Difference between revisions of "AT+XAPP Vulnerability"

From The iPhone Wiki
Jump to: navigation, search
(Implementation)
Line 14: Line 14:
 
== Implementation ==
 
== Implementation ==
 
The exploit was used by [[iPhone Dev Team]] in [[ultrasn0w]] 1.0-1 and 1.2, which is able to unlock the [[X-Gold 608]] basebands [[4.26.08]], [[5.11.07]], [[5.12.01]], [[5.13.04]] and [[6.15.00]](ultrasn0w 1.2 only), and [[XMM 6180]] baseband [[1.59.00]].
 
The exploit was used by [[iPhone Dev Team]] in [[ultrasn0w]] 1.0-1 and 1.2, which is able to unlock the [[X-Gold 608]] basebands [[4.26.08]], [[5.11.07]], [[5.12.01]], [[5.13.04]] and [[6.15.00]](ultrasn0w 1.2 only), and [[XMM 6180]] baseband [[1.59.00]].
  +
----
 
  +
{{stub|iPhone}}
  +
 
[[Category:Baseband Exploits]]
 
[[Category:Baseband Exploits]]

Revision as of 15:59, 19 February 2011

Used as an injection vector for the X-Gold 608 and XMM 6180 unlock payload. ‬Currently available in all X-Gold 608 basebands until 5.13.04 and 6.15.00, and XMM 6180 baseband 1.59.00.‬ ‭

Credit

Exploit

There is a stack overflow in the AT+XAPP‭="..." ‬command‭, ‬which allows unsigned code execution on the X-Gold 608 and XMM 6180.

at+xapp="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa4444555566667777PPPP"

Applying a string of more than 52‭ ‬characters will trigger the overflow.

Implementation

The exploit was used by iPhone Dev Team in ultrasn0w 1.0-1 and 1.2, which is able to unlock the X-Gold 608 basebands 4.26.08, 5.11.07, 5.12.01, 5.13.04 and 6.15.00(ultrasn0w 1.2 only), and XMM 6180 baseband 1.59.00.

IPhone.png This iPhone article is a "stub", an incomplete page. Please add more content to this article and remove this tag.