Technical Description

Multiple vulnerabilities have been identified in Apple iPhone and iPod touch, which could be exploited by attackers to bypass security restrictions, cause a denial of service or compromise a vulnerable system. These issues are caused by memory corruption, uninitialized memory access, memory exhaustion, signedness issues, input validation, and design errors in CoreGraphics, ImageIO, Networking, Office Viewer, Passcode Lock, Safari and Webkit, which could allow attackers to crash an affected application, execute arbitrary code, bypass restrictions and security checks, or conduct spoofing attacks. For additional information, see : VUPEN/ADV-2008-2268 - VUPEN/ADV-2008-2780 - VUPEN/ADV-2008-3155

Affected Products

Apple iPhone versions 1.0 through 2.1
Apple iPod touch versions 1.1 through 2.1

Solution

Upgrade to version 2.2.

References

http://www.vupen.com/english/advisories/2008/3232
http://support.apple.com/kb/HT3318

Credits

Vulnerabilities reported by the vendor, Michal Zalewski (Google), Sergio shadown Alvarez (n.runs AG), Stephen Butler (University of Illinois of Urbana-Champaign), Nolen Scaife, Haifei Li (Fortinet FortiGuard Global Security Research Team), John Resig (Mozilla Corporation) and Collin Mulliner (Fraunhofer SIT).

ChangeLog

2008-11-24 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.