Hi, my friend g0tcha and myself came across a remote DoS <span class="Apple-style-span" style="white-space: pre; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; ">(I know it sucks) </span>in iPhone (tested on
1.1.2) while looking for a jailbreak for 1.1.3. By browsing to <div><br class="webkit-block-placeholder"></div><div><a href="http://open-security.org/ifuk.html">http://open-security.org/ifuk.html</a></div><div><br class="webkit-block-placeholder">
</div><div>you can trigger the following:<div><br class="webkit-block-placeholder"></div><div><div># /Applications/MobileSafari.app/MobileSafari</div><div>2008-01-22 13:27:04.668 MobileSafari[230:d03] Safari got memory level warning, killing all documents except active.
</div><div>2008-01-22 13:27:06.081 MobileSafari[230:d03] Safari got memory level warning, killing all documents except active.</div><div><br> </div><div>which creates a Kernel panic:</div><div><br class="webkit-block-placeholder">
</div><div># cat 2008-01-22-133039.panic.plist</div><div><?xml version="1.0" encoding="UTF-8"?></div><div><!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "<a href="http://www.apple.com/DTDs/PropertyList-1.0.dtd">
http://www.apple.com/DTDs/PropertyList-1.0.dtd</a>"></div><div><plist version="1.0"></div><div><dict></div><div> <key>bug_type</key></div><div> <string>110</string>
</div><div> <key>description</key></div><div> <string>Incident Identifier: CA1C11E9-7607-4A85-93DE-8EB91D58B3C3</div><div>CrashReporter Key: f0feeb183ddcb5c5b291efdc094414a39ce0f837</div>
<div>Date/Time: 2008-01-22 13:30:41.464 +0000</div><div>OS Version: OS X 1.1.2 (3B48b)</div><div><br class="webkit-block-placeholder"></div><div>Debugger message: WDT timeout</div><div><br class="webkit-block-placeholder">
</div><div>OS version: 3B48b</div><div>Kernel version: Darwin Kernel Version 9.0.0d1: Wed Oct 10 00:07:50 PDT 2007; root:xnu-933.0.0.204.obj~7/RELEASE_ARM_S5L8900XRB</div><div>iBoot version: iBoot-204.2.9</div><div>secure boot?: YES
</div><div>Paniclog version: 1</div><div>Task 0xc0817dc8: 66 threads: pid 0: kernel_task</div><div> thread 0xc093c000</div><div> kernel backtrace: e37e3b08</div><div> lr: 0xc0061fb3 fp: 0xe37e3b2c
</div><div> lr: 0xc006219b fp: 0xe37e3b44</div><div> lr: 0xc0493070 fp: 0xe37e3f6c</div><div> lr: 0xc0141d79 fp: 0xe37e3f80</div><div> lr: 0xc0028175 fp: 0xe37e3fa8
</div><div> lr: 0xc00609f8 fp: 0x00000000</div><div><br class="webkit-block-placeholder"></div><div>Task 0xc0817c40: 3 threads: pid 1: launchd</div><div>Task 0xc0817930: 2 threads: pid 13: SMST</div><div>
Task 0xc0817498: 13 threads: pid 16: BTServer</div><div>Task 0xc0817310: 10 threads: pid 17: CommCenter</div><div>Task 0xc1025dc8: 5 threads: pid 20: configd</div><div>Task 0xc1025c40: 1 threads: pid 21: crashreporterd</div>
<div>Task 0xc1025ab8: 1 threads: pid 22: cron</div><div>Task 0xc1025930: 5 threads: pid 23: iapd</div><div>Task 0xc10257a8: 2 threads: pid 24: mDNSResponder</div><div>Task 0xc1025620: 4 threads: pid 25: lockdownd</div><div>
Task 0xc1025498: 3 threads: pid 26: syslogd</div><div>Task 0xc1025310: 1 threads: pid 27: update</div><div>Task 0xc1025188: 2 threads: pid 28: ptpd</div><div>Task 0xc12f1dc8: 2 threads: pid 30: notifyd</div><div>Task 0xc0817620: 2 threads: pid 187: dock
</div><div>Task 0xc0817ab8: 2 threads: pid 188: ants</div><div>Task 0xc0817000: 10 threads: pid 189: SpringBoard</div><div>Task 0xc12f1930: 2 threads: pid 190: MobilePhone</div><div>Task 0xc12f1ab8: 1 threads: pid 212: afcd
</div><div>Task 0xc12f1c40: 2 threads: pid 214: notification_pro</div><div>Task 0xc12f1620: 1 threads: pid 228: sshd</div><div>Task 0xc12f17a8: 1 threads: pid 229: sh</div><div>Task 0xc12f1498: 6 threads: pid 230: MobileSafari
</div><div>Task 0xc08177a8: 14 threads: pid 231: mediaserverd</div><div></string></div><div> <key>system_ID</key></div><div> <string></string></div><div></dict></div><div>
</plist></div><div><br class="webkit-block-placeholder"></div><div><br class="webkit-block-placeholder"></div><div>The code I have used is ripped from MOBB - thanks HDM!! - anyway, we can't seem to exploit this bug, but still working on it AND some other little things - Anyway, happy iPhoning (or browsing and wondering what to do with your brick if you updated to
1.1.3) :ppp.</div><br>-- <br><br>regards<br>c0ntex
</div></div>