lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <4C737207.2030204@eternal-todo.com>
Date: Tue, 24 Aug 2010 09:17:27 +0200
From: Jose Miguel Esparza <jesparza@...rnal-todo.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: On the iPhone PDF and kernel exploit

Robert S'wie;cki escribió:
> On Fri, Aug 6, 2010 at 10:14 AM, Jose Miguel Esparza
> <josemiguel.esparza@...il.com> wrote:
>   
>> Hi!
>>
>> I took a look at the PDF some days ago, looking for the PDF vuln, you
>> can see my post  about it here:
>>
>> http://eternal-todo.com/blog/jailbreakme-pdf-exploit
>>
>> Anyway, I continue analysing it...
>>     
>
> <cite>"At the moment there's no available patch so it's recommended
> some type of mitigation and to be careful with the visited
> links"....</cite>
>
> The fix seems to be here:
> http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=11d65e8a1f1f14e56148fd991965424d9bd1cdbc
> (http://www.kb.cert.org/vuls/id/275247)
>
> I wonder if this was in any way inspired by my previous bugreport in
> June (the same piece of code, slightly different attack vector).
>
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-2497
> http://savannah.nongnu.org/bugs/index.php?30083
>
> Maybe, maybe not..
>
>   
Hi,

I forgot to update this thread, maybe late but I add more info about it, 
more concretely, about the way the Type2 operands work and how this 
vulnerability can be exploited...

http://eternal-todo.com/blog/more-jailbreakme-pdf-exploit

Robert, I think it's not the same bug because yours is related to an 
integer overflow, isn't it?

-- 
Jose Miguel Esparza
http://eternal-todo.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ