Apple iOS 10/10.1 于 iPad2 Lockscreen 弱身份验证

CVSS 元临时分数	当前攻击价格 (≈)	CTI兴趣分数
4.5	$0-$5k	0.00

摘要信息

在Apple iOS 10/10.1中曾发现一漏洞，此漏洞被评为棘手。相关的是未知函数，在Lockscreen组件中。手动调试的不合法输入可导致弱身份验证。需要本地访问才能进行攻击。此外还有一个漏洞可利用。建议实施建议的临时解决方案。

在Apple iOS 10/10.1中曾发现一漏洞，此漏洞被评为棘手。相关的是未知函数，在Lockscreen组件中。手动调试的不合法输入可导致弱身份验证。采用 CWE 描述该问题会链接到 CWE-287。该漏洞已于 2016-11-17 由Benjamin Kunz Mejri 以VL-ID 2012 / 648680301 作为公告（网站）发布。公告共享下载网址是vulnerability-lab.com。该公开发布是在未与供应商协调的情况下进行的。

需要本地访问才能进行攻击。无技术细节可用。攻击复杂性相当高。该漏洞被认为难以被利用。该漏洞的知名度低于平均水平，此外还有一个漏洞可利用。该漏洞利用已公开，可能会被利用。漏洞利用的当前现价为美元计算大致为USD $0-$5k。公告指出：

The vulnerability is located after installtion of the ios 10.x version to the incompatible apple ipad2 device. The website of the apple site showed us that imcompatible devices can cause on usage in unexpected behavoir, so we decided to install the version to one of our test environment devices. After the installation we have noticed that the dictionary function became available ahead to the desk. In our testings we used the function to trigger a glitch on accessing the more information button in the locked device mode. After processing the interaction manually in a loop, we was able to get ahead the passcode screen area a push magnifying glass preview.

它被宣布为概念验证。该漏洞利用程序可在vulnerability-lab.com下载。 0日漏洞的地下市场估价大致为$25k-$100k。公告中提及：

Watching the bug displayed information of a restricted area that is located in `Device - Siri - About Sir & Data Security to Privacy`. Now i moved to the link by searching blind the location and pushed twice to receive the input menu bar like when marking a text. People that are aware of ios know that these function allows several options depending on the input and connected function. Now an attacker can use the share function that became visible ahead during the passcode lock screen via glitch and pushs the share button. Now the email opens. Then the attacker marks the email of the contact and pushs twice the contact plus a keyboard letter of an exisiting contact. Now the contact comes ahead, click the info button and move to the profil location. Add the information to a new contact, then press the image button and now the attacker is able to access the photo album of the device without any restrictions.

建议实施建议的临时解决方案。