PT-2017-15406 · Apple · Pages+2

Philipp Eckel · Publicado 2017-04-02 · Atualizado 2017-07-12 · CVE-2017-2391

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pages versions prior to 6.1 on macOS Pages versions prior to 3.1 on iOS Numbers versions prior to 4.1 on macOS Numbers versions prior to 3.1 on iOS Keynote versions prior to 7.1 on macOS Keynote versions prior to 3.1 on iOS

Description The issue involves the "Export" component and allows users to bypass iWork PDF password protection. This is achieved by leveraging the use of 40-bit RC4, which is considered insecure.

Recommendations For Pages on macOS, update to version 6.1 or later. For Pages on iOS, update to version 3.1 or later. For Numbers on macOS, update to version 4.1 or later. For Numbers on iOS, update to version 3.1 or later. For Keynote on macOS, update to version 7.1 or later. For Keynote on iOS, update to version 3.1 or later.

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2017-2391

Produtos afetados

Keynote

Numbers

Pages

Referências · 7

• http://securitytracker.com/id/1038136 · Nota
• https://support.apple.com/HT207595 · Aviso do Fabricante
• http://securitytracker.com/id/1038135 · Nota
• http://securityfocus.com/bid/97126 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-2391 · Nota de Segurança
• http://securitytracker.com/id/1038134 · Nota
• https://osv.dev/vulnerability/CVE-2017-2391 · Aviso do Fabricante