Apple iPhone and iPod touch USB Control Message Security Bypass Vulnerability
BID:38040
Info
Apple iPhone and iPod touch USB Control Message Security Bypass Vulnerability
| Bugtraq ID: | 38040 |
| Class: | Access Validation Error |
| CVE: |
CVE-2010-0038 |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 02 2010 12:00AM |
| Updated: | Feb 02 2010 12:00AM |
| Credit: | The vendor disclosed this issue. |
| Vulnerable: |
Apple iPod Touch 3.1.2 Apple iPod Touch 3.1.1 Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 1.1.4 Apple iPod Touch 1.1.3 Apple iPod Touch 1.1.2 Apple iPod Touch 1.1.1 Apple iPod Touch 3.0 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPod Touch 1.1 Apple iPod Touch 0 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 1.1.4 Apple iPhone 1.1.3 Apple iPhone 1.1.2 Apple iPhone 1.1.1 Apple iPhone 1.0.2 Apple iPhone 1.0.1 Apple iPhone 3.1 Apple iPhone 3.0 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPhone 1.1 Apple iPhone 1 Apple iPhone 0 |
| Not Vulnerable: |
Apple iPod Touch 3.1.3 Apple iPhone 3.1.3 |
Discussion
Apple iPhone and iPod touch USB Control Message Security Bypass Vulnerability
Apple iPhone and iPod touch are prone to a security-bypass vulnerability affecting the Recovery Mode component.
An attacker with physical access to a locked device can exploit this issue to bypass the passcode to access a user's data. This may aid in further attacks.
Versions prior to iPhone OS 3.1.3 are affected.
Apple iPhone and iPod touch are prone to a security-bypass vulnerability affecting the Recovery Mode component.
An attacker with physical access to a locked device can exploit this issue to bypass the passcode to access a user's data. This may aid in further attacks.
Versions prior to iPhone OS 3.1.3 are affected.
Exploit / POC
Apple iPhone and iPod touch USB Control Message Security Bypass Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Apple iPhone and iPod touch USB Control Message Security Bypass Vulnerability
Solution:
The vendor has released an advisory and a fix that is available via Apple's iTunes application. Please see the references for more information.
Solution:
The vendor has released an advisory and a fix that is available via Apple's iTunes application. Please see the references for more information.
References
Apple iPhone and iPod touch USB Control Message Security Bypass Vulnerability
References:
References: