Security Alert (A17-09-07): Multiple Vulnerabilities in Broadcom Wireless Chipset

Description:

Multiple vulnerabilities are found in Apple and Android devices built upon Broadcom BCM4355C0 model of wireless chipset. An attacker could exploit the vulnerabilities via a Wi-Fi connection without special permissions required.

Reports indicate that the proof-of-concept exploit code is available on the Internet.

Affected Systems:

• iPhone 5s and later
• iPad Air and later
• iPod touch (6th generation) and later
• Android devices using Broadcom BCM4355C0 model of wireless chipset. It is recommended to consult the Android device supplier and/or device manufacturer if the mentioned chipset is used.

Impact:

A successful attack could lead to arbitrary code execution.

Recommendation:

• Apple Devices
  To address the vulnerability for Apple devices, the product vendor has released iOS 11.0.1 to address the issue.
  
  
• Android Devices
  To address the vulnerability for Android device, Google has provided patches to device manufacturers for their further testing and distribution to their customers' devices. Users shall ascertain that the Android devices are updated with the patches once available. Users should contact the device manufacturers for the patch availability and details.
  
  

Users are advised not to connect mobile devices to suspicious Wi-Fi networks at all time.

More Information:

https://support.apple.com/en-hk/HT208143
https://bugs.chromium.org/p/project-zero/issues/detail?id=1289
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11120
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11121