|
|
|
|
| |
Credit:
The information has been provided by Tobias Klein.
The original article can be found at: http://www.trapkit.de/advisories/TKADV2009-007.txt
|
| |
Vulnerable Systems:
* iPhone OS 1.0 through version 3.0.1
* iPhone OS for iPod touch version 3.0 and prior
Immune Systems:
* iPhone OS 1.0 through version 3.1
* iPhone OS for iPod touch version 3.11
One attack vector is via iPhone ringtones with malformed sample size table entries. This was successfully tested and iTunes uploads such malformed ringtones to the phone.
Vulnerable library: /System/Library/Frameworks/AudioToolbox.framework/AudioCodecs
Vulnerable function: ACTransformerCodec::AppendInputData()
Disassembly of the vulnerable function:
[..]
__text:3314443C LDR R3, [R5,#0xA8]
__text:33144440 LDR R2, [R5,#0xA4]
__text:33144444 ADD R3, R3, #1
__text:33144448 ADD R2, fp, R2
__text:3314444C STR R3, [R5,#0xA8]
__text:33144450 MOV R3, #0
__text:33144454 STMIA IP, {R2,R3} [1]
__text:33144458 MOV R3, #0
__text:3314445C STR R3, [IP,#8] [2]
__text:33144460 LDR R3, [SP,#0x4C+sample_size] [3]
__text:33144464 STR R3, [IP,#0xC] [4]
__text:33144468 ADD IP, IP, #0x10 [5]
[..]
[1] The values of R2 and R3 are stored into the heap buffer pointed to by IP (R12). R2 contains user controlled data.
[2] The value of R3 gets copied into the heap buffer.
[3] R3 is filled with user controlled data from the audio file.
[4] The user controlled data of R3 gets copied into the heap buffer.
[5] The index into the heap buffer (pointed to by IP) gets incremented.
This code snippet gets executed in a loop. As there is no bounds checking of the heap buffer pointed to by IP (R12) it is possible to cause an out of bounds write (heap buffer overflow).
CVE Information:
CVE-2009-2206
Disclosure Timeline:
2009/04/05 - Apple Product Security Team notified
2009/04/05 - Received an automated response message
2009/04/07 - Reply from Apple
2009/06/05 - Status update request sent to Apple
2009/06/05 - Apple confirms the vulnerability
2009/08/17 - Status update by Apple
2009/09/05 - Status update by Apple
2009/09/09 - New iPhone OS released by Apple
2009/09/09 - Release date of this security advisory
--------------------------------------------------------------------------------------------------------------------------------
Find out more about XSS and eliminate the opportunity to exploit it on your site.
-
|
|
|
|
|
