CVE:	CVE-2011-0227
Remote:	No
Local:	Yes
Published:	Jul 06 2011 12:00AM
Updated:	Mar 19 2015 08:52AM
Credit:	Apple
Vulnerable:	Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0
Not Vulnerable:	Apple iOS 4.3.4 Apple iOS 4.2.9

Apple iOS for iPhone/iPad/iPod touch Local Privilege Escalation Vulnerability

Apple iOS for iPhone, iPod touch, and iPad is prone to a local privilege-escalation vulnerability.

Successfully exploiting this issue can allow attackers to elevate privileges, leading to a complete compromise of the device.

NOTE: This issue is related to the vulnerability discussed in BID 48619 (FreeType 'src/psaux/t1decode.c' Memory Corruption Vulnerability) in that it was used to jailbreak iOS devices through 'JailbreakMe 3.0'.

Apple iOS for iPhone/iPad/iPod touch Local Privilege Escalation Vulnerability

This vulnerability is being exploited to jailbreak vulnerable iOS devices through 'JailbreakMe 3.0'.

Apple iOS for iPhone/iPad/iPod touch Local Privilege Escalation Vulnerability

Solution:
Vendor updates are available. Please see the references for details.

Apple iOS for iPhone/iPad/iPod touch Local Privilege Escalation Vulnerability

References:

• [ft-devel] details on iPhone exploit caused by FreeType? (Werner LEMBERG)
  
• Hackers release new browser-based iOS 'jailbreak' based on PDF exploit (Apple Insider)
  
• iOS Homepage (Apple)
  
• iPhone Product Page (Apple)
  
• iPod touch Product Page (Apple)