Vulnerability CVE-2009-2206
Published: 2009-09-10   Modified: 2012-02-13

Description:
Multiple heap-based buffer overflows in the AudioCodecs library in the CoreAudio component in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted (1) AAC or (2) MP3 file, as demonstrated by a ringtone with malformed entries in the sample size table.

Type:

CWE-119

 (Improper Restriction of Operations within the Bounds of a Memory Buffer)

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.8/10
6.4/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Apple -> Iphone os 
Apple -> Iphone 
Apple -> Ipod touch 

 References:
http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html
http://support.apple.com/kb/HT3860
http://www.securityfocus.com/archive/1/506464/100/0/threaded
http://www.securityfocus.com/bid/36338
http://www.securitytracker.com/id?1022869
http://www.trapkit.de/advisories/TKADV2009-007.txt
https://exchange.xforce.ibmcloud.com/vulnerabilities/53180
Copyright 2024, cxsecurity.com

 

Back to Top