---------------------------------------------------------------------- Secunia CSI integrated with Microsoft WSUS and Microsoft SCCM for 3rd party Patch Management Free webinars http://secunia.com/vulnerability_scanning/corporate/webinars/ ---------------------------------------------------------------------- TITLE: Apple iOS Multiple Vulnerabilities SECUNIA ADVISORY ID: SA40257 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/40257/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=40257 RELEASE DATE: 2010-06-28 DISCUSS ADVISORY: http://secunia.com/advisories/40257/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/40257/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=40257 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple security issues and vulnerabilities have been reported in Apple iOS, which can be exploited by malicious people to bypass certain security restrictions, conduct phishing, spoofing, and cross-site scripting attacks, disclose sensitive information, cause a DoS (Denial of Service), or compromise a vulnerable system. 1) An security issue is caused due to the Application Sandbox not properly restricting access to the user's photo library. This can be exploited by a malicious application to determine visited locations without authorisation. 2) An error in the processing of URLs in CFNetwork can be exploited to cause a stack-based buffer overflow and potentially execute arbitrary code when a user visits a specially crafted web site. 3) Some vulnerabilities in ImageIO can be exploited by malicious people to disclose potentially sensitive information or potentially compromise a vulnerable system. For more information see vulnerability #2 through #4 in: SA38932 4) An unspecified error in ImageIO can be exploited to corrupt memory and potentially execute arbitrary code via a specially crafted JPEG image. 5) An error in Libsystem can potentially be exploited by malicious people to execute arbitrary code. For more information see vulnerability #30 in: SA39158 6) Some vulnerabilities in libxml can be exploited by malicious people to cause a DoS (Denial of Service). For more information: SA36207 7) An error in Passcode Lock can lead to the passcode already being entered if the device is unlocked in response to an alert, and MobileMe is used to Remote Lock the device. 8) A race condition in Passcode Lock allows pairing with a computer, even if the device is locked. Successful exploitation requires that the device was unlocked before powering down. 9) An error in Safari allows web sites to set Cookies, even if the "Accept Cookies" preference is set to "From visited" or "Never". 10) A vulnerability in Safari can be exploited by malicious people to conduct phishing attacks. For more information see vulnerability #2 in: SA40105 11) A vulnerability in Safari can be exploited by malicious people to conduct spoofing attacks. For more information see vulnerability #2 in: SA36096 12) A design error in the Settings application can result in the application incorrectly indicating another wireless network. 13) Multiple vulnerabilities in WebKit can be exploited by malicious people to bypass certain security restrictions, conduct cross-site scripting attacks, disclose sensitive information, or compromise a vulnerable system. For more information: SA36269 SA37346 SA37931 SA38932 SA40105 SA40196 14) A use-after-free error in JavaScriptCore during page transitions can be exploited to execute arbitrary code when a user visits a specially crafted web site. 15) An error in WebKit when handling tables can be exploited to trigger an out-of-bounds memory access and potentially execute arbitrary code. 16) An error in WebKit results in the "history.replaceState" method affecting the parent frame, even if it is in a separate origin. This can be exploited to disclose potentially sensitive information. 17) An error in WebKit allows iframes to display content outside of its boundaries. This can be exploited to e.g. spoof the user interface. SOLUTION: Upgrade to iOS 4 (downloadable and installable via iTunes). PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1) Zac White 2) Laurent OUDOT of TEHTRI-Security 4) Ladd Van Tol, Critical Path Software 7) Sidney San Martin of DeepTech, Inc. 9) Jason Dent, Street Side Software 12) Wilfried Teiken 15) wushi of team509 16) Darin Fisher, Google Inc. 17) Wayne Pan of AdMob, Inc. ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT4225 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------