Summaryinfo

A vulnerability, which was classified as problematic, has been found in Apple iOS 7.1.2. This impacts an unknown function of the component Passcode Module. The manipulation leads to improper authentication. Furthermore, there is an exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Apple iOS 7.1.2 (Smartphone Operating System). This issue affects an unknown functionality of the component Passcode Module. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is integrity.

The weakness was shared 09/02/2014 by Benjamin Kunz Mejri with Vulnerability Lab as Apple iOS v7.1.2 - Merge Apps Service Local Bypass Vulnerability as confirmed posting (Bugtraq). It is possible to read the advisory at archives.neohapsis.com. The exploitation is known to be easy. Attacking locally is a requirement. No form of authentication is needed for a successful exploitation. Technical details are unknown but a public exploit is available. The advisory points out:

Local attackers without restricted physcial account can merge apps with functions ahead to the pass code module to compromise the device. Local attackers with user account can prepare (manipulate) a mobile device to access later the restricted context. During the tests we revealed that the exploitation is only possible (merge apps ahead to pass code) when the siri edit command context has been involved to save temporarily context. If the exploitaiton through the glitch was successful the attacker is able to prepare calls via app, write emails or access other last used apps to compromise the iOS device.

A public exploit has been developed by Benjamin Kunz Mejri and been published immediately after the advisory. The exploit is available at archives.neohapsis.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 48 days. During that time the estimated underground price was around $25k-$100k.

The vulnerability is also documented in the vulnerability database at X-Force (95645). vulnerability-lab.com is providing further details. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Smartphone Operating System

Vendor

• Apple

Name

• iOS

Version

• 7.1.2

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion