PT-2013-5098 · Apple · Ios

Andreas Kurtz + 1 · Publicado 2013-06-18 · Atualizado 2013-10-25 · CVE-2013-4616

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:A/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 7

Description The issue concerns the generation of default Wi-Fi passwords in Apple iOS. Specifically, the WifiPasswordController generateDefaultPassword method relies on the UITextChecker suggestWordInLanguage method for selecting Wi-Fi hotspot WPA2 PSK passphrases. This approach results in an insufficient number of possible passphrases, making it easier for remote attackers to obtain access via a brute-force attack.

Recommendations For Apple iOS versions prior to 7, consider changing the default Wi-Fi password to a stronger, manually generated passphrase to minimize the risk of exploitation. As a temporary workaround, restrict access to sensitive data and networks until a secure password can be set.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2013-4616

Produtos afetados

Ios

Referências · 8

• http://www1.cs.fau.de/filepool/projects/hotspot/hotspot.pdf · Nota
• http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html · Aviso do Fabricante
• http://support.apple.com/kb/HT5934 · Nota
• http://securitytracker.com/id/1029054 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4616 · Nota de Segurança
• http://secunia.com/advisories/54886 · Aviso do Fabricante
• http://www1.cs.fau.de/hotspot · Nota
• http://lists.owasp.org/pipermail/owasp-mobile-security-project/2013-June/000640.html · Nota