Difference between revisions of "3DS Userland Flaws"
Jump to navigation
Jump to search
Line 53: | Line 53: | ||
| 2012 | | 2012 | ||
| [[User:Ichfly|Ichfly]] | | [[User:Ichfly|Ichfly]] | ||
+ | |- | ||
+ | | Webkit bugs | ||
+ | | spider has had at least three/four different vulns exploited. | ||
+ | | | ||
+ | | | ||
+ | | 2013? | ||
+ | | A lot of people. | ||
|} | |} | ||
=System applets= | =System applets= |
Revision as of 16:45, 16 March 2015
This page lists vulnerabilities / exploits for 3DS applications and applets. Exploiting these initially results in ROP.
Non-system applications
Application name | Summary | Description | Fixed in version | Last version this flaw was checked for | Timeframe info related to this was added to wiki | Timeframe this vuln was discovered | Vuln discovered by |
---|---|---|---|---|---|---|---|
Cubic Ninja | Map-data stack smash | See here regarding Ninjhax. | None | Ninjhax release | July 2014 | smea | |
The Legend of Zelda: Ocarina of Time 3D | UTF-16 name string buffer overflow via unchecked u8 length field | The u8 at offset 0x2C in the savefile is the character-length of the UTF-16 string at offset 0x1C. When copying this string, it's essentially a memory-copy with lenval*2, not a string-copy. This can be used to trigger buffer overflows at various locations depending on the string length.
On March 11, 2015, an exploit using this vuln was released, that one was intended for warez/etc. The following exploit wasn't released before then mainly because doing so would (presumably) result in the vuln being fixed. The following old exploit was released on March 14, 2015: [1]. |
None | March 11, 2015 | Around October 22, 2012 | Yellows8 |
System applications
Summary | Description | Fixed in version | Last version this flaw was checked for | Timeframe this was discovered | Discovered by |
---|---|---|---|---|---|
3DS System Settings DS profile string stack-smash | Too long or corrupted strings (01Ah 2 Nickname length in characters 050h 2 Message length in characters) in the NVRAM DS user settings (System Settings->Other Settings->Profile->Nintendo DS Profile) cause it to crash in 3DS-mode due to a stack-smash. The DSi is not vulnerable to this, DSi launcher(menu) and DSi System Settings will reset the NVRAM user-settings if the length field values are too long(same result as when the CRCs are invalid). TWL_FIRM also resets the NVRAM user-settings when the string-length(s) are too long. | 7.0.0-13 | 7.0.0-13 | 2012 | Ichfly |
Webkit bugs | spider has had at least three/four different vulns exploited. | 2013? | A lot of people. |