Bug Hunter Diary

sl 0xf40100 15991040fp 0x80808005 -2139062267ip 0x20044 131140sp 0x684c00 6835200lr 0x1f310 127760pc 0x44444444 1145324612cpsr{0x60000010, n = 0x0, z = 0x1, c = 0x1, v = 0x0, q = 0x0, j = 0x0, ge= 0x0, e = 0x0, a = 0x0, i = 0x0, f = 0x0, t = 0x0, mode = 0x10} {0x60000010, n= 0, z = 1, c = 1, v = 0, q = 0, j = 0, ge = 0, e = 0, a = 0, i = 0, f = 0, t = 0,mode = usr}(gdb) backtrace#0 0x44444444 in ?? ()Cannot access memory at address 0x74747318Yay! At this point I had full control over the program counter.8.3 Vulnerability RemediationTuesday, February 2, 2010I informed Apple of the bug on October 4, 2009.Today they released a new version of iPhone OSto address the vulnerability.The bug was easy to find, so I’m sure that Iwasn’t the only person who knew about it, but Iseem to be the only one who informed Apple.More surprising: Apple didn’t find such a trivialbug on its own.← The vulnerabilityaffects the iPhone aswell as the iPod touchwith iPhone OS priorversion 3.1.3.8.4 Lessons LearnedAs a bug hunter and iPhone user:• Even dumb mutation-based fuzzers, like the one described in thischapter, can be quite effective.• Fuzzing the iPhone is tedious but worth it.• Do not open untrusted (media) files on your iPhone.8.5 AddendumTuesday, February 2, 2010Since the vulnerability has been fixed and a new version of iPhoneOS is available, I released a detailed security advisory on my websitetoday. 8 The bug was assigned CVE-2010-0036. Figure 8-3 shows a timelineof how the vulnerability was addressed.The Ringtone Massacre 147