|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "AT+XAPP Vulnerability"
m |
|||
| Line 1: | Line 1: | ||
| − | Used as an injection vector for the |
+ | Used as an injection vector for the [[X-Gold 608]] unlock payload. Currently available in all baseband versions until 05.13.04. |
|
|
||
| + | |||
== Credit == |
== Credit == |
||
| + | * '''vulnerability''': [https://twitter.com/sherif_hashim sherif_hashim], also discovered by [https://twitter.com/westbaer westbaer], [[User:Geohot|geohot]] and [https://twitter.com/oranav Oranav] (each one independently) |
||
| − | |||
| − | * '''vulnerability''': [http://twitter.com/sherif_hashim sherif_hashim], also discovered by [http://twitter.com/westbaer westbaer], [[geohot]] and [http://twitter.com/oranav Oranav] (each one independently) |
||
* '''exploitation''': [[iPhone Dev Team]] |
* '''exploitation''': [[iPhone Dev Team]] |
||
== Exploit == |
== Exploit == |
||
| + | There is a stack overflow in the AT+XAPP="..." command, which allows unsigned code execution on the [[X-Gold 608]] and [[XMM 6180]]. |
||
| − | |||
| − | |||
| − | There is a stack overflow in the AT+XAPP="..." command, which allows unsigned code execution on the [[X-Gold 608]] |
||
at+xapp="0000111122223333444455556666777788889999000011112222" |
at+xapp="0000111122223333444455556666777788889999000011112222" |
||
| − | + | Applying a string of more than 52 characters will trigger the overflow. |
|
| − | It also exists on the [[XMM 6180]] |
||
| − | |
||
== Implementation == |
== Implementation == |
||
| + | The exploit was used by [[iPhone Dev Team]] in [[ultrasn0w]] 0.93 which is able to unlock the [[X-Gold 608]] basebands [[4.26.08]], [[5.11.07]], [[5.12.01]] and [[5.13.04]]. |
||
| − | |||
| − | |||
| − | The exploit was used by [[iPhone Dev Team]] in [[Ultrasn0w]] 0.93 which is able to unlock 4.26.08, 5.11.07, 5.12.01 and 5.13.04 BB firmwares |
||
| − | |||
---- |
---- |
||
| − | |||
[[Category:Baseband Exploits]] |
[[Category:Baseband Exploits]] |
||
Revision as of 17:50, 10 July 2010
Used as an injection vector for the X-Gold 608 unlock payload. Currently available in all baseband versions until 05.13.04.
Credit
- vulnerability: sherif_hashim, also discovered by westbaer, geohot and Oranav (each one independently)
- exploitation: iPhone Dev Team
Exploit
There is a stack overflow in the AT+XAPP="..." command, which allows unsigned code execution on the X-Gold 608 and XMM 6180.
at+xapp="0000111122223333444455556666777788889999000011112222"
Applying a string of more than 52 characters will trigger the overflow.
Implementation
The exploit was used by iPhone Dev Team in ultrasn0w 0.93 which is able to unlock the X-Gold 608 basebands 4.26.08, 5.11.07, 5.12.01 and 5.13.04.
