Apple iPhone/iPod touch Prior to iOS 4 Safari Security Bypass Vulnerability

Bugtraq ID:	41065
Class:	Design Error
CVE:	CVE-2010-1755
Remote:	Yes
Local:	No
Published:	Jun 21 2010 12:00AM
Updated:	Jun 23 2010 04:58PM
Credit:	Jason Dent
Vulnerable:	Apple iPod Touch 3.1.3 Apple iPod Touch 3.1.2 Apple iPod Touch 3.1.1 Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 3.0 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPod Touch 0 Apple iPhone 3.1.3 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 3.1 Apple iPhone 3.0 Apple iPhone 2.2 Apple iPhone 2.1 Apple iPhone 2.0 Apple iPhone 0
Not Vulnerable:	Apple iOS 4

Apple iPhone/iPod touch Prior to iOS 4 Safari Security Bypass Vulnerability

Apple Safari for iOS is prone to a security-bypass vulnerability that allows unauthorized access to cookies.

This issue may allow websites to bypass certain security restrictions and gain access to potentially sensitive information.

NOTE: This BID was previously covered in BID 41016 (Apple iPhone/iPod touch Prior to iOS 4 Multiple Vulnerabilities) but has been given its own record to better document it.

Versions prior to iOS 4 are vulnerable.

Apple iPhone/iPod touch Prior to iOS 4 Safari Security Bypass Vulnerability

Attackers may exploit this issue using standard tools.

Apple iPhone/iPod touch Prior to iOS 4 Safari Security Bypass Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for details.

Apple iPhone/iPod touch Prior to iOS 4 Safari Security Bypass Vulnerability

References:

• iOS Homepage (Apple)
  
• iPhone Product Page (Apple)
  
• iPod touch Product Page (Apple)