RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 7 Multiple Vulnerabilities

Bugtraq ID:	62491
Class:	Unknown
CVE:
Remote:	Yes
Local:	Yes
Published:	Sep 18 2013 12:00AM
Updated:	Sep 21 2013 12:15AM
Credit:	Apple, Jin Han of the Institute for Infocomm Research working with Qiang Yan and Su Mon Kywe of Singapore Management University, Mackenzie Straight of Mobile Labs, Will Estes, @dent1zt, Joonas Kuorilehto of Codenomicon, an anonymous researcher working with
Vulnerable:	Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0
Not Vulnerable:

RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 7 Multiple Vulnerabilities

Apple iOS for iPhone, iPod touch, and iPad is prone to multiple security vulnerabilities. These issues affect the following components:

Data Protection
Webkit
Data Security
IOKit
IOKitUser
Kernel
Kext Management
Passcode Lock
Safari
Push Notifications
Sandbox
Social
Springboard
Telephony
Twitter

Successfully exploiting these issues may allow attackers to crash the affected device, bypass security restrictions, obtain sensitive information, or execute arbitrary code. Other attacks are also possible.

This BID is being retired. The following individual records exist to better document the issues:

62566 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5154 Security Bypass Vulnerability
62561 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5156 Security Bypass Vulnerability
62555 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5157 Security Bypass Vulnerability
62573 Apple iPhone/iPad/iPod touch Prior to iOS 7 Safari History Information Disclosure Vulnerability
62543 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5152 Address Bar URI Spoofing Vulnerability
62539 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-1036 Memory Corruption Vulnerability
62536 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5139 Remote Code Exexution Vulnerability
62541 Apple iPhone/iPad/iPod touch CVE-2013-5131 Cross-Site Scripting Vulnerability
62542 Apple iPhone/iPad/iPod touch CVE-2013-5151 Cross-Site Scripting Vulnerability
62537 Apple iPhone/iPad/iPod touch CVE-2013-5129 Cross-Site Scripting Vulnerability
62520 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5138 Denial of Service Vulnerability
62521 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-0957 Security Bypass Vulnerability
62524 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5140 Denial of Service Vulnerability
62527 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5149 Information Disclosure Vulnerability
62526 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5137 Denial of Service Vulnerability
62529 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5145 Local Security Bypass Vulnerability
62534 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5147 Local Security Bypass Vulnerability
62530 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5153 Information Disclosure Vulnerability
62532 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5158 Information Disclosure Vulnerability
62533 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5159 Information Disclosure Vulnerability
62531 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2011-2391 Denial of Service Vulnerability
62523 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5141 Denial of Service Vulnerability
62535 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5155 Denial of Service Vulnerability
62522 Apple iPhone/iPad/iPod touch Prior to iOS 7 CVE-2013-5142 Information Disclosure Vulnerabilities

RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 7 Multiple Vulnerabilities

Some of these issues may not require specific exploit code and may be trivial to exploit.

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 7 Multiple Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

RETIRED: Apple iPhone/iPad/iPod touch Prior to iOS 7 Multiple Vulnerabilities

References:

• iOS Homepage (Apple)
  
• iPad Homepage (Apple)
  
• iPhone Product Page (Apple)
  
• iPod touch Product Page (Apple)