PT-2009-4163 · Microsoft+1 · Exchange Activesync+1

Publicado 2009-06-19 · Atualizado 2022-08-09 · CVE-2009-1679

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Apple iPhone OS versions 1.0 through 2.2.1 iPhone OS for iPod touch versions 1.1 through 2.2.1

Description: The Profiles component, when installing a configuration profile, can replace the password policy from Exchange ActiveSync with a weaker password policy. This allows physically proximate attackers to bypass the intended policy.

Recommendations: For Apple iPhone OS versions 1.0 through 2.2.1, consider disabling the installation of configuration profiles until a patch is available. For iPhone OS for iPod touch versions 1.1 through 2.2.1, restrict the use of Exchange ActiveSync to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-1679

Produtos afetados

Exchange Activesync

Ios

Referências · 9

• http://support.apple.com/kb/HT3639 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-1679 · Nota de Segurança
• http://vupen.com/english/advisories/2009/1621 · Aviso do Fabricante
• https://t.me/cvenotify/34420 · Publicação no Telegram
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51212 · Nota
• http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html · Aviso do Fabricante
• http://securityfocus.com/bid/35436 · Nota
• http://securityfocus.com/bid/35414 · Nota
• http://osvdb.org/55239 · Nota