Apple Kernel TCP Exhaustion Denial of Service Vulnerability

Bugtraq ID:	50087
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2011-3259
Remote:	Yes
Local:	No
Published:	Oct 12 2011 12:00AM
Updated:	Oct 12 2011 12:00AM
Credit:	Apple
Vulnerable:	Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 beta Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple Apple TV 4.3 Apple Apple TV 4.2 Apple Apple TV 4.1 Apple Apple TV 4.0
Not Vulnerable:	Apple iOS 5 Apple Apple TV 4.4

Apple Kernel TCP Exhaustion Denial of Service Vulnerability

Apple TV and iOS kernel are prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to reset an affected device, and exhaust system resources. It could deny service to a legitimate user.

The following applications and systems are vulnerable:
Apple TV 4.0 through 4.3;
iOS 3.0 through 4.3.5 for iPhone 3GS and iPhone 4;
iOS 3.1 through 4.3.5 for iPod touch (3rd generation) and later;
iOS 3.2 through 4.3.5 for iPad

Apple Kernel TCP Exhaustion Denial of Service Vulnerability

Attackers can use readily available network utilities to exploit this issue.

Apple Kernel TCP Exhaustion Denial of Service Vulnerability

Solution:
Vendor updates are available. Please see the referenced advisory for further information.

Apple Kernel TCP Exhaustion Denial of Service Vulnerability

References:

• Apple iOS Homepage (Apple)
  
• Apple TV Homepage (Apple)