Vulners
Lucene search
FaceTime - RTP Video Processing Heap Corruption Exploit
| Reporter | Title | Published | Views | Family All 15 |
|---|---|---|---|---|
 | Apple iOS < 12.1 Multiple Vulnerabilities | 17 Apr 201900:00 | – | nessus |
| Apple iOS < 12.1 Multiple Vulnerabilities | 31 Oct 201800:00 | – | nessus |
 | About the security content of iOS 12.1 | 30 Oct 201800:00 | – | apple |
| About the security content of watchOS 5.1 | 30 Oct 201800:00 | – | apple |
| About the security content of iOS 12.1 - Apple Support | 17 Sep 201910:50 | – | apple |
| About the security content of watchOS 5.1 - Apple Support | 27 Jul 202008:13 | – | apple |
 | CVE-2018-4384 | 6 Nov 201800:00 | – | circl |
 | CVE-2018-4384 | 3 Apr 201917:43 | – | cve |
 | CVE-2018-4384 | 3 Apr 201917:43 | – | cvelist |
 | EUVD-2018-16170 | 7 Oct 202500:30 | – | euvd |
10
FaceTime - RTP Video Processing Heap Corruption Exploit
There is a memory corruption issue when processing a malformed RTP video stream in FaceTime that leads to a kernel panic due to a corrupted heap cookie or data abort. This bug can be reached if a user accepts a call from a malicious caller. This issue only affects FaceTime on iOS, it does not crash on a Mac.
The issue can be reproduced using the attached sequence of RTP packets. To reproduce the issue:
1) Build video-replay.c in attached zip (gcc -g -dynamiclib -o mylib video-replay.c) and copy to /usr/lib/mylib
2) Use insert_dylib (https://github.com/Tyilo/insert_dylib) to add /usr/lib/mylib to AVConference (insert_dylib --strip-codesig /usr/lib/mylib AVConference)
3) Edit /System/Library/Sandbox/Profiles/com.apple.avconferenced.sb to add /out as allow file read and write
4) Restart the machine
5) Extract the attached out folder in the zip to /out and change the permissions so it's readable by AVConference
6) Call target, when they pick up, the phone will crash
Proof of Concept:
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/45786.zip
# 0day.today [2018-11-06] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
06 Nov 2018 00:00Current
EPSS0.022