ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev
Home / News & Blogs / Zero Day

Code execution holes in iPhone OS, iPod Touch

By | February 2, 2010, 11:09am PST

Summary: The most serious flaw could allow remote code execution if an iPhone/iPod Touch user opens audio and image files.

Apple has shipped a patch to cover five documented vulnerabilities that expose iPhone and iPod Touch users to malicious hacker attacks.

The most serious flaw could allow remote code execution if an iPhone/iPod Touch user opens audio and image files.
Here’s the skinny on the vulnerabilities being patched with this iPhone OS 3.1.3 and iPhone OS 3.1.3 for iPod Touch update:

  • CoreAudio (CVE-2010-0036) — A buffer overflow exists in the handling of mp4 audio files. Playing a maliciously crafted mp4 audio file may lead to an unexpected application termination or arbitrary code execution.
  • ImageIO (CVE-2009-2285) –  A buffer underflow exists in ImageIO’s handling of TIFF
    images. Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution.
  • Recovery Mode (CVE-2010-0038) — A memory corruption issue exists in the handling of a
    certain USB control message. A person with physical access to the device could use this to bypass the passcode and access the user’s data.
  • WebKit (CVE-2009-3384) — Multiple input validation issues exist in WebKit’s handling of FTP directory listings. Accessing a maliciously crafted FTP server may lead to information disclosure, unexpected application termination, or execution of arbitrary code.
  • WebKit (CVE-2009-2841) — When WebKit encounters an HTML 5 Media Element pointingto an external resource, it does not issue a resource load callback to determine if the resource should be loaded. This may result in undesired requests to remote servers. As an example, the sender of an HTML-formatted email message could use this to determine that the message was read.

This iPhone/iPod Touch update is only available through iTunes and will not appear in the software update utility available in Mac and Windows systems.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Zero Day”

Topics

Apple iPhone, Apple iPod, Operating System, Apple iPod Touch, Smart Phones, Digital Music, Digital Media, Consumer Electronics, Personal Technology, Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Disclosure

Ryan Naraine

The most important disclosure is of my employment with Kaspersky Lab as a member of the global research and analysis team. Kaspersky Lab is a global company specializing in anti-malware and secure content management technologies. I do not own stocks or other investments in any technology company.

Biography

Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content management technologies.

Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.

Ryan can be reached at naraine SHIFT 2 gmail.com. For daily updates on Ryan's activities, follow him on Twitter.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
Ask a Question Start a Discussion
85
Comments
Add Your Opinion

Join the conversation!

Just In

RE: Code execution holes in iPhone OS, iPod Touch
efsane Updated - 8th Apr 2011
Great!!! thanks for sharing this information to us!
sesli sohbet sesli chat
View in thread
0 Votes
+ -
Kills Jailbreaking
Screen Name 2nd Feb 2010
You forget to mention: If a user updates, he will then be unable to jailbreak.
0 Votes
+ -
A well deserved killing...
i8thecat 2nd Feb 2010
Anyone who hacks any device and is STUPID
enough to try to install a manufacturer update
on the hacked device is as stupid as you can
get and still be able to breathe...

Hacking any device breaks the EULA and voids
warranty and support... including updates...

It's sad that people are stupid enough to try
to hack a device with some stranger's hack...
They get what they deserve...
0 Votes
+ -
Indeed
tracy anne 2nd Feb 2010
What I got was a more useful device. I think I deserved that after paying what I did for the overpriced piece of cr4p.

Fortunately I dropped it on the concrete footpath, and wonder of wonders it broke, now I can replace it, with the insurance money, with a Nokia n900. Sometimes good things happen.
0 Votes
+ -
Why don't I believe you?
vulpine@... 2nd Feb 2010
n/t
0 Votes
+ -
I don't know
tracy anne 3rd Feb 2010
n/t
0 Votes
+ -
That's like saying..
AzuMao 2nd Feb 2010
..that WGA is evil, because it prevents people from installing
pirated Windows on their overpriced Dell piece of cr4p.


Actually that's a bad comparison, since WGA caused problems for legit
users, not just people hacking their systems illegally. Nevermind.
0 Votes
+ -
Also
Pete "athynz" Athens 3rd Feb 2010
the OS on the iPhones is NOT pirated... just modified a bit.
0 Votes
+ -
I don't think he understands "useful"...nt
ItsTheBottomLine 3rd Feb 2010
nt
0 Votes
+ -
Well who is stupid?
scsi72@... 2nd Feb 2010
I like the apple's devices but I don't like their business policy. It's not stupid to get the control of something that you buy. It's like carmakers don't allow you to change anything in your car. Even the kind of gas that you use. Read this article and you can jugde better the jailbreakers http://blogs.zdnet.com/Apple/?p=5922&tag=col1;post-5928
0 Votes
+ -
If you don't like Apple's business policies....
Lester Young 2nd Feb 2010
...then don't buy their products. There's nothing so uniquely cool about the iPhone that's worth the hassles and risks of jailbreaking.
0 Votes
+ -
And there's usually some
Pete "athynz" Athens Updated - 3rd Feb 2010
uninformed person (and I'm deliberately resisting the urge to use another word here BTW) who bleats about how people should not get an iPhone if they don't like how Apple does things... honestly what does that contribute to this whole thing? For those who jumped into purchasing the iPhone without researching it are stuck unless they are still in their 30 day trial period... those who did their research know the limitations AND how to safely and easily modify the OS to overcome those limitations.
0 Votes
+ -
If they let everyone pirate everything..
AzuMao 2nd Feb 2010
..most companies would stop making apps for the iPhone.

It would be pretty bad business practice.
You know that's what businesses are about, right? Not moral
practice.

Otherwise we wouldn't have companies doing things like pushing
their graphics API as a standard, and waiting until (almost)
everyone is dependent on it, and then cutting support for it from
old OSs so that you must buy a new OS (what happened with DX10 and
Vista).

It's not the user that matters to companies, but rather the bottom
line.
0 Votes
+ -
Again on the whole piracy thing...
Pete "athynz" Athens 3rd Feb 2010
AzuMao give it a ******* rest... seriously. You bleat on about how all jailbreakers are evil software pirates... and you could not be further from the truth. I'll grant there are some - as I've said before - who's moral fiber leaves much to be desired but how the hell is is wrong to jailbreak if one does nothing more than add customization options (themes), functionality that should have been on the unit from day one (like video recording), and apps that were submitted to the app store and rejected (google voice anyone?)? Other than it violating the EULA?

And no one - NO ONE - has ever been able to answer how jailbreaking is screwing over Apple... how many jailbroken devices were returned to Apple in an attempt to get a new device? NONE! Because one can ALWAYS go back to the stock OS with no issues.
0 Votes
+ -
It's wrong to Jailbreak. an iPhone... because
tracy anne 3rd Feb 2010
Apple say so. After all their license says you don't own either the hardware or the software, you are just using it at their pleasure, and paying for the "privilege".
0 Votes
+ -
You might want to reread my post...
Pete "athynz" Athens 4th Feb 2010
I already covered - in an admittedly roundabout way - the issues with the rentalware when I said a reason other than it violating the EULA...

And besides if I'm going to sink that much cash into it you bet your bippy I'm going to do with it as I want to and if Steve Jobs and Apple have an issue with that then they can refund the cost of the device and I'll go elsewhere for my smartphone needs... There never was this much of an outcry on either pro or anti hacking side when people stated baking custom roms (i.e. hacking) the WM OS. I had my old WM device which came with WM 5 running WM 6.1... and I'm considering putting WM 6.5 on it just to see if I can.
0 Votes
+ -
You mean like Microsoft does?
Rick_K 5th Feb 2010
With all of their products? Put a non-sanctioned hard drive on an xbox
360, watch how fast you lose functionality. Modify a zune, watch out,
cause now your a pirate.Remove windows activation and Windows
Genuine Aggravation, and then you've to pay again for the "privilege" of
paying Microsoft to use a device, they did not even manufacture.
0 Votes
+ -
A well deserved killing
garylayne@... 2nd Feb 2010
People like you need to stay under the rock
This is Apples way of scaring people in order to keep their profits coming in from the App store and nothing else.
0 Votes
+ -
So what's wrong with profits?
arminw 2nd Feb 2010
n/t
0 Votes
+ -
Kind of like what the RIAA has been doing with DRM in music..
AzuMao 2nd Feb 2010
..and Microsoft has been doing with WGA in Windows, and game publishers have
been doing with putting SecuROM and such in their games.
Yet I don't see you saying all of those should be killed. Hmm...
0 Votes
+ -
WTF? Keep up with the class please
buzzl 3rd Feb 2010
DRM in music is dead. You can buy virtually anything in plain old un-DRMed MP3 format from Amazon, or un-DRMed AAC format from the iTunes Store. For the first time in years, I am willing to buy music, because they aren't trying to rape me with DRM or other obnoxious practices.

MS does use its DRM in Windows, and for that reason I don't use Windows. Opponents of DRM have been calling for the death of WGA for a long time and not using or supporting Windows in the meantime.

Apple is trying to dominate the software market for the iPhone. It's not quite DRM, but close enough for me -- so I've switched the the Android. In many ways, the Android is better than the iPhone.

So please. DRM opponents have been vocally opposed to DRM forever, in all its forms. And they are voting with their dollars.
0 Votes
+ -
Funny, I hear that said all over the place
Flying Pig Updated - 4th Feb 2010
But just in case you weren't listening:

DRM and secuROM should be killed. If you must go after pirates, find some way other than punishing the innocent people who want to do nothing more than create a reliable backup of what they legally purchased.

Now, you were saying?...
0 Votes
+ -
Under the Rock
zdnet-gregc 3rd Feb 2010
Excellent double entendre, Sir! (you were riffing on the Rock App, right?)

Seriously folks, jailbreaking your iPhone is not Civil Disobedience or any sort of
moral imperative (It might qualify as Civil Disobedience if you go to Apple
headquartes, announce yourself as a violater of the iPhone EULA and insist
that Apple prosecute you to fullest extent of the law, the exposing the IPhone
EULA and the legal system that supports such things as immoral and unjust happy.

Lighten up, everybody.
0 Votes
+ -
Stupid is as stupid troll posts...
Pete "athynz" Athens 3rd Feb 2010
Point by point because this asinine post put me in the mood to do so:

Anyone who hacks any device and is STUPID
enough to try to install a manufacturer update
on the hacked device is as stupid as you can
get and still be able to breathe...

A bit harsh there, isn't it? Really it's common knowledge that a manufacturer update will break a hack which is why it's wise to wait until there is a hack available for the new update.

Hacking any device breaks the EULA and voids
warranty and support... including updates...

Really? No way!/sarcasm... of course it violates the EULA and voids the warranty and support... That's a no brainer.

It's sad that people are stupid enough to try
to hack a device with some stranger's hack...
They get what they deserve...

Where are you getting THIS? The Dev team has been around for years - from the initial jailbreak of the original iPhone OS to now. And I've been jailbreaking my iPhone ever since I bought my 3G the week after they came out... so over a year and a half through every single iPhone OS update since the introduction of 2.0. And I've never ever had an issue I could not fix, never had a bricked device and I've always been able to go back to the pure, pristine, unjailbroken, as Steve Jobs intended iPhone OS with no issues.

Not sure what got the bug up your rear about jailbreaking but you need to let it go.
0 Votes
+ -
Guessing or you applied it and the iphone went back to jail again?
HypnoToad72 2nd Feb 2010
happy

I ultimately jailbroke mine. I wanted to install, amongst other things, a FIREWALL so I could keep an eye on internet traffic and deny various apps and addresses.

Apple should be a little more proactive here, and less harsh with certain restrictions. But it is true, they like content control. DRM. Which is ironic...
0 Votes
+ -
Smug snicker!
kd5auq 2nd Feb 2010
wink
0 Votes
+ -
Why does Apple execute audio and picture files?
NonZealot 2nd Feb 2010
CoreAudio (CVE-2010-0036) ? A buffer overflow
exists in the handling of mp4 audio files. Playing a
maliciously crafted mp4 audio file may lead to an
unexpected application termination or arbitrary code
execution.
ImageIO (CVE-2009-2285) ? A buffer underflow exists
in ImageIO?s handling of TIFF
images. Viewing a maliciously crafted TIFF image may
lead to an unexpected application termination or
arbitrary code execution.

When MS issues a patch for an audio or picture file
arbitrary code execution hole, the Apple zealots
SCREAM about how badly designed Windows is
because it executes code in audio and picture files. I
suppose thought that when Apple does it, it's a
feature.

Cue the double standards...
0 Votes
+ -
It is a feature: Audio Remote Access
John Zern Updated - 2nd Feb 2010
no need to fumble with complicated links to invite a user to view and diagnose issues with you iPhone/iPod, just click the audio file....
0 Votes
+ -
that is funny
davidhite 2nd Feb 2010
but yeah, this just further illustrates that there
is no bullet proof OS
0 Votes
+ -
I agree.
John Zern 2nd Feb 2010
The day a bulletproof OS is invented will be about 100 years too late for me to enjoy!
0 Votes
+ -
It is called OFF ....
kd5auq 2nd Feb 2010
It is as secure and risk free as death (unless you believe in Zombies, Vampires, Werewolves, etc).
wink
0 Votes
+ -
Hey, I'm in love with a vampire,
Snooki_smoosh_smoosh 2nd Feb 2010
don't knock it till you try it. happy
0 Votes
+ -
Vampires and werewolves come back from the dead?
AzuMao 2nd Feb 2010
Since when? O_O
0 Votes
+ -
bulletproof OS is already invented
pupkin_z 2nd Feb 2010
paper and pencil.
0 Votes
+ -
Until I read over your sholder.
Snooki_smoosh_smoosh 2nd Feb 2010
.
0 Votes
+ -
Paper and Pencil in my own cypher then.
/A\V/ 2nd Feb 2010
.
0 Votes
+ -
@/A\V/
AzuMao 2nd Feb 2010
Until I put your cyphered text into a computer. The human
brain is not capable of strong cryptography, so it will be
broken instantly or in seconds.

Also, the pencil and piece piece of paper don't do anything
but hold data.

They are the equivalent of a laser and CD, or a electromagnet
and magnetic platter, or flash chips, not an OS.

p.s. I know you're both being facetious, but that doesn't
exclude you from rebuttals.
0 Votes
+ -
Right.
AzuMao 2nd Feb 2010
And if two things are both in any way less than
perfect, that must mean they are the same.

[/windows-user-logic]
0 Votes
+ -
Just roll with it and have some fun
John Zern 3rd Feb 2010
is that the [/Apple-user-logic] we've heard of, you know where two identicle issues are actually totally different because they happen to different OS's?

You know where on a PC it's an EPIC=FAIL, yet on an Apple it becomes an AWSOME FEATURE?
0 Votes
+ -
You have a corner of the phrase "cue the double standards" ...
RationalGuy Updated - 2nd Feb 2010
I notice that you use the phrase "cue the double standards" way way way too much. So, I did a Google search of that exact phrase and you pretty much own the whole page of results.

If you select the option to "repeat the search with the omitted results included" there are 36 pages of you beating that phrase to death.

Well done!
0 Votes
+ -
And how many invalid ones?
Sleeper Service 2nd Feb 2010
Oh that's right: None.
0 Votes
+ -
That's cute how you did that just then ... [nt]
RationalGuy 2nd Feb 2010
[nt]
0 Votes
+ -
All of them.
AzuMao 2nd Feb 2010
0 Votes
+ -
Wow...
/A\V/ 2nd Feb 2010
At first, I thought you were being mostly facetious, but then I decided to
give it a go and search for that phrase..

That...is...absolutely...amazing...

NZ, congratulations. You have somehow achieved the notoriety of being
the person to use "Cue the double standards..." the most, which,
considering the politicians in this world, is actually quite impressive.
0 Votes
+ -
Holy damn, you're right.
AzuMao 2nd Feb 2010
LOL
0 Votes
+ -
LOL, good find.
Aragorn_z 3rd Feb 2010
Whether one thinks NonZealot's statements are accurate or not, the fact that he has used that phrase so many times in a one-sided way surely indicates that he is in fact, a Zealot.
0 Votes
+ -
I don't care who you are
Pete "athynz" Athens 3rd Feb 2010
that right there is funny... LOL
0 Votes
+ -
Nice straw man.
AzuMao 2nd Feb 2010
The problem with Windows isn't that it isn't 100% perfect in every way,
so no double standards have occurred. The problem with Windows is that
vulnerabilities are left in for a long time even after they have
become known to the public, giving script kiddies and malicious hackers
ample opportunity to use them. Until the same can be said about OSX
and Linux as often as it can be said about Windows, and people
still say Windows is worse, no double standards have occurred.

Keep holding your breath, because it's not gonna happen.
0 Votes
+ -
Let's put some dates on it
Earthling2 Updated - 2nd Feb 2010
Let's just take a look at one vulnerability:
CVE-2009-2841.

The earliest date I could find is 9/25/2009 in
RedHat bugzilla:

https://bugzilla.redhat.com/show_bug.cgi?
id=525791#c0

A Safari update for Windows and Mac was released
on 11/11/2009, 47 days later:

http://threatpost.com/en_us/blogs/apple-patches-
critical-safari-vulnerabilities-111109

A patch for iPhone is being released on
2/2/2010, 130 day (4 mo 1 wk) later.

It gets even more interesting for CVE-2009-2285:

Ubuntu: July 6, 2009
iPhone: Feb 02, 2010

http://www.ubuntulinux.org/usn/usn-797-1

Also, if you look to what releases of Ubuntu
this bug applies to, the earliest is Ubuntu 6.06
LTS, which is quite a few years old.
0 Votes
+ -
Point! Set! Match!
windozefreak 2nd Feb 2010
nt
0 Votes
+ -
Doooh! - nt
ItsTheBottomLine 3rd Feb 2010
nt
0 Votes
+ -
RE: Code execution holes in iPhone OS, iPod Touch
efsane Updated - 8th Apr 2011
Great!!! thanks for sharing this information to us!
sesli sohbet sesli chat

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix