RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Multiple Vulnerabilities

Bugtraq ID:	57572
Class:	Unknown
CVE:
Remote:	Yes
Local:	Yes
Published:	Jan 28 2013 12:00AM
Updated:	Jan 29 2013 12:40PM
Credit:	Mark Dowd of Azimuth Security, Andrew Plotkin of Zarfhome Software Consulting, Ben Madison of BitCloud, Marek Durcek, Abhishek Arya (Inferno) of the Google Chrome Security Team, Apple Product Security, Aaron Nelson, Mario Heiderich of Cure53
Vulnerable:	Apple iPod Touch 3.1.3 Apple iPod Touch 3.1.2 Apple iPod Touch 3.1.1 Apple iPod Touch 3.0 Apple iPod Touch 0 Apple iPhone 4.0.1 Apple iPhone 3.2.1 Apple iPhone 3.1.3 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 4.3.3 Apple iPhone 4.3.2 Apple iPhone 4.3.1 Apple iPhone 4.3.0 Apple iPhone 4.2.8 Apple iPhone 4.2.5 Apple iPhone 4.2.1 Apple iPhone 4.1 Apple iPhone 4.0.2 Apple iPhone 4.0.1 - Ipodtouch Apple iPhone 4.0.1 - Iphone Apple iPhone 4.0 - Ipodtouch Apple iPhone 4.0 - Iphone Apple iPhone 4.0 Apple iPhone 3.2.2 Apple iPhone 3.2.1 - Ipad Apple iPhone 3.2 - Ipodtouch Apple iPhone 3.2 - Iphone Apple iPhone 3.2 Apple iPhone 3.1.3 - Ipodtouch Apple iPhone 3.1.3 - Iphone Apple iPhone 3.1.2 - Ipodtouch Apple iPhone 3.1.2 - Iphone Apple iPhone 3.1 - Ipodtouch Apple iPhone 3.1 - Iphone Apple iPhone 3.1 Apple iPhone 3.0.1 - Ipodtouch Apple iPhone 3.0.1 - Iphone Apple iPhone 3.0 - Ipodtouch Apple iPhone 3.0 - Iphone Apple iPhone 0 Apple iPad 3.2.1 Apple iPad 3.2.2 Apple iPad 3.2 Apple iPad 0 Apple iPad 0 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 beta Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0 Apple Apple TV 5.0 Apple Apple TV 4.4 Apple Apple TV 4.3 Apple Apple TV 4.2 Apple Apple TV 4.1 Apple Apple TV 4.0
Not Vulnerable:

RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Multiple Vulnerabilities

Apple iOS for the iPhone, the iPod touch, and the iPad is prone to multiple security vulnerabilities. These issues affect the following components:

Identity Services
Kernel
StoreKit
WebKit

Successfully exploiting these issues may allow attackers to execute arbitrary script code, bypass security restrictions, obtain sensitive information, execute arbitrary code, or crash the affected device. Other attacks are also possible.

This BID is being retired. The following individual records exist to better document the issues:

57576 WebKit CVE-2013-0948 Unspecified Memory Corruption Vulnerability
57580 WebKit CVE-2013-0949 Unspecified Memory Corruption Vulnerability
57581 WebKit CVE-2013-0950 Unspecified Memory Corruption Vulnerability
57582 WebKit CVE-2013-0951 Unspecified Memory Corruption Vulnerability
57583 WebKit CVE-2013-0962 Cross Site Scripting Vulnerability
57584 WebKit CVE-2013-0952 Unspecified Memory Corruption Vulnerability
57585 WebKit CVE-2013-0953 Unspecified Memory Corruption Vulnerability
57586 WebKit CVE-2013-0954 Unspecified Memory Corruption Vulnerability
57587 WebKit CVE-2013-0955 Unspecified Memory Corruption Vulnerability
57588 WebKit CVE-2013-0956 Unspecified Memory Corruption Vulnerability
57589 WebKit CVE-2013-0958 Unspecified Memory Corruption Vulnerability
57590 WebKit CVE-2013-0959 Unspecified Memory Corruption Vulnerability
57591 WebKit CVE-2013-0968 Unspecified Memory Corruption Vulnerability
57595 Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Information Disclosure Vulnerability
57597 Apple iPhone/iPad/iPod touch CVE-2013-0974 Security Bypass Vulnerability
57598 Apple iPhone/iPad/iPod touch Prior to iOS 6.1 CVE-2013-0963 Security Bypass Vulnerability

RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Multiple Vulnerabilities

Some of these issues may not require specific exploit code and may be trivial to exploit.

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Multiple Vulnerabilities

Solution:
The vendor has released an advisory and fixes. Please see the references for details.

RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 6.1 Multiple Vulnerabilities

References:

• iOS Homepage (Apple)
  
• iPad Homepage (Apple)
  
• iPhone Product Page (Apple)
  
• iPod touch Product Page (Apple)