Apple iOS 'keychain' Local Information Disclosure Vulnerability

Bugtraq ID:	46437
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Feb 09 2011 12:00AM
Updated:	Feb 09 2011 12:00AM
Credit:	Jens Heider, Matthias Boll
Vulnerable:	Apple iPod Touch 3.1.3 Apple iPod Touch 3.1.2 Apple iPod Touch 3.1.1 Apple iPod Touch 2.2.1 Apple iPod Touch 2.0.2 Apple iPod Touch 2.0.1 Apple iPod Touch 1.1.4 Apple iPod Touch 1.1.3 Apple iPod Touch 1.1.2 Apple iPod Touch 1.1.1 Apple iPod Touch 3.0 Apple iPod Touch 2.2 Apple iPod Touch 2.1 Apple iPod Touch 2.0 Apple iPod Touch 1.1 Apple iPod Touch 0 Apple iPhone 4.0.1 Apple iPhone 3.2.1 Apple iPhone 3.1.3 Apple iPhone 3.1.2 Apple iPhone 3.0.1 Apple iPhone 2.2.1 Apple iPhone 2.0.2 Apple iPhone 2.0.1 Apple iPhone 1.1.5 Apple iPhone 1.1.4 Apple iPhone 1.1.3 Apple iPhone 1.1.2 Apple iPhone 1.1.1 Apple iPhone 1.0.2 Apple iPhone 1.0.1 Apple iPhone 4.1 Apple iPhone 4.0.2 Apple iPhone 4.0.1 - Ipodtouch Apple iPhone 4.0.1 - Iphone Apple iPhone 4.0 - Ipodtouch Apple iPhone 4.0 - Iphone Apple iPhone 4.0 Apple iPhone 3.2.2 Apple iPhone 3.2.1 - Ipad Apple iPhone 3.2 - Ipodtouch Apple iPhone 3.2 - Iphone Apple iPhone 3.2 Apple iPhone 3.1.3 - Ipodtouch Apple iPhone 3.1.3 - Iphone Apple iPhone 3.1.2 - Ipodtouch Apple iPhone 3.1.2 - Iphone Apple iPhone 3.1 - Ipodtouch Apple iPhone 3.1 - Iphone Apple iPhone 3.1 Apple iPhone 3.0.1 - Ipodtouch Apple iPhone 3.0.1 - Iphone Apple iPhone 3.0 - Ipodtouch Apple iPhone 3.0 - Iphone Apple iPhone 3.0 Apple iPhone 2.2.1 - Ipodtouch Apple iPhone 2.2.1 - Iphone Apple iPhone 2.2 - Ipodtouch Apple iPhone 2.2 - Iphone Apple iPhone 2.2 Apple iPhone 2.1.1 Apple iPhone 2.1 - Ipodtouch Apple iPhone 2.1 - Iphone Apple iPhone 2.1 Apple iPhone 2.0 Apple iPhone 2.0 Apple iPhone 1.1.5 - Ipodtouch Apple iPhone 1.1.5 - Iphone Apple iPhone 1.1 Apple iPhone 1 Apple iPhone 0 Apple iPad 3.2.1 Apple iPad 3.2.2 Apple iPad 3.2 Apple iPad 0 Apple iPad 0 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 4.2 beta Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 2.1 Apple iOS 2.0
Not Vulnerable:

Apple iOS 'keychain' Local Information Disclosure Vulnerability

The discoverer of this issue has developed exploit tools. These tools are not otherwise known to be available, or circulating in the wild.

Apple iOS 'keychain' Local Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apple iOS 'keychain' Local Information Disclosure Vulnerability

References:

• iPhone Product Page (Apple)
  
• iPod touch Product Page (Apple)
  
• Lost iPhone? Lost Passwords! (Jens Heider, Matthias Boll)