ID

VAR-201211-0321

CVE

CVE-2012-3750

TITLE

Apple iOS 6.0.1 Vulnerabilities that can bypass passcode requests in less than passcode lock implementations

DESCRIPTION

The Passcode Lock implementation in Apple iOS before 6.0.1 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement and access Passbook passes via unspecified vectors. Apple iOS for the iPhone, the iPod touch, and the iPad is prone to a local security-bypass vulnerability. An attacker with physical access to the affected device can exploit this issue to access user data without entering a passcode. The issue is fixed in Apple iOS 6.0.1. Adjacent attackers could exploit this vulnerability to gain access to Passbooks via an unknown vector, bypassing the destination password requirement. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2012-11-01-1 iOS 6.0.1 iOS 6.0.1 is now available and addresses the following: Kernel Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later Impact: Maliciously crafted or compromised iOS applications may be able to determine addresses in the kernel Description: An information disclosure issue existed in the handling of APIs related to kernel extensions. Responses containing an OSBundleMachOHeaders key may have included kernel addresses, which may aid in bypassing address space layout randomization protection. This issue was addressed by unsliding the addresses before returning them. CVE-ID CVE-2012-3749 : Mark Dowd of Azimuth Security, Eric Monti of Square, and additional anonymous researchers Passcode Lock Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later Impact: A person with physical access to the device may be able to access Passbook passes without entering a passcode Description: A state management issue existed in the handling of Passbook passes at the lock screen. This issue was addressed through improved handling of Passbook passes. CVE-ID CVE-2012-3750 : Anton Tsviatkou WebKit Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A time of check to time of use issue existed in the handling of JavaScript arrays. This issue was addressed through additional validation of JavaScript arrays. CVE-ID CVE-2012-3748 : Joost Pol and Daan Keuper of Certified Secure working with HP TippingPoint's Zero Day Initiative WebKit Available for: iPhone 3GS and later, iPod touch (4th generation) and later, iPad 2 and later Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: A use after free issue existed in the handling of SVG images. This issue was addressed through improved memory handling. CVE-ID CVE-2012-5112 : Pinkie Pie working with Google's Pwnium 2 contest Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. The version after applying this update will be "6.0.1". Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJQkZabAAoJEPefwLHPlZEwr00P/204OjJMiHe2I/bhwLanLfxw NEm7Ds0rBTZo7pA2mjeabUO1QpjeIZptMxtAD3p769KVd+eF9NO8ap3OaKzzhb2B uKvaiyLRcUG0mQh87e0K9hiZdU6N8yyBpoodK4/7vJFVDqxqlanmS/ewIPtG+a4L aIZcuy7ats8djpTd2tjVUGHhvtkX5exzU8+/F+ajISYMxQqYa26sAvAobJTvQWAx v9fanfgpE+hVXSH879yJlHIh7H64YhA8M+qQEzW2fz/YRXP/YC2tlFxvVUzB5Lyj uR2ER9MLi02rbJQbYzMEooWq2niPlh+c2LG+5KAqCGUGHWomTbeWui/yS27uQLrJ sbkpkaZuJPL5d1Mn9x70hlWyB6jpbfwsBw+H9XPYtHk1YhslYofNCdShJc8RNtME NSXjU2MBnga1KcQI9Kyyt6OfmGYqRKWqcX+xPuPhKdTCM3S4c6M1UgiVJgeQh5+f Wu87jgZ45CSiu28M2XN6wNKJflhrGpxBYdIGJHsYxu9lfh3WUFpr14NFpe//MChS Xhtiq9Neo+UqcYH1xV40FESHRy3iSe3jj2kJceUxvu0juLEdkYZu4aVp+2nCQokl akQ7iOvcE4l42LpO9GiVfo2PgtyH4vq5gyzpWRWtjhi3F6HDWY3yFBciYlzy0qsu am5QBITYy5QuxM/Pg+MO =eLYi -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/ ---------------------------------------------------------------------- TITLE: Apple iOS Multiple Vulnerabilities SECUNIA ADVISORY ID: SA51162 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/51162/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=51162 RELEASE DATE: 2012-11-02 DISCUSS ADVISORY: http://secunia.com/advisories/51162/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/51162/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=51162 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A weakness and multiple vulnerabilities have been reported in Apple iOS, which can be exploited by malicious people with physical access to bypass certain security restrictions and by malicious people to disclose certain system information and compromise a vulnerable device. 1) The weakness is caused due to an error within the kernel when handling certain APIs and can be exploited to disclose the OSBundleMachOHeaders key, which includes kernel addresses. 3) Some vulnerabilities exist due to a bundled vulnerable version of the WebKit component. PROVIDED AND/OR DISCOVERED BY: The vendor credits: 1) Mark Dowd of Azimuth Security, Eric Monti of Square, and anonymous people 2) Anton Tsviatkou ORIGINAL ADVISORY: APPLE-SA-2012-11-01-1: http://support.apple.com/kb/HT5567 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

permissions and access control

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Anton Tsviatkou

SOURCES

LAST UPDATE DATE

2025-04-11T20:35:30.065000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE