CERT-In Advisory
CIAD-2011-0065
Multiple Vulnerabilities in Apple iOS for iPhone, iPad and iPod
Original Issue Date: November 21, 2011
Severity Rating: High
Systems Affected
- Apple iOS 3.0 through 5.0 for iPhone 3GS, iPhone 4 and iPhone 4S
- Apple iOS 3.1 through 5.0 for iPod touch (3rd generation) and later
- Apple iOS 3.2 through 5.0 for iPad
- Apple iOS 4.3 through 5.0 for iPad 2
Overview
Multiple vulnerabilities have been reported in Apple iOS for iPhone, iPad and iPod, which could allow a remote attacker to bypass certain security restrictions, disclose certain sensitive information and execute arbitrary code or potentially compromise a vulnerable system.
Description
1. CFNetwork Component Information Disclosure Vulnerability
(
CVE-2011-3246
)
This vulnerability exist due to an error within the CFNetwork component. A remote attacker could exploit this vulnerability to trigger visits to unintended web sites, and transmission of cookies to unintended web sites. Successful exploitation of this vulnerability could allow a remote attacker to obtain sensitive information via a crafted (1) http or (2) https URL.
2. FreeType Arbitrary Code Execution Vulnerability
(
CVE-2011-3439
)
This vulnerability exist in FreeType in CoreGraphics due to an error within the CoreGraphics component. A remote attacker could exploit this vulnerability by convincing an unwitting user to load a specially crafted FreeType font. Successful exploitation of this vulnerability may allow execution of arbitrary code and take complete control of the affected system.
3. Passcode Lock Information Disclosure Vulnerability
(
CVE-2011-3440
)
This vulnerability exist in Apple iOS before 5.0.1 on the iPad 2 due to Passcode Lock feature does not properly implement the locked state. When a Smart Cover is opened while iPad 2 is confirming power off in the locked state, the iPad does not request a passcode. A physically local attacker could exploit this vulnerability to access data by opening a Smart Cover during power-off confirmation. Successful exploitation of this vulnerability could allow an attacker to access user data not protected by Data Protection feature.
4. żlibinfoż Sensitive Information Disclosure vulnerability
(
CVE-2011-3441
)
This vulnerability exist because żlibinfoż does not properly formulate domain-name queries. A remote attacker could exploit this vulnerability to obtain sensitive information by convincing a user to load a specially crafted crafted DNS hostname.
5. Kernel unsigned code execution Vulnerability
(
CVE-2011-3442
)
This vulnerability exist in kernel due to logic error within the mmap system call when checking valid flag combinations. A remote attacker could exploit this vulnerability to bypass codesigning checks and execute unsigned code via a malicious App.
Solution
- Upgrade to iOS version 5.0.1 using
iTunes
Vendor Information
Apple
http://support.apple.com/kb/HT5052
References
Secunia
http://secunia.com/advisories/46747/
http://secunia.com/advisories/46836/
Security Tracker
http://securitytracker.com/id/1026311
CVE Name
CVE-2011-3246
CVE-2011-3439
CVE-2011-3440
CVE-2011-3441
CVE-2011-3442
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|