0day.today － 世界最大的漏洞利用数据库。
- 我们唯一的域名：http://0day.today
- 我们大多数的材料都完全免费
- 如果你想购买漏洞利用 / 获取V.I.P.权限 或者使用其他付费服务，
你需要购买或者赢取金币
金币
本站管理员使用官方账号。请谨防诈骗！
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
联系我们
你可以由此方式联系我们:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Apple iMessage - DigitalTouch tap Message Processing Out-of-Bounds Read Exploit
[The digital touch iMessage extension can read out of bounds if a malformed Tap message contains a color array that is shorter than the points array and delta array. The method [ETTapMessage initWithArchiveData:] checks that the points array is twice as long as the deltas array, but only checks that the colors array is longer than eight bytes, even though a color is needed for every point-delta pair that is processed. To reproduce the issue with the files in tapcrash.zip: 1) install frida (pip3 install frida) 2) open sendMessage.py, and replace the sample receiver with the phone number or email of the target device 3) in injectMessage.js replace the marker "FULL PATH" with the path of the obj file 4) in the local directory, run: python3 sendMessage.py This will lead to a crash in SpringBoard requiring no user interaction. I've also attached a crash dump and ETencode.m, which is the file that was used to generate the obj file. Proof of Concept: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47158.zip # 0day.today [2024-07-01] #