PT-2017-2792 · Apple · Ios

Ben Seri + 1 · Publicado 2017-09-12 · Atualizado 2019-05-14 · CVE-2017-14315

Positive Technologies (AI Summary)

CVSS v2.0

7.9

Alta

Vetor base

AV:A/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apple iOS versions 7 through 9

Description The issue is related to a flaw in the implementation of the Low Energy Audio Protocol (LEAP) in Apple iOS, which can lead to a heap overflow with attacker-controlled data when a large audio command is sent to a targeted device. This overflow can be exploited by an attacker to gain full control of the device, leveraging the relatively high privileges of the Bluetooth stack in iOS. The attack bypasses Bluetooth access control but requires the default "Bluetooth On" value to be present in Settings.

Recommendations For Apple iOS versions 7 through 9, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-119

CWE-122

Identificadores relacionados

BDU:2017-02055

CVE-2017-14315

Produtos afetados

Ios

Referências · 8

• https://seclists.org/bugtraq/2019/May/30 · Nota
• https://bdu.fstec.ru/vul/2017-02055 · Nota de Segurança
• http://seclists.org/fulldisclosure/2019/May/24 · Nota
• https://osv.dev/vulnerability/CVE-2017-14315 · Aviso do Fabricante
• http://securityfocus.com/bid/100816 · Nota
• https://support.apple.com/kb/HT210121 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-14315 · Nota de Segurança
• https://armis.com/blueborne · Nota