Apple iPhone Passcode Lock Security Bypass Vulnerability

Bugtraq ID:	27297
Class:	Access Validation Error
CVE:	CVE-2008-0034 CVE-2008-3633
Remote:	No
Local:	Yes
Published:	Jan 15 2008 12:00AM
Updated:	Sep 12 2008 05:20PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 1.1.2 Apple iPhone 1.1.1 Apple iPhone 1.0.2 Apple iPhone 1.0.1 Apple iPhone 2.0 Apple iPhone 1
Not Vulnerable:	Apple iPhone 1.1.3 Apple iPhone 2.1

Apple iPhone Passcode Lock Security Bypass Vulnerability

Apple iPhone is prone to a security-bypass vulnerability affecting the 'Passcode Lock' feature.

Attackers with physical access to the device can exploit this issue to gain unauthorized access to applications. This may aid in various attacks, including information disclosure.

Versions prior to iPhone 1.1.3 and 2.1 are vulnerable.

Apple iPhone Passcode Lock Security Bypass Vulnerability

An attacker with physical access to the iPhone can use standard functions of the device to exploit this issue.

Apple iPhone Passcode Lock Security Bypass Vulnerability

Solution:
The vendor released an advisory and a fix to address this issue. The fix is available via Apple's iTunes application.

Please see the references for more information.

Apple iPhone Passcode Lock Security Bypass Vulnerability

References:

• Cisco TelePresence Video Communication Server (VCS) Homepage (Cisco)
  
• iTunes Homepage (Apple)
  
• Major Security Flaw in 2.0.2 [iPhone] (Macrumors)
  
• About the security content of QuickTime 7.4 (Apple)