ID

VAR-200811-0320

CVE

CVE-2008-4233

TITLE

Apple iPhone OS of Safari Vulnerabilities that allow calls to any phone

DESCRIPTION

Safari in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 does not isolate the call-approval dialog from the process of launching new applications, which allows remote attackers to make arbitrary phone calls via a crafted HTML document. Apple iPhone and iPod touch are prone to multiple vulnerabilities: 1. A denial-of-service vulnerability in the ImageIO module. 2. A weakness in Networking. 3. Two security-bypass vulnerabilities in the Passcode Lock functionality. 4. An information-disclosure vulnerability in the Passcode Lock functionality. 5. A memory-corruption vulnerability in Safari. 6. A spoofing vulnerability in Safari. 7. A security-bypass vulnerability in Safari. Successfully exploiting these issues may allow attackers to execute arbitrary code, bypass security restrictions, obtain sensitive information, perform spoofing attacks, or cause denial-of-service conditions. These issues affect the following: iPhone OS 1.0 through 2.1 iPhone OS for iPod touch 1.1 through 2.1. If the app is launched through Safari while the call permission dialog is displayed, the call is allowed, which may allow a malicious site to initiate a call without user interaction; also in some circumstances, a malicious site may not allow the user to cancel for a short period of time call. ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: Apple iPhone / iPod touch Multiple Vulnerabilities SECUNIA ADVISORY ID: SA32756 VERIFY ADVISORY: http://secunia.com/advisories/32756/ CRITICAL: Highly critical IMPACT: Security Bypass, Spoofing, Exposure of sensitive information, DoS, System access WHERE: >From remote OPERATING SYSTEM: Apple iPod touch http://secunia.com/advisories/product/16074/ Apple iPhone http://secunia.com/advisories/product/15128/ DESCRIPTION: Some weaknesses, security issues, and vulnerabilities have been reported in Apple iPhone and iPod touch, which can be exploited by malicious people to bypass certain security restrictions, disclose potential sensitive information, conduct spoofing attacks, to cause a DoS (Denial of Service), or potentially compromise a user's system. 1) A vulnerability in CoreGraphics can potentially be exploited to compromise a vulnerable system. For more information see vulnerability #3 in: SA31326 2) Several vulnerabilities in the processing of TIFF images can potentially be exploited to execute arbitrary code. For more information: SA31610 3) An error in the processing of TIFF images can cause a device reset. 4) An unspecified error can result in the encryption level for PPTP VPN connections to be lower than expected. 5) A signedness error in the Office Viewer component can potentially be exploited to execute arbitrary code via a specially crafted Microsoft Excel file. This is related to vulnerability #10 in: SA32222 6) A weakness exists in the handling of emergency calls, which can be exploited to bypass the Passcode lock and call arbitrary numbers when physical access to the device is provided. 8) A security issue can result in the content of an SMS message being displayed when the message arrives while the emergency call screen is shown. 9) An error in Safari when handling HTML table elements can be exploited to cause a memory corruption and potentially execute arbitrary code when a user visits a specially crafted web site. 10) An error in Safari when handling embedded iframe elements can be exploited to spoof the user interface via content being displayed outside its boundaries. 11) An error exists in Safari when launching an application while a call approval dialog is shown. This can be exploited to call an arbitrary number without user interaction. It is also possible to block the user's ability to cancel the call. 12) An error in Webkit can be exploited to disclose potentially sensitive data from form fields, although the "Autocomplete" feature is disabled. PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1) Michal Zalewski, Google 3) Sergio 'shadown' Alvarez, n.runs AG 4) Stephen Butler, University of Illinois 7) Nolen Scaife 9) Haifei Li of Fortinet's FortiGuard Global Security Research Team 10) John Resig, Mozilla Corporation 11) Collin Mulliner, Fraunhofer SIT 12) an anonymous researcher ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3318 OTHER REFERENCES: SA31326: http://secunia.com/advisories/31326/ SA31610: http://secunia.com/advisories/31610/ SA32222: http://secunia.com/advisories/32222/ SA32706: http://secunia.com/advisories/32706/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

other

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Sergio AlvarezJohn ResigCollin Mulliner

SOURCES

LAST UPDATE DATE

2024-11-23T20:36:29.038000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE