ID

VAR-200811-0570

CVE

CVE-2008-4231

TITLE

Apple iPhone OS of Safari Vulnerable to arbitrary code execution

DESCRIPTION

Safari in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 does not properly handle HTML TABLE elements, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document. Apple iPhone and iPod touch are prone to multiple vulnerabilities: 1. A denial-of-service vulnerability in the ImageIO module. 2. A weakness in Networking. 3. Two security-bypass vulnerabilities in the Passcode Lock functionality. 4. An information-disclosure vulnerability in the Passcode Lock functionality. 5. A memory-corruption vulnerability in Safari. 6. A spoofing vulnerability in Safari. 7. A security-bypass vulnerability in Safari. Successfully exploiting these issues may allow attackers to execute arbitrary code, bypass security restrictions, obtain sensitive information, perform spoofing attacks, or cause denial-of-service conditions. These issues affect the following: iPhone OS 1.0 through 2.1 iPhone OS for iPod touch 1.1 through 2.1. ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: Apple iPhone / iPod touch Multiple Vulnerabilities SECUNIA ADVISORY ID: SA32756 VERIFY ADVISORY: http://secunia.com/advisories/32756/ CRITICAL: Highly critical IMPACT: Security Bypass, Spoofing, Exposure of sensitive information, DoS, System access WHERE: >From remote OPERATING SYSTEM: Apple iPod touch http://secunia.com/advisories/product/16074/ Apple iPhone http://secunia.com/advisories/product/15128/ DESCRIPTION: Some weaknesses, security issues, and vulnerabilities have been reported in Apple iPhone and iPod touch, which can be exploited by malicious people to bypass certain security restrictions, disclose potential sensitive information, conduct spoofing attacks, to cause a DoS (Denial of Service), or potentially compromise a user's system. 1) A vulnerability in CoreGraphics can potentially be exploited to compromise a vulnerable system. For more information see vulnerability #3 in: SA31326 2) Several vulnerabilities in the processing of TIFF images can potentially be exploited to execute arbitrary code. For more information: SA31610 3) An error in the processing of TIFF images can cause a device reset. 4) An unspecified error can result in the encryption level for PPTP VPN connections to be lower than expected. 5) A signedness error in the Office Viewer component can potentially be exploited to execute arbitrary code via a specially crafted Microsoft Excel file. This is related to vulnerability #10 in: SA32222 6) A weakness exists in the handling of emergency calls, which can be exploited to bypass the Passcode lock and call arbitrary numbers when physical access to the device is provided. 8) A security issue can result in the content of an SMS message being displayed when the message arrives while the emergency call screen is shown. 10) An error in Safari when handling embedded iframe elements can be exploited to spoof the user interface via content being displayed outside its boundaries. 11) An error exists in Safari when launching an application while a call approval dialog is shown. This can be exploited to call an arbitrary number without user interaction. It is also possible to block the user's ability to cancel the call. 12) An error in Webkit can be exploited to disclose potentially sensitive data from form fields, although the "Autocomplete" feature is disabled. PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1) Michal Zalewski, Google 3) Sergio 'shadown' Alvarez, n.runs AG 4) Stephen Butler, University of Illinois 7) Nolen Scaife 9) Haifei Li of Fortinet's FortiGuard Global Security Research Team 10) John Resig, Mozilla Corporation 11) Collin Mulliner, Fraunhofer SIT 12) an anonymous researcher ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3318 OTHER REFERENCES: SA31326: http://secunia.com/advisories/31326/ SA31610: http://secunia.com/advisories/31610/ SA32222: http://secunia.com/advisories/32222/ SA32706: http://secunia.com/advisories/32706/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. Other vulnerabilities have also been reported of which some may also affect Safari version 3.x. SOLUTION: Upgrade to Safari version 4, which fixes the vulnerabilities. PROVIDED AND/OR DISCOVERED BY: 1-3) Tavis Ormandy 4) Chris Evans of Google Inc. Apple Safari Remote Memory Corruption Vulnerability 2009.June.09 Fortinet's FortiGuard Global Security Research Team Discovers Vulnerability in Apple Safari. Impact: ======= Remote Code Execution. Risk: ===== Critical Affected Software: ================== For a list of product versions affected, please see the Apple Security Update reference below. Additional Information: ======================= The memory corruption vulnerability occurs when handling HTML table elements. A remote attacker may craft a malicious webpage and lure an unsuspecting user. When the page is viewed and these elements are processed, arbitrary code execution may occur resulting in the victims machine being compromised. Solutions: ========== Apple security updates are available via their Software Update mechanism. Apple security updates are available for manual download here. The FortiGuard Global Security Research Team released a signature "DHTML.Malicious.Table.Elements", which covers this specific vulnerability. Fortinet customers who subscribe to Fortinet's intrusion prevention (IPS) service should be protected against this memory corruption vulnerability. Fortinet's IPS service is one component of FortiGuard Subscription Services, which also offer comprehensive solutions such as antivirus, Web content filtering and antispam capabilities. These services enable protection against threats on both application and network layers. FortiGuard Services are continuously updated by the FortiGuard Global Security Research Team, which enables Fortinet to deliver a combination of multi-layered security intelligence and true zero-day protection from new and emerging threats. These updates are delivered to all FortiGate, FortiMail and FortiClient products. Fortinet strictly follows responsible disclosure guidelines to ensure optimum protection during a threat's lifecycle. References: =========== FortiGuard Advisory: http://www.fortiguardcenter.com/advisory/FGA-2009-23.html Apple Security Updates for Safari 4.0: http://support.apple.com/kb/HT3613 Apple Security Updates for iPhone: http://support.apple.com/kb/HT3318 CVE ID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4231 Acknowledgement: ================ Haifei Li of Fortinet's FortiGuard Global Security Research Team *** This email and any attachments thereto may contain private, confidential, and privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

resource management error

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Sergio AlvarezJohn ResigCollin Mulliner

SOURCES

LAST UPDATE DATE

2024-11-23T20:05:42.885000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE