FKIE_CVE-2010-2973

Vulnerability from fkie_nvd - Published: 2010-08-05 18:17 - Updated: 2025-04-11 00:51
Severity ?
Summary
Integer overflow in IOSurface in Apple iOS before 4.0.2 on the iPhone and iPod touch, and before 3.2.2 on the iPad, allows local users to gain privileges via vectors involving IOSurface properties, as demonstrated by JailbreakMe.
References
cve@mitre.orghttp://lists.apple.com/archives/security-announce/2010//Aug/msg00000.html
cve@mitre.orghttp://lists.apple.com/archives/security-announce/2010//Aug/msg00001.html
cve@mitre.orghttp://osvdb.org/66827
cve@mitre.orghttp://secunia.com/advisories/40807Vendor Advisory
cve@mitre.orghttp://support.apple.com/kb/HT4291
cve@mitre.orghttp://support.apple.com/kb/HT4292
cve@mitre.orghttp://www.exploit-db.com/exploits/14538Exploit
cve@mitre.orghttp://www.securityfocus.com/bid/42151
af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2010//Aug/msg00000.html
af854a3a-2127-422b-91ae-364da2661108http://lists.apple.com/archives/security-announce/2010//Aug/msg00001.html
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/66827
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/40807Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://support.apple.com/kb/HT4291
af854a3a-2127-422b-91ae-364da2661108http://support.apple.com/kb/HT4292
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/14538Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/42151
Impacted products
Vendor Product Version
apple iphone_os 4.0
apple iphone_os 4.0
apple iphone_os 4.0.1
apple iphone_os 4.0.1
apple iphone_os *
apple iphone_os 4.0
apple iphone_os 4.0.1
apple ipad *
apple iphone_os 4.0
apple iphone_os 4.0
apple iphone_os 4.0.1
apple iphone_os 4.0.1
apple ipod_touch *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "12E22AF0-2B66-425A-A1EE-4F0E3B0433E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:4.0:-:iphone:*:*:*:*:*",
              "matchCriteriaId": "954CDDCB-AC22-448D-8ECA-CFA4DBA1BC27",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:4.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB34ECBE-33E8-40E1-936B-7800D2525AE6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:4.0.1:-:iphone:*:*:*:*:*",
              "matchCriteriaId": "ECE983F6-A597-4581-A254-80396B54F2D5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "340C4071-1447-477F-942A-8E09EA29F917",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "12E22AF0-2B66-425A-A1EE-4F0E3B0433E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:4.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB34ECBE-33E8-40E1-936B-7800D2525AE6",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:apple:ipad:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BAADE29A-712B-4AD5-A78B-6AD537BA9196",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "12E22AF0-2B66-425A-A1EE-4F0E3B0433E7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:4.0:-:ipodtouch:*:*:*:*:*",
              "matchCriteriaId": "54FECD66-4216-43FC-9959-B8EA9545449C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:4.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "BB34ECBE-33E8-40E1-936B-7800D2525AE6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:4.0.1:-:ipodtouch:*:*:*:*:*",
              "matchCriteriaId": "586C0CB3-98E5-4CB3-8F23-27F01233D6C4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:apple:ipod_touch:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "88FA2602-DDAB-4E23-A3D2-FB712970AAD1",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Integer overflow in IOSurface in Apple iOS before 4.0.2 on the iPhone and iPod touch, and before 3.2.2 on the iPad, allows local users to gain privileges via vectors involving IOSurface properties, as demonstrated by JailbreakMe."
    },
    {
      "lang": "es",
      "value": "Un desbordamiento de enteros en IOSurface en Apple iOS anterior a versi\u00f3n 4.0.2 en el iPhone y iPod touch, y anterior a versi\u00f3n 3.2.2 en la iPad, permite a los usuarios locales alcanzar privilegios por medio de vectores que involucran las propiedades de IOSurface, como es demostrado por JailbreakMe."
    }
  ],
  "evaluatorImpact": "Per: http://xforce.iss.net/xforce/xfdb/60856\r\n\r\n\u0027Platforms Affected:\r\n\r\n    * Apple iPhone OS 4.0 iPodtouch\r\n    * Apple iPhone OS 4.0\r\n    * Apple iPhone OS 4.0.1 iPodtouch\r\n    * Apple iPhone OS 4.0.1 \u0027\r\n\r\n\r\nPer: http://www.securityfocus.com/bid/42151/discuss\r\n\r\n\u0027versions 4.0.1 and prior are vulnerable.\u0027",
  "id": "CVE-2010-2973",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 6.9,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.4,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2010-08-05T18:17:58.197",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.apple.com/archives/security-announce/2010//Aug/msg00000.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.apple.com/archives/security-announce/2010//Aug/msg00001.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/66827"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/40807"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://support.apple.com/kb/HT4291"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://support.apple.com/kb/HT4292"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/14538"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/42151"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce/2010//Aug/msg00000.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce/2010//Aug/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/66827"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/40807"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.apple.com/kb/HT4291"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://support.apple.com/kb/HT4292"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/14538"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/42151"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.