BID:98588

Apple iOS/macOS/WatchOS/tvOS CVE-2017-2522 Memory Corruption Vulnerability

Info

Apple iOS/macOS/WatchOS/tvOS CVE-2017-2522 Memory Corruption Vulnerability

Bugtraq ID:	98588
Class:	Input Validation Error
CVE:	CVE-2017-2522
Remote:	Yes
Local:	No
Published:	May 19 2017 12:00AM
Updated:	May 19 2017 12:00AM
Credit:	Ian Beer of Google Project Zero.
Vulnerable:	Apple watchOS 10.1.1 Apple watchOS 3.1.3 Apple watchOS 3.1.1 Apple watchOS 2.2.2 Apple watchOS 2.2.1 Apple watchOS 2.0.1 Apple watchOS 1.0.1 Apple watchOS 3.2.1 Apple watchOS 3.2 Apple watchOS 3.1 Apple watchOS 3.0 Apple watchOS 3 Apple watchOS 2.2 Apple watchOS 2.1 Apple watchOS 2.0 Apple watchOS 1.0 Apple Watch Hermes 0 Apple Watch Edition 0 Apple Watch 0 Apple tvOS 10.1.1 Apple tvOS 10.0.1 Apple tvOS 9.2.2 Apple tvOS 9.2.1 Apple tvOS 9.1.1 Apple tvOS 9.2 Apple tvOS 9.1 Apple tvOS 9.0 Apple tvOS 10.2 Apple tvOS 10.1 Apple tvOS 10 Apple TV 0 Apple macOS 10.12.4 Apple macOS 10.12.3 Apple macOS 10.12.2 Apple macOS 10.12.1 Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 5 0 Apple iOS 4 0 Apple iOS 3 0 Apple iOS 10.2.1 Apple iOS 10.0.1 Apple iOS 9.3.4 Apple iOS 9.3.3 Apple iOS 9.3.2 Apple iOS 9.3.1 Apple iOS 9.2.1 Apple iOS 9.0.2 Apple iOS 9.0.1 Apple iOS 8.4.1 Apple iOS 7.2 Apple iOS 7.0.6 Apple iOS 7.0.5 Apple iOS 7.0.3 Apple iOS 7.0.2 Apple iOS 7.0.1 Apple iOS 6.3.1 Apple iOS 6.1.6 Apple iOS 6.1.4 Apple iOS 6.1.3 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 9.3.5 Apple iOS 9.3 Apple iOS 9.2 Apple iOS 9.1 Apple iOS 9 Apple iOS 8.4 Apple iOS 8.3 Apple iOS 8.2 Apple iOS 8.1.3 Apple iOS 8.1.2 Apple iOS 8.1.1 Apple iOS 8.1 Apple iOS 8 Apple iOS 7.1.2 Apple iOS 7.1.1 Apple iOS 7.1 Apple iOS 7.0.4 Apple iOS 7 Apple iOS 6.1 Apple iOS 6.0.2 Apple iOS 6.0.1 Apple iOS 6 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0 Apple iOS 10.3.1 Apple iOS 10.3 Apple iOS 10.2 Apple iOS 10.1 Apple iOS 10

Not Vulnerable:	Apple watchOS 3.2.2 Apple tvOS 10.2.1 Apple macOS 10.12.5 Apple iOS 10.3.2

Discussion

Apple iOS/macOS/WatchOS/tvOS CVE-2017-2522 Memory Corruption Vulnerability

Apple iOS, WatchOS, macOS and tvOS are prone to a memory corruption vulnerability.

Attackers can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts may result in a denial-of-service condition.

The following versions fixes the issue:

Versions prior to Apple iOS 10.3.2
Versions prior to Apple watchOS 3.2.2
Versions prior to Apple tvOS 10.2.1
Versions prior to Apple macOS 10.12.5

Exploit / POC

Apple iOS/macOS/WatchOS/tvOS CVE-2017-2522 Memory Corruption Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Solution / Fix

Apple iOS/macOS/WatchOS/tvOS CVE-2017-2522 Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

References

Apple iOS/macOS/WatchOS/tvOS CVE-2017-2522 Memory Corruption Vulnerability

References: