Multiple vulnerabilities have been identified in Apple iPhone and iPod touch, which could be exploited by attackers to bypass security restrictions, gain knowledge of sensitive information, cause a denial of service or compromise a vulnerable system.

The first issue is caused by a buffer overflow error when processing malformed MP4 files, which could be exploited by attackers to execute arbitrary code.

The second vulnerability is caused by a buffer underflow error in ImageIO when handling malformed TIFF images, which could be exploited by attackers to execute arbitrary code.

The third issue is caused due to a memory corruption error when handling certain USB control messages, which could allow an attacker with physical access to a vulnerable device to bypass the passcode and access the user's data.

The fourth vulnerability is caused by input validation errors in WebKit when handling FTP directory listings, which could be exploited to disclose sensitive information or execute arbitrary code.

The fifth issue is caused due to WebKit automatically sending requests to remote servers when encountering an HTML 5 Media Element pointing to an external resource, which could allow attackers to gain knowledge of certain information (e.g. determine if a message was read).

Affected Products

Apple iPhone OS versions 1.0 through 3.1.2
Apple iPhone OS for iPod touch versions 1.1 through 3.1.2

Solution

Upgrade to version 3.1.3.

References

http://www.vupen.com/english/advisories/2010/0285
http://support.apple.com/kb/HT4013

Credits

Vulnerabilities reported by the vendor, Tobias Klein (trapkit.de) and Michal Zalewski (Google Inc.).

Changelog

2010-02-03 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.