Symbolic Link Vulnerability - Revision history

Http: new link here too

2013-12-30T22:32:43Z

new link here too

IAdam1n: Please do not use the [1].

2013-12-16T16:37:12Z

Please do not use the [1].

Http: mention that it's patched

2013-12-16T01:42:27Z

mention that it's patched

Http: fix link

2013-04-15T08:53:05Z

fix link

Http: mention relation to Malformed PairRequest

2013-04-06T22:54:07Z

mention relation to Malformed PairRequest

Http: /* Usage in evasi0n jailbreak */ link to important file

2013-02-18T22:34:52Z

‎Usage in evasi0n jailbreak: link to important file

Http: /* Usage in evasi0n jailbreak */ typo

2013-02-18T22:28:31Z

‎Usage in evasi0n jailbreak: typo

Http: initial page

2013-02-17T22:52:15Z

initial page

New page

By restoring files, directories and symlinks to the iOS device, the path is carefully checked, so that no write accesses outside of certain domains are possible. By creating a symlink that points to somewhere else, it is possible to overcome this limitation.

== Usage in [[evasi0n]] jailbreak ==
In the case of [[evasi0n]], the following files, directories and symlinks are restored, all in the [[Media Domain]]:
* directory: <code>Media/</code>
* directory: <code>Media/Recordings/</code>
* symlink: <code>Media/Recordings/.haxx</code> pointing to <code>/var/mobile</code>
* directory: <code>Media/Recordings/.haxx/DemoApp.app/</code>
* several files in <code>Media/Recordings/.haxx/DemoApp.app/</code>: <code>Info.plist</code>, <code>DemoApp</code>, <code>Icon.png</code>, <code>Icon@2x.png</code>, <code>Icon-72.png</code>, <code>Icon-72@2x.png</code>
* file: <code>Media/Recordings/.haxx/Library/Caches/com.apple.mobile.installation.plist</code>

This results in the following directory and file structure:
/var/mobile/Media/Recordings/ (folder)
/var/mobile/Media/Recordings/.haxx (symlink)

/var/mobile/DemoApp.app/Info.plist
/var/mobile/DemoApp.app/DemoApp
/var/mobile/DemoApp.app/Icon.png
/var/mobile/DemoApp.app/Icon@2x.png
/var/mobile/DemoApp.app/Icon-72.png
/var/mobile/DemoApp.app/Icon-72@2x.png

/var/mobile/Library/Caches/com.apple.mobile.installation.plist

== References ==
* [http://blog.accuvantlabs.com/blog/bthomas/evasi0n-jailbreaks-userland-component Accuvant Labs analysis of evasi0n]

[[Category:Exploits]]

@@ Line 1: / Line 1: @@
 By restoring files, directories and symlinks to the iOS device, the path is carefully checked, so that no write accesses outside of certain domains are possible. By creating a symlink that points to somewhere else, it is possible to overcome this limitation.
-This vulnerability has been fixed in iOS 7.1b2[https://twitter.com/iH8sn0w/status/412338808903192576].
+This vulnerability has been [https://twitter.com/iH8sn0w/status/412338808903192576 fixed] in iOS 7.1b2.
 == Usage in [[evasi0n]] jailbreak ==

← Older revision		Revision as of 01:42, 16 December 2013
Line 1:		Line 1:
	By restoring files, directories and symlinks to the iOS device, the path is carefully checked, so that no write accesses outside of certain domains are possible. By creating a symlink that points to somewhere else, it is possible to overcome this limitation.		By restoring files, directories and symlinks to the iOS device, the path is carefully checked, so that no write accesses outside of certain domains are possible. By creating a symlink that points to somewhere else, it is possible to overcome this limitation.
		+
		+	This vulnerability has been fixed in iOS 7.1b2[https://twitter.com/iH8sn0w/status/412338808903192576].

	== Usage in [[evasi0n]] jailbreak ==		== Usage in [[evasi0n]] jailbreak ==

@@ Line 24: / Line 24: @@
 == See Also ==
-* [[Malformed PairRequest]] regarding CVE-2013-0979
+* [[Timezone Vulnerability]] regarding CVE-2013-0979
 == References ==

← Older revision		Revision as of 22:54, 6 April 2013
Line 22:		Line 22:

	/var/mobile/Library/Caches/[[com.apple.mobile.installation.plist]]		/var/mobile/Library/Caches/[[com.apple.mobile.installation.plist]]
		+
		+	== See Also ==
		+	* [[Malformed PairRequest]] regarding CVE-2013-0979

	== References ==		== References ==

@@ Line 29: / Line 29: @@
 == References ==
-* [http://blog.accuvantlabs.com/blog/bthomas/evasi0n-jailbreaks-userland-component Accuvant Labs analysis of evasi0n]
+* [http://blog.accuvant.com/bthomasaccuvant/evasi0n-jailbreaks-userland-component/ Accuvant Labs analysis of evasi0n]
 [[Category:Exploits]]

@@ Line 8: / Line 8: @@
 * directory: <code>Media/Recordings/.haxx/DemoApp.app/</code>
 * several files in <code>Media/Recordings/.haxx/DemoApp.app/</code>, <code>Info.plist</code>, <code>DemoApp</code>, <code>Icon.png</code>, <code>Icon@2x.png</code>, <code>Icon-72.png</code>, <code>Icon-72@2x.png</code>
-* file: <code>Media/Recordings/.haxx/Library/Caches/com.apple.mobile.installation.plist</code>
+* file: <code>Media/Recordings/.haxx/Library/Caches/[[com.apple.mobile.installation.plist]]</code>
 This results in the following directory and file structure:
@@ Line 21: / Line 21: @@
  /var/mobile/DemoApp.app/Icon-72@2x.png
- /var/mobile/Library/Caches/com.apple.mobile.installation.plist
+ /var/mobile/Library/Caches/[[com.apple.mobile.installation.plist]]
 == References ==