----------------------------------------------------------------------


Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM).

Request a free trial: 
http://secunia.com/products/corporate/vim/


----------------------------------------------------------------------

TITLE:
Apple iOS Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA42312

VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/42312/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=42312

RELEASE DATE:
2010-11-23

DISCUSS ADVISORY:
http://secunia.com/advisories/42312/#comments

AVAILABLE ON SITE AND IN CUSTOMER AREA:
 * Last Update
 * Popularity
 * Comments
 * Criticality Level
 * Impact
 * Where
 * Solution Status
 * Operating System / Software
 * CVE Reference(s)

http://secunia.com/advisories/42312/

ONLY AVAILABLE IN CUSTOMER AREA:
 * Authentication Level
 * Report Reliability
 * Secunia PoC
 * Secunia Analysis
 * Systems Affected
 * Approve Distribution
 * Remediation Status
 * Secunia CVSS Score
 * CVSS

https://ca.secunia.com/?page=viewadvisory&vuln_id=42312

ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:
 * AUTOMATED SCANNING

http://secunia.com/vulnerability_scanning/personal/
http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

DESCRIPTION:
Multiple vulnerabilities have been reported in Apple iOS, which can
be exploited by malicious people bypass certain security
restrictions, conduct spoofing attacks, disclose sensitive
information, cause a DoS (Denial of Service), or to compromise a
user's system.

1) An error in the signature validation when handling configuration
profiles can result in a specially crafted, malicious configuration
profile appearing to have a valid signature.

2) Multiple vulnerabilities in FreeType can be exploited by malicious
people to potentially compromise an application using the library.

For more information:
SA34723
SA40586
SA40816
SA41738

3) An error in iAd Content Display in the handling of certain URL
schemes can be exploited to initiate a call without user
interaction.

Successful exploitation of this vulnerability requires manipulation
of a response for a requested ad.

4) Two vulnerabilities in libpng can be exploited by malicious people
to potentially compromise an application using the library.

For more information:
SA40302

5) An error in libxml can be exploited to potentially compromise an
application using the library.

For more information:
SA42175
 
6) An weakness in Mail can be exploited to trigger DNS prefetching
even if remote image loading is disabled.

7) A vulnerability in Networking can be exploited to cause system
shutdown.

For more information:
SA42151

8) An invalid pointer reference error in Networking when handling
packet filter rules can be exploited to gain system privileges.

9) An error in the Photos application can be exploited to disclose
the MobileMe account password.

Successful exploitation requires the attacker to manipulate a
response of the MobileMe Gallery requesting basic authentication.

10) A weakness is caused due to the "Reset Safari" feature taking up
to 30 seconds to clear the website passwords from memory.

11) A boundary error in the handling of Temporary Mobile Subscriber
Identity (TMSI) fields in GSM mobility management can be exploited to
cause a heap-based buffer overflow and execute arbitrary code on the
baseband processor.

12) Multiple vulnerabilities in WebKit can be exploited by malicious
people to compromise a user's system.

For more information:
SA40664
SA41085
SA42264

13) A design error within WebKit in the handling of the CSS
":visited" pseudo-class can be exploited to determine which sites a
user has visited.

SOLUTION:
Update to iOS 4.2 (downloadable and installable via iTunes).

PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) Barry Simpson, Bomgar Corporation
3, 9) Aaron Sigel, vtty.com
5) Bui Quang Minh, Bkis
6) Mike Cardwell, Cardwell IT Ltd.
10) Philippe Couturier, izypage.com and Andrew Wellington, The
Australian National University
11) Ralf-Philipp Weinmann, University of Luxembourg

ORIGINAL ADVISORY:
Apple:
http://support.apple.com/kb/HT4456

OTHER REFERENCES:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

DEEP LINKS:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

EXTENDED DESCRIPTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

EXTENDED SOLUTION:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

EXPLOIT:
Further details available in Customer Area:
http://secunia.com/products/corporate/EVM/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------