Executive brief
libplist is a library used to handle Apple Property List (plist) files, commonly used for communicating with iOS devices. A vulnerability in the library's utility tool allows an attacker to provide a specially crafted, malformed file that can crash the application or expose sensitive information from the computer's memory. This could lead to service disruptions or the unauthorized disclosure of private data during file processing.
Technical details
An out-of-bounds (OOB) heap buffer read exists in the 'plistutil' tool within libplist versions up to and including 1.12. The vulnerability is located in the main function of tools/plistutil.c, where the application performs a memory comparison (memcmp) or similar read operation on input data without verifying that the file size is sufficient (minimum 8 bytes). A remote attacker can exploit this by providing a truncated or malformed Apple Property List file, leading to a process crash (Denial of Service) or the leakage of sensitive information from the heap memory. The issue was addressed by adding a check to ensure the input file size is at least 8 bytes before processing.
Affected products
- libimobiledevice libplist through 1.12
Timeline
- 2017-01-17: disclosed: Issue reported on GitHub by user zhunki
- 2017-01-20: patched: Fix committed to libplist repository
- 2017-01-21: advisory: NVD publication date
- 2020-04-02: patched: Debian LTS security update released