AusCERT - ESB-2011.0439 - [Apple iOS] Apple iOS: Multiple vulnerabilities

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
ESB-2011.0439 - [Apple iOS] Apple iOS: Multiple vulnerabilities
Date: 15 April 2011
References: ESB-2011.0314 ESB-2011.0667 ESB-2011.0772 ESB-2011.1029 ESB-2011.1036

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2011.0439
                    iOS 4.3.2 and 4.2.7 Software Update
                               15 April 2011

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Apple iOS
Publisher:         Apple
Operating System:  Apple iOS
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Provide Misleading Information  -- Remote/Unauthenticated      
                   Reduced Security                -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2011-1417 CVE-2011-1344 CVE-2011-1290
                   CVE-2011-0195  

Reference:         ESB-2011.0314

Original Bulletin: 
   http://support.apple.com/kb/HT4606
   http://support.apple.com/kb/HT4607

Comment: This bulletin contains two (2) Apple security advisories.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

APPLE-SA-2011-04-14-1 iOS 4.3.2 Software Update

iOS 4.3.2 Software Update is now available and addresses the
following:

Certificate Trust Policy
Available for:  iOS 3.0 through 4.3.1 for iPhone 3GS and later,
iOS 3.1 through 4.3.1 for iPod touch (3rd generation) and later,
iOS 3.2 through 4.3.1 for iPad
Impact:  An attacker with a privileged network position may intercept
user credentials or other sensitive information
Description:  Several fraudulent SSL certificates were issued by a
Comodo affiliate registration authority. This may allow a man-in-the-
middle attacker to redirect connections and intercept user
credentials or other sensitive information. This issue is addressed
by blacklisting the fraudulent certificates. Note: For Mac OS X
systems, this issue is addressed with Security Update 2011-002. For
Windows systems, Safari relies on the certificate store of the host
operating system to determine if an SSL server certificate is
trustworthy. Applying the update described in Microsoft Knowledge
Base Article 2524375 will cause Safari to regard these certificates
as untrusted. The article is available at
http://support.microsoft.com/kb/2524375

libxslt
Available for:  iOS 3.0 through 4.3.1 for iPhone 3GS and later,
iOS 3.1 through 4.3.1 for iPod touch (3rd generation) and later,
iOS 3.2 through 4.3.1 for iPad
Impact:  Visiting a maliciously crafted website may lead to the
disclosure of addresses on the heap
Description:  libxslt's implementation of the generate-id() XPath
function disclosed the address of a heap buffer. Visiting a
maliciously crafted website may lead to the disclosure of addresses
on the heap, which may aid in bypassing address space layout
randomization protection. This issue is addressed by generating an ID
based on the difference between the addresses of two heap buffers.
CVE-ID
CVE-2011-0195 : Chris Evans of Google Chrome Security Team

QuickLook
Available for:  iOS 3.0 through 4.3.1 for iPhone 3GS and later,
iOS 3.1 through 4.3.1 for iPod touch (3rd generation) and later,
iOS 3.2 through 4.3.1 for iPad
Impact:  Viewing a maliciously crafted Microsoft Office file may lead
to an unexpected application termination or arbitrary code execution
Description:  A memory corruption issue existed in QuickLook's
handling of Microsoft Office files. Viewing a maliciously crafted
Microsoft Office file may lead to an unexpected application
termination or arbitrary code execution.
CVE-ID
CVE-2011-1417 : Charlie Miller and Dion Blazakis working with
TippingPoint's Zero Day Initiative

WebKit
Available for:  iOS 3.0 through 4.3.1 for iPhone 3GS and later,
iOS 3.1 through 4.3.1 for iPod touch (3rd generation) and later,
iOS 3.2 through 4.3.1 for iPad
Impact:  Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description:  An integer overflow issue existed in the handling of
nodesets. Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution.
CVE-ID
CVE-2011-1290 : Vincenzo Iozzo, Willem Pinckaers, Ralf-Philipp
Weinmann, and an anonymous researcher working with TippingPoint's
Zero Day Initiative

WebKit
Available for:  iOS 3.0 through 4.3.1 for iPhone 3GS and later,
iOS 3.1 through 4.3.1 for iPod touch (3rd generation) and later,
iOS 3.2 through 4.3.1 for iPad
Impact:  Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description:  A use after free issue existed in the handling of text
nodes. Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution.
CVE-ID
CVE-2011-1344 : Vupen Security working with TippingPoint's Zero Day
Initiative, and Martin Barbella


Installation note:

These updates are only available through iTunes, and will not appear
in your computer's Software Update application, or in the Apple
Downloads site. Make sure you have an Internet connection and have
installed the latest version of iTunes from www.apple.com/itunes/

iTunes will automatically check Apple's update server on its weekly
schedule. When an update is detected, it will download it. When
the iPhone, iPod touch or iPad is docked, iTunes will present the
user with the option to install the update. We recommend applying
the update immediately if possible. Selecting Don't Install will
present the option the next time you connect your iPhone, iPod touch,
or iPad.

The automatic update process may take up to a week depending on the
day that iTunes checks for updates. You may manually obtain the
update via the Check for Updates button within iTunes. After doing
this, the update can be applied when your iPhone, iPod touch, or iPad
is docked to your computer.

To check that the iPhone, iPod touch, or iPad has been updated:

* Navigate to Settings
* Select General
* Select About. The version after applying this update will be
"4.3.2 (8H8)" or later for iPad 2 for Verizon, and 
"4.3.2 (8H7)" or later for everything else.

Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (Darwin)

iQEcBAEBAgAGBQJNphkoAAoJEGnF2JsdZQeeNUUH/R/gm+Yj9JeB63lwtcnOBLD4
PMkNjIOItDLb/cjPaof6kiSDTgHxA3ZYyrxFLQ7Z1bYLqOhk8OLGAPspzXW1koE3
Hr8vG1NUVJS8NsQH5jdcADl4YBtHkh94Xyq+151I8N8cwHMmJAZcO04aQ1/EjZqf
X9NgaasaYL2gpt0wNuzupPEkxnyim8cBs/9JEmT3cehSGBl3bcusVLbZYKit3woZ
oYz3XHAwvd0+FN6jvlnWwmZp1PVi8AO8KoWnymRzS7LqFJfRfrnRlZxYCiI/76S8
Hfku1fZ9uJqOZ4wiENil6PjPSEiwpXIX6oCNf8lUuWugvlo0rXB0wVunAJWsOqE=
=FB1s
- -----END PGP SIGNATURE-----




- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

APPLE-SA-2011-04-14-2 iOS 4.2.7 Software Update for iPhone

iOS 4.2.7 Software Update for iPhone is now available and addresses
the following:

Certificate Trust Policy
Available for:  iOS 4.2.5 through 4.2.6 for iPhone 4 (CDMA)
Impact:  An attacker with a privileged network position may intercept
user credentials or other sensitive information
Description:  Several fraudulent SSL certificates were issued by a
Comodo affiliate registration authority. This may allow a man-in-the-
middle attacker to redirect connections and intercept user
credentials or other sensitive information. This issue is addressed
by blacklisting the fraudulent certificates. Note: For Mac OS X
systems, this issue is addressed with Security Update 2011-002. For
Windows systems, Safari relies on the certificate store of the host
operating system to determine if an SSL server certificate is
trustworthy. Applying the update described in Microsoft Knowledge
Base Article 2524375 will cause Safari to regard these certificates
as untrusted. The article is available at
http://support.microsoft.com/kb/2524375

QuickLook
Available for:  iOS 4.2.5 through 4.2.6 for iPhone 4 (CDMA)
Impact:  Viewing a maliciously crafted Microsoft Office file may lead
to an unexpected application termination or arbitrary code execution
Description:  A memory corruption issues existed in QuickLook's
handling of Microsoft Office files. Viewing a maliciously crafted
Microsoft Office file may lead to an unexpected application
termination or arbitrary code execution.
CVE-ID
CVE-2011-1417 : Charlie Miller and Dion Blazakis working with
TippingPoint's Zero Day Initiative

WebKit
Available for:  iOS 4.2.5 through 4.2.6 for iPhone 4 (CDMA)
Impact:  Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description:  An integer overflow issue existed in the handling of
nodesets. Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution.
CVE-ID
CVE-2011-1290 : Vincenzo Iozzo, Willem Pinckaers, Ralf-Philipp
Weinmann, and an anonymous researcher working with TippingPoint's
Zero Day Initiative

WebKit
Available for:  iOS 4.2.5 through 4.2.6 for iPhone 4 (CDMA)
Impact:  Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description:  A use after free issue existed in the handling of text
nodes. Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution.
CVE-ID
CVE-2011-1344 : Vupen Security working with TippingPoint's Zero Day
Initiative, and Martin Barbella


Installation note:

These updates are only available through iTunes, and will not appear
in your computer's Software Update application, or in the Apple
Downloads site. Make sure you have an Internet connection and have
installed the latest version of iTunes from www.apple.com/itunes/

iTunes will automatically check Apple's update server on its weekly
schedule. When an update is detected, it will download it. When
the iPhone is docked, iTunes will present the user with the option
to install the update. We recommend applying the update immediately
if possible. Selecting Don't Install will present the option the next
time you connect your iPhone.

The automatic update process may take up to a week depending on the
day that iTunes checks for updates. You may manually obtain the
update via the Check for Updates button within iTunes. After doing
this, the update can be applied when your iPhone is docked to your
computer.

To check that the iPhone has been updated:

* Navigate to Settings
* Select General
* Select About. The version after applying this update will be
"4.3.2 (8E303)" or later.

Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (Darwin)

iQEcBAEBAgAGBQJNphojAAoJEGnF2JsdZQee+PkH/jySYbKcPWTvTgPOqIxLqvqt
CS1cED9lNnkFhPHosGDKaQYPF307PnDNyOCuUEymHf7MU/vJTiX8kaHWrAozG5XR
CxgA50aT7/w+xjAwcOzeEJQyFMik1wZsnkyrXZl48Ww+vut9q35jnojE+ChWoTpJ
npftYZHkOr/+ct76/m7gPVkG3UFP2myP5SbUTKSDgTIjm/QMw7Px01rcm5SVRojc
5vaqs1dOaR+gJfiKebwjvHDBmMp1Yx8uDZdkj2cft1U6QTIrQuJIljWWk4uJrv63
pokVEz5nTcBhaz4N84U9+0qjCQZ7vRgjvkhni/It/QDfmrj0UtwLTjl3Pkua66s=
=lA4q
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://www.auscert.org.au/1967

iD8DBQFNp52u/iFOrG6YcBERAoP8AKCEroAcA4CD8NYovRjPLMAedCOA+gCgrocO
YWukfmVWbxmY1StGQg/j1Lw=
=V71w
-----END PGP SIGNATURE-----