Vulnerabilities > CVE-2009-2204 - Remote Code Execution vulnerability in Apple iPhone SMS Application

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
apple
critical
NVD
Published: 2009-08-03
Updated: 2010-03-30

Summary

Unspecified vulnerability in the CoreTelephony component in Apple iPhone OS before 3.0.1 allows remote attackers to execute arbitrary code, obtain GPS coordinates, or enable the microphone via an SMS message that triggers memory corruption, as demonstrated by Charlie Miller at SyScan '09 Singapore.

Vulnerable Configurations

Part Description Count
OS
Apple
49

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 35569 CVE(CAN) ID: CVE-2009-2204,CVE-2009-2315 Apple iPhone是苹果最新发布的智能手机。 iPhone手机在解码短信消息时存在内存破坏漏洞，远程攻击者可以通过发送恶意短信导致执行任何代码、获取GPS坐标或启用话筒。 Apple iPhone 3.0 厂商补丁： Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.apple.com
idSSV:11983
last seen2017-11-19
modified2009-08-05
published2009-08-05
reporterRoot
titleApple iPhone短信消息远程内存破坏漏洞

References