PT-2013-4756 · Apple · Libc+2

Stefan Esser · Published 2013-06-05 · Updated 2016-12-08 · CVE-2013-3951

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libc in Apple iOS versions 6.1.3 libc in Apple Mac OS X versions 10.8.x

Description The issue allows local users to bypass cookie randomization by executing a program with a call-path beginning with the stack-guard= substring. This can be demonstrated by an iOS untethering attack or an attack against a setuid Mac OS X program.

Recommendations For Apple iOS version 6.1.3, update to a newer version that contains a fix for this issue. For Apple Mac OS X version 10.8.x, update to a newer version that contains a fix for this issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-3951

Affected Products

Macos X

Ios

Libc

References · 10

• 🔥 http://antid0te.com/syscan_2013/SyScan2013_Mountain_Lion_iOS_Vulnerabilities_Garage_Sale_Whitepaper.pdf · Exploit
• https://support.apple.com/HT205267 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-3951 · Security Note
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html · Vendor Advisory
• https://support.apple.com/HT205212 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html · Vendor Advisory
• https://support.apple.com/HT205213 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html · Vendor Advisory
• http://syscan.org/index.php/sg/program/day/2 · Note
• http://securitytracker.com/id/1033703 · Note