CVE-2013-0979 in iOS
Summary
by MITRE
lockdownd in Lockdown in Apple iOS before 6.1.3 does not properly consider file types during the permission-setting step of a backup restoration, which allows local users to change the permissions of arbitrary files via a backup that contains a pathname with a symlink.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/06/2021
The vulnerability identified as CVE-2013-0979 resides within the lockdownd service component of Apple iOS operating systems, specifically affecting versions prior to 6.1.3. This issue represents a critical permission escalation flaw that stems from insufficient validation of file types during the backup restoration process. The lockdownd service operates as a core daemon responsible for managing device security configurations and backup operations, making it a prime target for privilege escalation attacks. The vulnerability manifests when the system fails to properly validate symbolic link references within backup archives, creating an opportunity for malicious actors to manipulate file permissions across the device filesystem.
The technical implementation of this vulnerability exploits the trust model inherent in iOS backup restoration procedures. During normal backup operations, the system should validate that all file paths within a backup archive correspond to legitimate file types and maintain proper permission boundaries. However, the flaw allows attackers to include malicious symbolic links within backup files that, when restored, cause the system to traverse these links and modify permissions of arbitrary target files. This occurs because the restoration process does not adequately verify whether pathnames represent actual files or symbolic links before applying permission changes. The vulnerability specifically affects the permission-setting phase of backup restoration, where the system assumes all paths are legitimate file references without proper validation of symbolic link integrity.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it provides attackers with the ability to modify critical system files and directories that should remain protected from unauthorized modification. Local users who can execute backup operations or have access to a backup file containing malicious symbolic links can leverage this flaw to gain elevated privileges and potentially compromise the entire device security model. The attack vector is particularly concerning because it operates within the legitimate backup restoration workflow, making it difficult to detect through standard security monitoring. This vulnerability effectively undermines the principle of least privilege by allowing unauthorized permission changes that could enable further exploitation, including the modification of system binaries, configuration files, or sensitive user data.
The weakness aligns with CWE-22, which describes improper limitation of a pathname to a restricted directory, and CWE-73, which addresses external control of reference. These classifications highlight the fundamental flaw in path validation and symbolic link handling within the backup restoration process. From an ATT&CK perspective, this vulnerability maps to T1059 for execution through system services and T1068 for local privilege escalation. The vulnerability also relates to T1548.001 which covers abuse of system privileges, and T1078 which addresses valid accounts. Mitigation strategies should include immediate patching to iOS version 6.1.3 or later, where Apple implemented proper symbolic link validation during backup restoration. Additionally, system administrators should implement strict backup validation procedures and consider network segmentation to limit local access to backup operations. The fix typically involves enhanced path validation that checks for symbolic link references before applying permission changes, ensuring that all file paths are properly resolved to their actual targets before any permission modifications are executed. Organizations should also review their backup policies to ensure that only trusted backup sources are used for device restoration, as this vulnerability specifically targets the trust relationship between the device and backup archives.