Apple iPhone Lock Screen Security Bypass Vulnerability

Bugtraq ID:	44419
Class:	Unknown
CVE:	CVE-2010-4012
Remote:	No
Local:	Yes
Published:	Oct 22 2010 12:00AM
Updated:	Dec 10 2010 03:44PM
Credit:	jordand321
Vulnerable:	Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 4.2 beta Apple iOS 4.1 Apple iOS 4
Not Vulnerable:	Apple iOS 4.2

Apple iPhone Lock Screen Security Bypass Vulnerability

Apple iPhone is prone to a security-bypass vulnerability due to a failure to restrict access to locked devices.

An attacker with physical access to a locked device can exploit this issue to bypass the passcode and make calls to numbers in the address book.

The following iOS are vulnerable:

iOS version 4.2 beta
iOS version 4.1
iOS version 4.0

Apple iPhone Lock Screen Security Bypass Vulnerability

An attacker can exploit this issue using readily available tools.

Apple iPhone Lock Screen Security Bypass Vulnerability

Solution:
The vendor released an update. Please see the references for details.

Apple iPhone Lock Screen Security Bypass Vulnerability

References:

• Apple Homepage (Apple)
  
• iOS 4.1 glitch lets you bypass lock screen to access Phone app, photo album (vid (Engadget)
  
• iOS 4.1 Security Issue - Bypassing the Lock Screen to Make Calls (Macrumors)
  
• iPhone Homepage (Apple)
  
• Make calls from locked iPhone 4s (9to5mac.com)
  
• About the security content of iOS 4.2 (Apple)