Apple iPhone PIN Authentication Security Bypass Vulnerability

Bugtraq ID:	40376
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	May 17 2010 12:00AM
Updated:	May 17 2010 12:00AM
Credit:	Bernd Marienfeldt
Vulnerable:	Apple iPhone 3.1.3 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 3.1 Apple iPhone 3.0
Not Vulnerable:

Apple iPhone PIN Authentication Security Bypass Vulnerability

Apple iPhone is prone to a security-bypass vulnerability due to a failure to restrict access to locked devices.

An attacker with physical access to a locked device can exploit this issue to bypass the passcode and access a user's data. This may aid in further attacks.

iPhone 3GS devices are vulnerable; other versions or devices may also be affected.

Apple iPhone PIN Authentication Security Bypass Vulnerability

An attacker can exploit this issue using readily available tools.

Apple iPhone PIN Authentication Security Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple iPhone PIN Authentication Security Bypass Vulnerability

References:

• Cisco TelePresence Video Communication Server (VCS) Homepage (Cisco)
  
• iPhone business security framework (Bernd)
  
• iPhone data protection (vtlists () wyae de)
  
• iPhone data protection flaw (Thor (Hammer of God))
  
• iPhone data protection flaw (Bernd Marienfeldt)
  
• iPhone in Business Security Overview (Apple)