Apple iPhone and iPod touch Mail Client Information Disclosure Weakness

Bugtraq ID:	35434
Class:	Design Error
CVE:	CVE-2009-0960
Remote:	Yes
Local:	No
Published:	Jun 17 2009 12:00AM
Updated:	Jun 19 2009 04:19PM
Credit:	Ronald C.F. Antony of Cubiculum Systems, Stefan Seiz of ERNI Electronics GmbH, Oskar Lissheim-Boethius of iPhone development house OLB Productions, Meyer Consulting, Oliver Quas, Christian Schmitz of MonkeybreadSoftware, Thomas Adams of TynTec, Aviv Raff o
Vulnerable:	Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 1.1.4 Apple iPod Touch 1.1.3 Apple iPod Touch 1.1.2 Apple iPod Touch 1.1.1 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPod Touch 1.1 Apple iPod Touch 0 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 1.1.4 Apple iPhone 1.1.3 Apple iPhone 1.1.2 Apple iPhone 1.1.1 Apple iPhone 1.0.2 Apple iPhone 1.0.1 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPhone 1.1 Apple iPhone 1 Apple iPhone 0
Not Vulnerable:	Apple iPod Touch 3.0 Apple iPhone 3.0

Apple iPhone and iPod touch Mail Client Information Disclosure Weakness

Apple iPhone and iPod touch are prone to an information-disclosure weakness.

Successfully exploiting this issue may allow attackers to verify a recipient's email address and obtain their IP address.

NOTE: This issue was previously covered in BID 35414 (Apple iPhone and iPod touch Prior to Version 3.0 Multiple Vulnerabilities), but has been assigned its own record to better document it.

Apple iPhone and iPod touch Mail Client Information Disclosure Weakness

To exploit this issue, an attacker will entice a user to view an email.

Apple iPhone and iPod touch Mail Client Information Disclosure Weakness

Solution:
The vendor has released an advisory and fixes. Please see the references for details.

Apple iPhone and iPod touch Mail Client Information Disclosure Weakness

References:

• iPhone Product Page (Apple)
  
• iPod touch Product Page (Apple)