PT-2017-2792 · Apple · Ios

Ben Seri + 1 · Published 2017-09-12 · Updated 2019-05-14 · CVE-2017-14315

Positive Technologies (AI Summary)

CVSS v2.0

7.9

High

Base vector

AV:A/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apple iOS versions 7 through 9

Description The issue is related to a flaw in the implementation of the Low Energy Audio Protocol (LEAP) in Apple iOS, which can lead to a heap overflow with attacker-controlled data when a large audio command is sent to a targeted device. This overflow can be exploited by an attacker to gain full control of the device, leveraging the relatively high privileges of the Bluetooth stack in iOS. The attack bypasses Bluetooth access control but requires the default "Bluetooth On" value to be present in Settings.

Recommendations For Apple iOS versions 7 through 9, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-122

Related Identifiers

BDU:2017-02055

CVE-2017-14315

Affected Products

Ios

References · 8

• https://bdu.fstec.ru/vul/2017-02055 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14315 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14315 · Security Note
• https://seclists.org/bugtraq/2019/May/30 · Note
• http://seclists.org/fulldisclosure/2019/May/24 · Note
• http://securityfocus.com/bid/100816 · Note
• https://support.apple.com/kb/HT210121 · Note
• https://armis.com/blueborne · Note