full-disclosure

Open Source and information security mailing list archives

Message-ID: <007a01d14283$77c456c0$9b7a6fd5@pc>
Date: Tue, 29 Dec 2015 23:52:58 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>,
	<fulldisclosure@...lists.org>
Subject: [FD] Vulnerabilities in Mobile Safari

Hello list!

There are multiple vulnerabilities in Mobile Safari. There are Denial of
Service and Cross-Site Scripting vulnerabilities.

In the middle of December I checked all exploits for different browsers,
which I published and non-published since 2006, in Mobile Safari for iOS
6.0.1 and 8.4.1. This is the first part of vulnerabilities.

-------------------------
Affected products:
-------------------------

Vulnerable are Mobile Safari 6.0.1 and 8.4.1 for iOS and previous versions.

----------
Details:
----------

Denial of Service (WASC-10):

Crash or freezing (with further crash) of the browser.

http://websecurity.com.ua/uploads/2006/Mozilla_Firefox_IE_DoS_Exploit.html -
in 6.0.1, and in 8.4.1 without crash, only consuming 60% CPU.

http://websecurity.com.ua/uploads/2008/Firefox%203%20DoS%20Exploit.html - in
6.0.1.

http://websecurity.com.ua/uploads/2008/Firefox%20DoS%20Exploit3.html - in
6.0.1, and in 8.4.1 without crash, only consuming 60% CPU.

http://websecurity.com.ua/uploads/2008/Firefox%20DoS%20Exploit4.html - in
6.0.1, and in 8.4.1 without crash, only consuming 60% CPU.

http://websecurity.com.ua/uploads/2008/Firefox,%20IE,%20Opera%20&%20Chrome%20DoS%20Exploit.html -
in 6.0.1.

Made exploit for Mobile Safari, which is similar to 2008's exploit for 
Firefox:

http://websecurity.com.ua/uploads/2015/Safari%20DoS%20Exploit.html

Cross-Site Scripting (WASC-08):

Bypass XSS filters in Mobile Safari 6.0.1 and 8.4.1. The attack is possible
with using the next characters: 9 (0x09), 10 (0x0a), 12 (0x0c), 13 (0x0d),
32 (0x20), 47 (0x2f).

About it read my article Bypassing filters for conducting XSS attacks
http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2013-February/008727.html.

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/8090/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives