Timezone Vulnerability - Revision history

Nullpixel: change to past tense

2017-10-10T17:34:01Z

change to past tense

2013-12-30T22:33:33Z

new link for blog

2013-08-26T19:00:33Z

clarification

2013-04-15T09:27:43Z

mention the crashing with separate page

2013-04-15T09:22:57Z

Total rewrite based on new information from HITB talk

2013-04-15T08:35:34Z

Http moved page Malformed PairRequest to Timezone Vulnerability without leaving a redirect: there seems to be no malformed PairRequest

2013-04-07T20:47:47Z

‎Credits

2013-04-06T23:11:45Z

fix link

2013-04-06T22:52:00Z

reference CVE-2013-0979

2013-02-17T22:20:52Z

reference to evasi0n

@@ Line 1: / Line 1: @@
-There is a flaw in [[lockdownd]]:
+There was a flaw in [[lockdownd]], fixed in iOS 6.1.3:
  MOVW   R0, #(aPrivateVarDbTi-0x4DB8A) ; "/private/var/db/timezone"
  MOVW   R1, #0x1FF                     ; mode_t -> 0777

@@ Line 32: / Line 32: @@
 == References ==
 * [http://conference.hitb.org/hitbsecconf2013ams/materials/D2T1%20-%20Pod2g,%20Planetbeing,%20Musclenerd%20and%20Pimskeks%20aka%20Evad3rs%20-%20Swiping%20Through%20Modern%20Security%20Features.pdf Slides from HITB presentation in Amsterdam 2013]
-* [http://blog.accuvantlabs.com/blog/bthomas/evasi0n-jailbreaks-userland-component Accuvant Labs analysis of evasi0n]
+* [http://blog.accuvant.com/bthomasaccuvant/evasi0n-jailbreaks-userland-component/ Accuvant Labs analysis of evasi0n]
 * [http://support.apple.com/kb/HT5704 Apple's iOS 6.1.3 security fixes]
 * [http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0979 NIST Reference CVE-2013-0979]

@@ Line 15: / Line 15: @@
 Description: When restoring from backup, [[lockdownd]] changed permissions on certain files even if the path to the file included a symbolic link. This issue was addressed by not changing permissions on any file with a symlink in its path.
 </cite>
 __NOTOC__
 == Usage ==

@@ Line 6: / Line 6: @@
  BLX    _chmod
-This means <code>chmod("/private/var/db/timezone",0777)</code> without any further checks and is executed on every launch. By setting a symbolic link on <code>/var/db/timezone</code> though [[MobileBackup]] and pointing the symlink to any other file and crashing [[lockdownd]] by sending it a malformed property list to make it relaunch (another probably non-exploitable vulnerability) causes it to perform the actual permission change on any file.
+This means <code>chmod("/private/var/db/timezone",0777)</code> without any further checks and is executed on every launch. By setting a symbolic link on <code>/var/db/timezone</code> though [[MobileBackup]] and pointing the symlink to any other file and crashing [[lockdownd]] by sending it a malformed property list (see [[Malformed PairRequest]]) to make it relaunch causes it to perform the actual permission change on any file.
 This vulnerability is '''CVE-2013-0979''' and Apple describes it in the iOS 6.1.3 security fixes like this:
@@ Line 24: / Line 24: @@
 == See Also ==
 * [[Symbolic Link Vulnerability]]
 == References ==

@@ Line 1: / Line 1: @@
-Apple's description in the iOS 6.1.3 security fixes:
+This vulnerability is '''CVE-2013-0979''' and Apple describes it in the iOS 6.1.3 security fixes like this:
 <cite>
@@ Line 10: / Line 15: @@
 Description: When restoring from backup, [[lockdownd]] changed permissions on certain files even if the path to the file included a symbolic link. This issue was addressed by not changing permissions on any file with a symlink in its path.
 </cite>
 == Usage ==
 * [[evasi0n|evasi0n jailbreak]]
@@ Line 21: / Line 26: @@
 == References ==
 * [http://blog.accuvantlabs.com/blog/bthomas/evasi0n-jailbreaks-userland-component Accuvant Labs analysis of evasi0n]
 * [http://support.apple.com/kb/HT5704 Apple's iOS 6.1.3 security fixes]

← Older revision	Revision as of 08:35, 15 April 2013
(No difference)

@@ Line 15: / Line 15: @@
 == Credits ==
-* probably [[pimskeks]]
+* [[evad3rs]]
 == See Also ==

@@ Line 1: / Line 1: @@
 According the the Accuvant Labs analysis, sending [[lockdownd]] a malformed [[PairRequest]] command causes [[lockdownd]] to change the permissions like <code>chmod 777 file</code> making it accessible to mobile (and all users). It isn't clear whether this vulnerability is in [[lockdownd]] or in an underlying library or framework, so more analysis of this vulnerability is necessary.
-This vulnerability (or together with [Symbolic Link Vulnerability]?) is CVE-2013-0979.
+This vulnerability (or together with [[Symbolic Link Vulnerability]]?) is CVE-2013-0979.
 Apple's description in the iOS 6.1.3 security fixes: