You are here

U-036: Apple iOS Bugs Let Remote Users Execute Arbitrary Code

November 15, 2011 - 8:00am

Addthis

PROBLEM:

Apple iOS Bugs Let Remote Users Execute Arbitrary Code and Obtain Information and Let Local Users Bypass Authentication.

PLATFORM:

iOS 3.0 through 5.0 for iPhone 3GS
iPhone 4 and iPhone 4S
iOS 3.1 through 5.0 for iPod touch (3rd generation) and later
iOS 3.2 through 5.0 for iPad, iOS 4.3 through 5.0 for iPad 2

ABSTRACT:

A remote user can create content that, when loaded by the target user, will execute arbitrary code on or obtain potentially sensitive information from the target user's system.

referenceĀ  LINKS:

Apple Security Article: HT5052
Apple Product Security
SecurityTracker Alert ID: 1026311

IMPACT ASSESSMENT:

High

Discussion:

Several vulnerabilities were reported in Apple iOS.
A remote user can cause arbitrary code to be executed on the target user's system. A physically local user can bypass authentication. A remote user can obtain potentially sensitive information. A remote user can create a specially crafted FreeType font that, when loaded by the target user, will execute arbitrary code on the target user's system CVE-2011-3439.

A remote user can create specially crafted HTML that, when loaded by the target user, will cause libinfo to disclose potentially sensitive information via DNS name lookups CVE-2011-3441.

A physically local user can open an iPad 2 Smart Cover while the device is confirming power off in the locked state to bypass the authentication passcode request CVE-2011-3440. The user cannot launch apps or access data protected by Data Protection.

Impact:

A remote user can create content that, when loaded by the target user, will execute arbitrary code on or obtain potentially sensitive information from the target user's system.

Solution:

The vendor has issued a fix 5.0.1
Apple security updates
Software Update
Apple Downloads

Addthis