A persistent denial of service vulnerability affecting iOS
trevorspiniolas.com
A persistent denial of service vulnerability affecting iOS
1–10 of 36 posts
Re: A persistent denial of service vulnerability affecting iOS
#2> This bug was initially reported on August 10th
They had plenty of time. You did the right thing by disclosing.
Re: A persistent denial of service vulnerability affecting iOS
#3This looks nasty, I hope they patch this soon.
Re: A persistent denial of service vulnerability affecting iOS
#4What is it with iOS and string parsing bugs? First it was iMessage content then it was SSIDs now it's LAN device names? Oof
Re: A persistent denial of service vulnerability affecting iOS
#5Uh.
I wonder if this can still be triggered when the Home application has been removed from the device? I expect so as IIRC builtin-in application removal is really just hiding them and all the functions are part of priviledged bundles shipped with the OS.
Re: A persistent denial of service vulnerability affecting iOS
#6What is it with iOS and string parsing bugs? First it was iMessage content then it was SSIDs now it's LAN device names? Oof
This is not a parsing bug, it is just some component crashing because of a name that is too long. Not very nice, but considering the source of the name any exploitation scenario is very unlikely and this is incomparable to bugs that allow code execution.
Re: A persistent denial of service vulnerability affecting iOS
#7Why didn’t they add a string limit?
Re: A persistent denial of service vulnerability affecting iOS
#8Uh. I wonder if this can still be triggered when the Home application has been removed from the device? I expect so as IIRC builtin-in application removal is really just hiding them and all the functions are part of priviledged bundles shipped with the OS.
> all the functions are part of privileged bundles shipped with the OS
Luckily a lot of these can be disabled when jailbroken: https://i.imgur.com/KhGmGrf.png
Re: A persistent denial of service vulnerability affecting iOS
#9There are so many bugs in iOS that are years old and still unfixed.
One example is the cellular-data draining bug[1]. The only "solution" for this is to wipe your device, and set it up again, without restoring any backups, at all. Which makes the whole point of backups of the device totally pointless.
For a company that spent $6B+ on a (now mostly empty) campus, you'd think they could spare a few $million into proper QA/Testing.
[1] https://mjtsai.com/blog/2019/07/26/broken-ios-cellular-data-...
Re: A persistent denial of service vulnerability affecting iOS
#10Why didn’t they add a string limit?
Perhaps the limit was "available memory"? It's not hard to imagine how a programmer who has only ever worked with dynamic languages and basically doesn't know what a fixed-length-buffer is could be completely oblivious to it.
Then again, what is an appropriate limit on the length of the name of a HomeKit device? I'm tempted to say 255, but I'm sure someone else would disagree. I've been in design meetings where such things were discussed, with lots of bikeshed, so it's also understandable that, with deadlines and other priorities, they decided not to impose any limit.