PT-2009-5587 · Apple · Iphone Mail+1

Publicado 2009-09-21 · Atualizado 2021-05-23 · CVE-2009-3273

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple iPhone OS (affected versions not specified) iPhone OS for iPod touch (affected versions not specified)

Description The issue concerns the failure to validate X.509 certificates in iPhone Mail, allowing man-in-the-middle attackers to spoof arbitrary SSL e-mail servers by using a crafted certificate.

Recommendations For Apple iPhone OS, update to a version that properly validates X.509 certificates. For iPhone OS for iPod touch, update to a version that properly validates X.509 certificates. As a temporary workaround, consider disabling SSL e-mail servers until a patch is available.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2009-3273

Produtos afetados

Iphone Mail

Ios

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/53234 · Nota
• http://securityfocus.com/archive/1/506428/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3273 · Nota de Segurança
• http://securityfocus.com/bid/36370 · Nota