REDHAT-BUG-1339988: Low severity libimobiledevice libimobiledevice vulnerability
It was found that libimobiledevice and libusbmuxd libraries accidentally bound a listening IPv4 TCP socket to INADDRANY instead of INADDRLOOPBACK.
This socket is used to communicate with services on an iOS device. The impact is accidental exposure of the iOS device to attackers on the local network. The RHEL workstation itself is not exposed, nor is there an easy escalation for attackers to gain access to the host.
Upstream patches:
libusbmuxd: https://github.com/libimobiledevice/libusbmuxd/commit/4397b3376dc4e4cb1c991d0aed61ce6482614196
libimobiledevice: https://github.com/libimobiledevice/libimobiledevice/commit/df1f5c4d70d0c19ad40072f5246ca457e7f9849e
CVE request:
http://seclists.org/oss-sec/2016/q2/410
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1339988?
The severity of REDHAT-BUG-1339988 is considered high as it exposes iOS devices to potential attacks from local network threats.
How do I fix REDHAT-BUG-1339988?
To fix REDHAT-BUG-1339988, update the libimobiledevice and libusbmuxd libraries to the latest patched versions provided by the vendor.
What systems are affected by REDHAT-BUG-1339988?
REDHAT-BUG-1339988 affects systems that use the libimobiledevice and libusbmuxd libraries for iOS device communication.
Is there a workaround for REDHAT-BUG-1339988?
A potential workaround for REDHAT-BUG-1339988 is to configure your firewall to block access to the affected services from the local network.
What is the impact of REDHAT-BUG-1339988?
The impact of REDHAT-BUG-1339988 is the accidental exposure of iOS devices to attackers on the local network due to inappropriate socket binding.