RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 6 Multiple Vulnerabilities
BID:55612
Info
RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 6 Multiple Vulnerabilities
| Bugtraq ID: | 55612 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Sep 19 2012 12:00AM |
| Updated: | Mar 19 2015 09:28AM |
| Credit: | Erling Ellingsen of Facebook, Will Dormann of the CERT/CC, Mark Wuergler of Immunity Inc, Phil of PKJE Consulting, iOS Jailbreak Dream Team, Dan Rosenberg, Angelo Prado of the salesforce.com Product Security Team, Stephen Prairie of Travelers Insurance, Er |
| Vulnerable: |
Apple Mac Os X Server 10.7.3 Apple Mac Os X Server 10.7.2 Apple Mac Os X Server 10.7.1 Apple Mac Os X Server 10.7 Apple Mac Os X Server 10.6.8 Apple Mac Os X 10.7.4 Apple Mac Os X 10.7.3 Apple Mac Os X 10.7.2 Apple Mac Os X 10.7.1 Apple iPod Touch 3.1.3 Apple iPod Touch 3.1.2 Apple iPod Touch 3.1.1 Apple iPod Touch 3.0 Apple iPod Touch 0 Apple iPhone 4.0.1 Apple iPhone 3.2.1 Apple iPhone 3.1.3 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 4.3.3 Apple iPhone 4.3.2 Apple iPhone 4.3.1 Apple iPhone 4.3.0 Apple iPhone 4.2.8 Apple iPhone 4.2.5 Apple iPhone 4.2.1 Apple iPhone 4.1 Apple iPhone 4.0.2 Apple iPhone 4.0.1 - Ipodtouch Apple iPhone 4.0.1 - Iphone Apple iPhone 4.0 - Ipodtouch Apple iPhone 4.0 - Iphone Apple iPhone 4.0 Apple iPhone 3.2.2 Apple iPhone 3.2.1 - Ipad Apple iPhone 3.2 - Ipodtouch Apple iPhone 3.2 - Iphone Apple iPhone 3.2 Apple iPhone 3.1.3 - Ipodtouch Apple iPhone 3.1.3 - Iphone Apple iPhone 3.1.2 - Ipodtouch Apple iPhone 3.1.2 - Iphone Apple iPhone 3.1 - Ipodtouch Apple iPhone 3.1 - Iphone Apple iPhone 3.1 Apple iPhone 3.0.1 - Ipodtouch Apple iPhone 3.0.1 - Iphone Apple iPhone 3.0 - Ipodtouch Apple iPhone 3.0 - Iphone Apple iPhone 0 Apple iPad 3.2.1 Apple iPad 3.2.2 Apple iPad 3.2 Apple iPad 0 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 beta Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0 Apple Apple TV 5.0 Apple Apple TV 4.4 |
| Not Vulnerable: | |
Discussion
RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 6 Multiple Vulnerabilities
Apple iOS for the iPhone, the iPod touch, and the iPad is prone to multiple security vulnerabilities. These issues affect the following components:
CFNetwork
CoreMedia
DHCP
ImageIO
IPSec
Kernel
Mail
Messages
Office Viewer
Passcode Lock
Restrictions
Safari
System Logs
Telephony
UIKit
WebKit
Successfully exploiting these issues may allow attackers to crash the affected device, bypass security restrictions, obtain sensitive information, or execute arbitrary code. Other attacks are also possible.
This BID is being retired. The following individual records exist to better document the issues:
56275 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3737 Security Weakness
56270 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3735 Security Weakness
56269 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3734 Local Information Disclosure Vulnerability
56279 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3732 'From' Address Spoofing Vulnerability
56277 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3742 Secure Site Spoofing Vulnerability
56276 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3738 Security Weakness
56274 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3739 Security Bypass Vulnerability
56273 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3725 Information Disclosure Vulnerability
56272 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3729 Information Disclosure Vulnerability
56271 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3736 Security Bypass Vulnerability
56268 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3722 Remote Code Execution Vulnerability
56264 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3726 Remote Code Execution Vulnerability
56265 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3724 Information Disclosure Vulnerability
56267 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3733 Information Disclosure Vulnerability
56261 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3745 Off-By-One Buffer-Overflow Vulnerability
56260 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3741 Security Bypass Vulnerability
56259 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3743 Information Disclosure Vulnerability
56253 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3746 Information Disclosure Vulnerability
56257 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3740 Security Bypass Vulnerability
56251 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3731 Security Bypass Vulnerability
56255 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3728 Local Privilege Escalation Vulnerability
56250 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3727 Buffer Overflow Vulnerability
56296 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3730 Security Bypass Vulnerability
55087 Apple iOS SMS Spoofing Vulnerability
56254 WebKit CVE-2012-3747 Unspecified Remote Code Execution Vulnerability
Apple iOS for the iPhone, the iPod touch, and the iPad is prone to multiple security vulnerabilities. These issues affect the following components:
CFNetwork
CoreMedia
DHCP
ImageIO
IPSec
Kernel
Messages
Office Viewer
Passcode Lock
Restrictions
Safari
System Logs
Telephony
UIKit
WebKit
Successfully exploiting these issues may allow attackers to crash the affected device, bypass security restrictions, obtain sensitive information, or execute arbitrary code. Other attacks are also possible.
This BID is being retired. The following individual records exist to better document the issues:
56275 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3737 Security Weakness
56270 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3735 Security Weakness
56269 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3734 Local Information Disclosure Vulnerability
56279 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3732 'From' Address Spoofing Vulnerability
56277 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3742 Secure Site Spoofing Vulnerability
56276 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3738 Security Weakness
56274 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3739 Security Bypass Vulnerability
56273 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3725 Information Disclosure Vulnerability
56272 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3729 Information Disclosure Vulnerability
56271 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3736 Security Bypass Vulnerability
56268 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3722 Remote Code Execution Vulnerability
56264 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3726 Remote Code Execution Vulnerability
56265 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3724 Information Disclosure Vulnerability
56267 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3733 Information Disclosure Vulnerability
56261 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3745 Off-By-One Buffer-Overflow Vulnerability
56260 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3741 Security Bypass Vulnerability
56259 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3743 Information Disclosure Vulnerability
56253 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3746 Information Disclosure Vulnerability
56257 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3740 Security Bypass Vulnerability
56251 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3731 Security Bypass Vulnerability
56255 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3728 Local Privilege Escalation Vulnerability
56250 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3727 Buffer Overflow Vulnerability
56296 Apple iPhone/iPad/iPod touch Prior to iOS 6 CVE-2012-3730 Security Bypass Vulnerability
55087 Apple iOS SMS Spoofing Vulnerability
56254 WebKit CVE-2012-3747 Unspecified Remote Code Execution Vulnerability
Exploit / POC
RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 6 Multiple Vulnerabilities
Some of these issues may not require specific exploit code and may be trivial to exploit.
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Some of these issues may not require specific exploit code and may be trivial to exploit.
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 6 Multiple Vulnerabilities
Solution:
The vendor has released an advisory and fixes. Please see the references for details.
Apple Mac OS X Server 10.6.8
Apple Mac OS X 10.6.8
Apple Mac OS X 10.7.3
Apple Mac OS X Server 10.7.3
Solution:
The vendor has released an advisory and fixes. Please see the references for details.
Apple Mac OS X Server 10.6.8
-
Apple SecUpdSrvr2012-004.dmg
For Mac OS X Server v10.6.8
http://www.apple.com/support/downloads/
Apple Mac OS X 10.6.8
-
Apple SecUpd2012-004.dmg
For Mac OS X v10.6.8
http://www.apple.com/support/downloads/
Apple Mac OS X 10.7.3
-
Apple MacOSXUpdCombo10.7.5.dmg
For OS X Lion v10.7 and v10.7.3
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.7.3
-
Apple MacOSXServerUpdCombo10.7.5.dmg
For OS X Lion Server v10.7 and v10.7.3
http://www.apple.com/support/downloads/
References
RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 6 Multiple Vulnerabilities
References:
References:
- About the security content of Apple TV 5.1 (Apple)
- iOS Homepage (Apple)
- iPad Homepage (Apple)
- iPhone Product Page (Apple)
- iPod touch Product Page (Apple)