Vulnerabilities > CVE-2011-3442 - Resource Management Errors vulnerability in Apple Iphone OS

047910
CVSS 7.2 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
local
low complexity
apple
CWE-399
NVD
Published: 2011-11-11
Updated: 2012-02-15

Summary

The kernel in Apple iOS before 5.0.1 does not ensure the validity of flag combinations for an mmap system call, which allows local users to execute arbitrary unsigned code via a crafted app. Per: http://support.apple.com/kb/HT5052 'This issue does not affect devices running iOS prior to version 4.3.'

Vulnerable Configurations

Part Description Count
OS
Apple
12

Common Weakness Enumeration (CWE)

Seebug

bulletinFamilyexploit
descriptionCVE ID：CVE-2011-3442 Apple iOS是一款运行在苹果iPhone和iPod touch设备上的最新的操作系统。 mmap系统调用对合法标记组合检查存在逻辑错误，此问题可导致绕过代码签名检查。 Apple iOS 5.x for iPhone 3GS and later Apple iOS for iPod touch 5.x 厂商解决方案 用户可参考如下供应商提供的安全公告获得补丁信息： http://support.apple.com/kb/HT5052
idSSV:23208
last seen2017-11-19
modified2011-11-17
published2011-11-17
reporterRoot
titleApple iOS代码签名检查漏洞

References