PT-2013-4753 · Apple · Ios

Stefan Esser · Publicado 2013-06-05 · Atualizado 2014-03-16 · CVE-2013-3948

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apple iOS version 6.1.3

Description The issue allows remote attackers to trigger the installation of arbitrary applications via a download-manifest itms-services:// URL. This is possible because the software does not follow redirects during the determination of the hostname to display in an installation dialog, leveraging an open redirect vulnerability within a trusted domain.

Recommendations For Apple iOS version 6.1.3, consider restricting access to itms-services:// URLs until a fix is available. As a temporary workaround, avoid using the itms-services:// protocol in trusted domains to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-3948

Produtos afetados

Ios

Referências · 4

• 🔥 http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdf · Exploit
• http://syscan.org/index.php/sg/program/day/2 · Nota
• http://support.apple.com/kb/HT6162 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3948 · Nota de Segurança