var-200811-0570
Vulnerability from variot
Safari in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 does not properly handle HTML TABLE elements, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document. Apple iPhone and iPod touch are prone to multiple vulnerabilities: 1. A denial-of-service vulnerability in the ImageIO module. 2. A weakness in Networking. 3. Two security-bypass vulnerabilities in the Passcode Lock functionality. 4. An information-disclosure vulnerability in the Passcode Lock functionality. 5. A memory-corruption vulnerability in Safari. 6. A spoofing vulnerability in Safari. 7. A security-bypass vulnerability in Safari. Successfully exploiting these issues may allow attackers to execute arbitrary code, bypass security restrictions, obtain sensitive information, perform spoofing attacks, or cause denial-of-service conditions. These issues affect the following: iPhone OS 1.0 through 2.1 iPhone OS for iPod touch 1.1 through 2.1. ----------------------------------------------------------------------
Do you need accurate and reliable IDS / IPS / AV detection rules?
Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/
TITLE: Apple iPhone / iPod touch Multiple Vulnerabilities
SECUNIA ADVISORY ID: SA32756
VERIFY ADVISORY: http://secunia.com/advisories/32756/
CRITICAL: Highly critical
IMPACT: Security Bypass, Spoofing, Exposure of sensitive information, DoS, System access
WHERE:
From remote
OPERATING SYSTEM: Apple iPod touch http://secunia.com/advisories/product/16074/ Apple iPhone http://secunia.com/advisories/product/15128/
DESCRIPTION: Some weaknesses, security issues, and vulnerabilities have been reported in Apple iPhone and iPod touch, which can be exploited by malicious people to bypass certain security restrictions, disclose potential sensitive information, conduct spoofing attacks, to cause a DoS (Denial of Service), or potentially compromise a user's system.
1) A vulnerability in CoreGraphics can potentially be exploited to compromise a vulnerable system.
For more information see vulnerability #3 in: SA31326
2) Several vulnerabilities in the processing of TIFF images can potentially be exploited to execute arbitrary code.
For more information: SA31610
3) An error in the processing of TIFF images can cause a device reset.
4) An unspecified error can result in the encryption level for PPTP VPN connections to be lower than expected.
5) A signedness error in the Office Viewer component can potentially be exploited to execute arbitrary code via a specially crafted Microsoft Excel file.
This is related to vulnerability #10 in: SA32222
6) A weakness exists in the handling of emergency calls, which can be exploited to bypass the Passcode lock and call arbitrary numbers when physical access to the device is provided.
8) A security issue can result in the content of an SMS message being displayed when the message arrives while the emergency call screen is shown.
10) An error in Safari when handling embedded iframe elements can be exploited to spoof the user interface via content being displayed outside its boundaries.
11) An error exists in Safari when launching an application while a call approval dialog is shown. This can be exploited to call an arbitrary number without user interaction. It is also possible to block the user's ability to cancel the call.
12) An error in Webkit can be exploited to disclose potentially sensitive data from form fields, although the "Autocomplete" feature is disabled.
PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1) Michal Zalewski, Google 3) Sergio 'shadown' Alvarez, n.runs AG 4) Stephen Butler, University of Illinois 7) Nolen Scaife 9) Haifei Li of Fortinet's FortiGuard Global Security Research Team 10) John Resig, Mozilla Corporation 11) Collin Mulliner, Fraunhofer SIT 12) an anonymous researcher
ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT3318
OTHER REFERENCES: SA31326: http://secunia.com/advisories/31326/
SA31610: http://secunia.com/advisories/31610/
SA32222: http://secunia.com/advisories/32222/
SA32706: http://secunia.com/advisories/32706/
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability intelligence source on the market.
Implement it through Secunia.
Other vulnerabilities have also been reported of which some may also affect Safari version 3.x.
SOLUTION: Upgrade to Safari version 4, which fixes the vulnerabilities.
PROVIDED AND/OR DISCOVERED BY: 1-3) Tavis Ormandy 4) Chris Evans of Google Inc. Apple Safari Remote Memory Corruption Vulnerability 2009.June.09
Fortinet's FortiGuard Global Security Research Team Discovers Vulnerability in Apple Safari.
Impact:
Remote Code Execution.
Risk:
Critical
Affected Software:
For a list of product versions affected, please see the Apple Security Update reference below.
Additional Information:
The memory corruption vulnerability occurs when handling HTML table elements. A remote attacker may craft a malicious webpage and lure an unsuspecting user. When the page is viewed and these elements are processed, arbitrary code execution may occur resulting in the victims machine being compromised.
Solutions:
Apple security updates are available via their Software Update mechanism. Apple security updates are available for manual download here. The FortiGuard Global Security Research Team released a signature "DHTML.Malicious.Table.Elements", which covers this specific vulnerability.
Fortinet customers who subscribe to Fortinet's intrusion prevention (IPS) service should be protected against this memory corruption vulnerability. Fortinet's IPS service is one component of FortiGuard Subscription Services, which also offer comprehensive solutions such as antivirus, Web content filtering and antispam capabilities. These services enable protection against threats on both application and network layers. FortiGuard Services are continuously updated by the FortiGuard Global Security Research Team, which enables Fortinet to deliver a combination of multi-layered security intelligence and true zero-day protection from new and emerging threats. These updates are delivered to all FortiGate, FortiMail and FortiClient products. Fortinet strictly follows responsible disclosure guidelines to ensure optimum protection during a threat's lifecycle.
References:
FortiGuard Advisory: http://www.fortiguardcenter.com/advisory/FGA-2009-23.html Apple Security Updates for Safari 4.0: http://support.apple.com/kb/HT3613 Apple Security Updates for iPhone: http://support.apple.com/kb/HT3318 CVE ID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4231
Acknowledgement:
Haifei Li of Fortinet's FortiGuard Global Security Research Team
*** This email and any attachments thereto may contain private, confidential, and privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200811-0570",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.1.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "*"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.0"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.1.5"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "2.0"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "2.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.1.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.0.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "2.0.2"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.1.3"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.0.1"
},
{
"model": "iphone os",
"scope": "eq",
"trust": 1.0,
"vendor": "apple",
"version": "1.1.1"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.4.11"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.5.7"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.4.11"
},
{
"model": "mac os x server",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "v10.5.7"
},
{
"model": "ios",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "1.0 to 2.1"
},
{
"model": "ios for ipod touch",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "1.1 to 2.1"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "4.0"
},
{
"model": "iphone",
"scope": null,
"trust": 0.6,
"vendor": "apple",
"version": null
},
{
"model": "ipod touch",
"scope": null,
"trust": 0.6,
"vendor": "apple",
"version": null
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.3"
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2.2"
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.2"
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1.1"
},
{
"model": "safari beta for windows",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0.4"
},
{
"model": "safari beta for windows",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0.3"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0.3"
},
{
"model": "safari beta for windows",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0.2"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0.2"
},
{
"model": "safari beta for windows",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0.1"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.4"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.2"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.2"
},
{
"model": "safari for windows",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3.1"
},
{
"model": "safari beta for windows",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3"
},
{
"model": "safari beta",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3"
},
{
"model": "safari",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "3"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.2"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.4"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.3"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.2"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.1"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
},
{
"model": "ipod touch",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.2"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.4"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.3"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.2"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0.2"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.0.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "2.0"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1.1"
},
{
"model": "iphone",
"scope": "eq",
"trust": 0.3,
"vendor": "apple",
"version": "1"
},
{
"model": "safari for windows",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "safari",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "4"
},
{
"model": "ipod touch",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "2.2"
},
{
"model": "iphone",
"scope": "ne",
"trust": 0.3,
"vendor": "apple",
"version": "2.2"
}
],
"sources": [
{
"db": "BID",
"id": "32394"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002048"
},
{
"db": "NVD",
"id": "CVE-2008-4231"
},
{
"db": "CNNVD",
"id": "CNNVD-200811-393"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:apple:ipod_touch:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:1.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:1.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:1.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:1.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:1.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:1.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:2.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:2.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:apple:iphone_os:1.1.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2008-4231"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sergio AlvarezJohn ResigCollin Mulliner",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200811-393"
}
],
"trust": 0.6
},
"cve": "CVE-2008-4231",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2008-4231",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-34356",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2008-4231",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200811-393",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-34356",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-34356"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002048"
},
{
"db": "NVD",
"id": "CVE-2008-4231"
},
{
"db": "CNNVD",
"id": "CNNVD-200811-393"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Safari in Apple iPhone OS 1.0 through 2.1 and iPhone OS for iPod touch 1.1 through 2.1 does not properly handle HTML TABLE elements, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document. Apple iPhone and iPod touch are prone to multiple vulnerabilities:\n1. A denial-of-service vulnerability in the ImageIO module. \n2. A weakness in Networking. \n3. Two security-bypass vulnerabilities in the Passcode Lock functionality. \n4. An information-disclosure vulnerability in the Passcode Lock functionality. \n5. A memory-corruption vulnerability in Safari. \n6. A spoofing vulnerability in Safari. \n7. A security-bypass vulnerability in Safari. \nSuccessfully exploiting these issues may allow attackers to execute arbitrary code, bypass security restrictions, obtain sensitive information, perform spoofing attacks, or cause denial-of-service conditions. \nThese issues affect the following:\niPhone OS 1.0 through 2.1\niPhone OS for iPod touch 1.1 through 2.1. ----------------------------------------------------------------------\n\nDo you need accurate and reliable IDS / IPS / AV detection rules?\n\nGet in-depth vulnerability details:\nhttp://secunia.com/binary_analysis/sample_analysis/\n\n----------------------------------------------------------------------\n\nTITLE:\nApple iPhone / iPod touch Multiple Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA32756\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/32756/\n\nCRITICAL:\nHighly critical\n\nIMPACT:\nSecurity Bypass, Spoofing, Exposure of sensitive information, DoS,\nSystem access\n\nWHERE:\n\u003eFrom remote\n\nOPERATING SYSTEM:\nApple iPod touch\nhttp://secunia.com/advisories/product/16074/\nApple iPhone\nhttp://secunia.com/advisories/product/15128/\n\nDESCRIPTION:\nSome weaknesses, security issues, and vulnerabilities have been\nreported in Apple iPhone and iPod touch, which can be exploited by\nmalicious people to bypass certain security restrictions, disclose\npotential sensitive information, conduct spoofing attacks, to cause a\nDoS (Denial of Service), or potentially compromise a user\u0027s system. \n\n1) A vulnerability in CoreGraphics can potentially be exploited to\ncompromise a vulnerable system. \n\nFor more information see vulnerability #3 in:\nSA31326\n\n2) Several vulnerabilities in the processing of TIFF images can\npotentially be exploited to execute arbitrary code. \n\nFor more information:\nSA31610\n\n3) An error in the processing of TIFF images can cause a device\nreset. \n\n4) An unspecified error can result in the encryption level for PPTP\nVPN connections to be lower than expected. \n\n5) A signedness error in the Office Viewer component can potentially\nbe exploited to execute arbitrary code via a specially crafted\nMicrosoft Excel file. \n\nThis is related to vulnerability #10 in:\nSA32222\n\n6) A weakness exists in the handling of emergency calls, which can be\nexploited to bypass the Passcode lock and call arbitrary numbers when\nphysical access to the device is provided. \n\n8) A security issue can result in the content of an SMS message being\ndisplayed when the message arrives while the emergency call screen is\nshown. \n\n10) An error in Safari when handling embedded iframe elements can be\nexploited to spoof the user interface via content being displayed\noutside its boundaries. \n\n11) An error exists in Safari when launching an application while a\ncall approval dialog is shown. This can be exploited to call an\narbitrary number without user interaction. It is also possible to\nblock the user\u0027s ability to cancel the call. \n\n12) An error in Webkit can be exploited to disclose potentially\nsensitive data from form fields, although the \"Autocomplete\" feature\nis disabled. \n\nPROVIDED AND/OR DISCOVERED BY:\nThe vendor credits:\n1) Michal Zalewski, Google\n3) Sergio \u0027shadown\u0027 Alvarez, n.runs AG\n4) Stephen Butler, University of Illinois\n7) Nolen Scaife\n9) Haifei Li of Fortinet\u0027s FortiGuard Global Security Research Team\n10) John Resig, Mozilla Corporation\n11) Collin Mulliner, Fraunhofer SIT\n12) an anonymous researcher\n\nORIGINAL ADVISORY:\nApple:\nhttp://support.apple.com/kb/HT3318\n\nOTHER REFERENCES:\nSA31326:\nhttp://secunia.com/advisories/31326/\n\nSA31610:\nhttp://secunia.com/advisories/31610/\n\nSA32222:\nhttp://secunia.com/advisories/32222/\n\nSA32706:\nhttp://secunia.com/advisories/32706/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. ----------------------------------------------------------------------\n\nDo you have VARM strategy implemented?\n\n(Vulnerability Assessment Remediation Management) \n\nIf not, then implement it through the most reliable vulnerability\nintelligence source on the market. \n\nImplement it through Secunia. \n\nOther vulnerabilities have also been reported of which some may also\naffect Safari version 3.x. \n\nSOLUTION:\nUpgrade to Safari version 4, which fixes the vulnerabilities. \n\nPROVIDED AND/OR DISCOVERED BY:\n1-3) Tavis Ormandy\n4) Chris Evans of Google Inc. Apple Safari Remote Memory Corruption Vulnerability\n2009.June.09\n\nFortinet\u0027s FortiGuard Global Security Research Team Discovers Vulnerability in Apple Safari. \n\nImpact:\n=======\nRemote Code Execution. \n\nRisk:\n=====\nCritical\n\nAffected Software:\n==================\nFor a list of product versions affected, please see the Apple Security Update reference below. \n\nAdditional Information:\n=======================\nThe memory corruption vulnerability occurs when handling HTML table elements. A remote attacker may craft a malicious webpage and lure an unsuspecting user. When the page is viewed and these elements are processed, arbitrary code execution may occur resulting in the victims machine being compromised. \n\nSolutions:\n==========\nApple security updates are available via their Software Update mechanism. \nApple security updates are available for manual download here. \nThe FortiGuard Global Security Research Team released a signature \"DHTML.Malicious.Table.Elements\", which covers this specific vulnerability. \n\nFortinet customers who subscribe to Fortinet\u0027s intrusion prevention (IPS) service should be protected against this memory corruption vulnerability. Fortinet\u0027s IPS service is one component of FortiGuard Subscription Services, which also offer comprehensive solutions such as antivirus, Web content filtering and antispam capabilities. These services enable protection against threats on both application and network layers. FortiGuard Services are continuously updated by the FortiGuard Global Security Research Team, which enables Fortinet to deliver a combination of multi-layered security intelligence and true zero-day protection from new and emerging threats. These updates are delivered to all FortiGate, FortiMail and FortiClient products. Fortinet strictly follows responsible disclosure guidelines to ensure optimum protection during a threat\u0027s lifecycle. \n\nReferences:\n===========\nFortiGuard Advisory: http://www.fortiguardcenter.com/advisory/FGA-2009-23.html\nApple Security Updates for Safari 4.0: http://support.apple.com/kb/HT3613\nApple Security Updates for iPhone: http://support.apple.com/kb/HT3318\nCVE ID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4231\n\nAcknowledgement:\n================\nHaifei Li of Fortinet\u0027s FortiGuard Global Security Research Team\n\n\n*** This email and any attachments thereto may contain private, confidential, and privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto",
"sources": [
{
"db": "NVD",
"id": "CVE-2008-4231"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002048"
},
{
"db": "BID",
"id": "32394"
},
{
"db": "VULHUB",
"id": "VHN-34356"
},
{
"db": "PACKETSTORM",
"id": "72169"
},
{
"db": "PACKETSTORM",
"id": "78192"
},
{
"db": "PACKETSTORM",
"id": "78258"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2008-4231",
"trust": 2.9
},
{
"db": "BID",
"id": "32394",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "32756",
"trust": 2.6
},
{
"db": "VUPEN",
"id": "ADV-2008-3232",
"trust": 2.5
},
{
"db": "SECTRACK",
"id": "1021272",
"trust": 2.5
},
{
"db": "OSVDB",
"id": "50028",
"trust": 2.5
},
{
"db": "SECUNIA",
"id": "35379",
"trust": 1.8
},
{
"db": "VUPEN",
"id": "ADV-2009-1522",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002048",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200811-393",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "78258",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-34356",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "72169",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "78192",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-34356"
},
{
"db": "BID",
"id": "32394"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002048"
},
{
"db": "PACKETSTORM",
"id": "72169"
},
{
"db": "PACKETSTORM",
"id": "78192"
},
{
"db": "PACKETSTORM",
"id": "78258"
},
{
"db": "NVD",
"id": "CVE-2008-4231"
},
{
"db": "CNNVD",
"id": "CNNVD-200811-393"
}
]
},
"id": "VAR-200811-0570",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-34356"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T10:55:43.956000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "HT3613",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht3613"
},
{
"title": "HT3318",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht3318"
},
{
"title": "HT3318",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht3318?viewlocale=ja_jp"
},
{
"title": "HT3613",
"trust": 0.8,
"url": "http://support.apple.com/kb/ht3613?viewlocale=ja_jp"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-002048"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-399",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-34356"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002048"
},
{
"db": "NVD",
"id": "CVE-2008-4231"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/32394"
},
{
"trust": 2.5,
"url": "http://osvdb.org/50028"
},
{
"trust": 2.5,
"url": "http://www.securitytracker.com/id?1021272"
},
{
"trust": 2.5,
"url": "http://secunia.com/advisories/32756"
},
{
"trust": 2.5,
"url": "http://www.vupen.com/english/advisories/2008/3232"
},
{
"trust": 2.2,
"url": "http://support.apple.com/kb/ht3318"
},
{
"trust": 2.1,
"url": "http://www.fortiguardcenter.com/advisory/fga-2009-23.html"
},
{
"trust": 1.9,
"url": "http://support.apple.com/kb/ht3613"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2008/nov/msg00002.html"
},
{
"trust": 1.7,
"url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/archive/1/504211/100/0/threaded"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/35379"
},
{
"trust": 1.7,
"url": "http://www.vupen.com/english/advisories/2009/1522"
},
{
"trust": 0.9,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-4231"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2008-4231"
},
{
"trust": 0.3,
"url": "http://www.apple.com/iphone/"
},
{
"trust": 0.3,
"url": "http://www.apple.com/ipodtouch/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/binary_analysis/sample_analysis/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/32756/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/32222/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/31326/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/product/16074/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/32706/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/product/15128/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/31610/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/35379/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/33970/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34723/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/business_solutions/"
},
{
"trust": 0.1,
"url": "http://scary.beasts.org/security/cesa-2009-006.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2008-4231"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-34356"
},
{
"db": "BID",
"id": "32394"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002048"
},
{
"db": "PACKETSTORM",
"id": "72169"
},
{
"db": "PACKETSTORM",
"id": "78192"
},
{
"db": "PACKETSTORM",
"id": "78258"
},
{
"db": "NVD",
"id": "CVE-2008-4231"
},
{
"db": "CNNVD",
"id": "CNNVD-200811-393"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-34356"
},
{
"db": "BID",
"id": "32394"
},
{
"db": "JVNDB",
"id": "JVNDB-2008-002048"
},
{
"db": "PACKETSTORM",
"id": "72169"
},
{
"db": "PACKETSTORM",
"id": "78192"
},
{
"db": "PACKETSTORM",
"id": "78258"
},
{
"db": "NVD",
"id": "CVE-2008-4231"
},
{
"db": "CNNVD",
"id": "CNNVD-200811-393"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2008-11-25T00:00:00",
"db": "VULHUB",
"id": "VHN-34356"
},
{
"date": "2008-11-20T00:00:00",
"db": "BID",
"id": "32394"
},
{
"date": "2008-12-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-002048"
},
{
"date": "2008-11-21T13:17:13",
"db": "PACKETSTORM",
"id": "72169"
},
{
"date": "2009-06-10T12:30:42",
"db": "PACKETSTORM",
"id": "78192"
},
{
"date": "2009-06-11T00:15:07",
"db": "PACKETSTORM",
"id": "78258"
},
{
"date": "2008-11-25T23:30:00.437000",
"db": "NVD",
"id": "CVE-2008-4231"
},
{
"date": "2008-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200811-393"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-11T00:00:00",
"db": "VULHUB",
"id": "VHN-34356"
},
{
"date": "2009-06-10T17:39:00",
"db": "BID",
"id": "32394"
},
{
"date": "2009-07-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2008-002048"
},
{
"date": "2022-08-09T13:48:58.247000",
"db": "NVD",
"id": "CVE-2008-4231"
},
{
"date": "2022-08-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200811-393"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "78258"
},
{
"db": "CNNVD",
"id": "CNNVD-200811-393"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple iPhone OS of Safari Vulnerable to arbitrary code execution",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2008-002048"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "resource management error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200811-393"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.