|
The iPhone Wiki is no longer updated. Visit this article on The Apple Wiki for current information. |
Difference between revisions of "T1 Font Integer Overflow"
m |
(The exploit name is tentative and lame. Feel free to suggest a better name.) |
||
| Line 1: | Line 1: | ||
| + | The '''T1 Font Integer Overflow''' is a vulnerability used in [[Saffron]]. It is very similar to the [[Malformed CFF Vulnerability]], hence why comex named its exploitation "DejaVu."[https://twitter.com/comex/status/88208990789578752] |
||
| − | DejaVu [http://twitter.com/#!/comex/status/88208990789578752] is a vulnerability used [[Saffron]]. |
||
| + | |||
| + | == Credit for Exploitation == |
||
| + | [[User:comex|comex]] |
||
== Description == |
== Description == |
||
| − | + | When dealing with op_callothersubr, arg_cnt is defined as an integer. arg_cnt is read from decoder->stack, which could be set to 0xfea50000 by charstring "fb ef". And this will bypass stack checking. Then "top -= arg_cnt" will make top points to data outside of decoder->stack. Actually it points to decoder->parse_callback. |
|
| + | This vulnerability was actually addressed by Apple in Mac OS X v10.6.8/Security Update 2011-004, but a fix was never pushed to iOS. Its CVE identifier is '''CVE-2011-0202'''. |
||
| − | Sources: |
||
| − | [http://twitter.com/#!/windknown/status/88170553948651520 1] |
||
| − | [http://twitter.com/#!/windknown/status/88171950886760448 2] |
||
| − | [http://twitter.com/#!/windknown/status/88172830029651968 3] |
||
| − | == |
+ | ==Sources== |
| + | * Tweets from [https://twitter.com/windknown @windknown]: [https://twitter.com/windknown/status/88170553948651520][https://twitter.com/windknown/status/88171950886760448][https://twitter.com/windknown/status/88172830029651968] |
||
| − | [[User:comex|comex]] |
||
| + | * http://support.apple.com/kb/HT4723 |
||
| + | * http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0202 |
||
[[Category:Exploits]] |
[[Category:Exploits]] |
||
Revision as of 02:46, 7 July 2011
The T1 Font Integer Overflow is a vulnerability used in Saffron. It is very similar to the Malformed CFF Vulnerability, hence why comex named its exploitation "DejaVu."[1]
Credit for Exploitation
Description
When dealing with op_callothersubr, arg_cnt is defined as an integer. arg_cnt is read from decoder->stack, which could be set to 0xfea50000 by charstring "fb ef". And this will bypass stack checking. Then "top -= arg_cnt" will make top points to data outside of decoder->stack. Actually it points to decoder->parse_callback.
This vulnerability was actually addressed by Apple in Mac OS X v10.6.8/Security Update 2011-004, but a fix was never pushed to iOS. Its CVE identifier is CVE-2011-0202.
