Apple iPhone and iPod touch Untrusted Certificate Exception Information Disclosure Vulnerability
BID:35447
Info
Apple iPhone and iPod touch Untrusted Certificate Exception Information Disclosure Vulnerability
| Bugtraq ID: | 35447 |
| Class: | Design Error |
| CVE: |
CVE-2009-0958 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 17 2009 12:00AM |
| Updated: | May 12 2015 07:48PM |
| Credit: | FD of Securus Global |
| Vulnerable: |
Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 1.1.4 Apple iPod Touch 1.1.3 Apple iPod Touch 1.1.2 Apple iPod Touch 1.1.1 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPod Touch 1.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 1.1.4 Apple iPhone 1.1.3 Apple iPhone 1.1.2 Apple iPhone 1.1.1 Apple iPhone 1.0.2 Apple iPhone 1.0.1 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPhone 1.1 Apple iPhone 1 Apple iPhone 0 |
| Not Vulnerable: |
Apple iPod Touch 3.0 Apple iPhone 3.0 |
Discussion
Apple iPhone and iPod touch Untrusted Certificate Exception Information Disclosure Vulnerability
Apple iPhone and iPod touch are prone to an information-disclosure vulnerability.
Successfully exploiting this issue may allow an attacker to perform man-in-the-middle attacks by impersonating a trusted Exchange server. This may allow the attacker to obtain credentials or other sensitive information or give users a false sense of security. Information harvested may aid in further attacks.
NOTE: This issue was previously covered in BID 35414 (Apple iPhone and iPod touch Prior to Version 3.0 Multiple Vulnerabilities), but has been assigned its own record to better document it.
Apple iPhone and iPod touch are prone to an information-disclosure vulnerability.
Successfully exploiting this issue may allow an attacker to perform man-in-the-middle attacks by impersonating a trusted Exchange server. This may allow the attacker to obtain credentials or other sensitive information or give users a false sense of security. Information harvested may aid in further attacks.
NOTE: This issue was previously covered in BID 35414 (Apple iPhone and iPod touch Prior to Version 3.0 Multiple Vulnerabilities), but has been assigned its own record to better document it.
Exploit / POC
Apple iPhone and iPod touch Untrusted Certificate Exception Information Disclosure Vulnerability
Attackers can exploit this issue by enticing an unsuspecting user to connect to a malicious server.
Attackers can exploit this issue by enticing an unsuspecting user to connect to a malicious server.
Solution / Fix
Apple iPhone and iPod touch Untrusted Certificate Exception Information Disclosure Vulnerability
Solution:
The vendor has released an advisory and fixes. Please see the references for details.
Solution:
The vendor has released an advisory and fixes. Please see the references for details.
References
Apple iPhone and iPod touch Untrusted Certificate Exception Information Disclosure Vulnerability
References:
References:
- iPhone Product Page (Apple)
- iPod touch Product Page (Apple)