Apple iOS Insecure Misleading UI Insecure Configuration Weakness

Bugtraq ID:	50159
Class:	Design Error
CVE:	CVE-2011-3430
Remote:	No
Local:	Yes
Published:	Oct 12 2011 12:00AM
Updated:	Oct 12 2011 12:00AM
Credit:	Florian Kreitmaier of Siemens CERT
Vulnerable:	Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0
Not Vulnerable:	Apple iOS 5

Apple iOS Insecure Misleading UI Insecure Configuration Weakness

Apple iOS is prone to a security weakness that may result in improper display of configurations and settings when applied through configuration profiles.

This weakness may cause unsuspecting users to set up unsafe configurations, resulting in a false sense of security. This may lead to other attacks.

Apple iOS Insecure Misleading UI Insecure Configuration Weakness

A specific exploit is not required. Since configuration settings may be misconfigured, the device may be more susceptible to other attacks.

Apple iOS Insecure Misleading UI Insecure Configuration Weakness

Solution:
The vendor has released an advisory and fixes. Please see the references for more information.

Apple iOS Insecure Misleading UI Insecure Configuration Weakness

References:

• Apple iOS Homepage (Apple)