PT-2017-1760 · Apple · Icloud+1

Matthias Wachs + 1 · Publicado 2017-04-01 · Atualizado 2017-07-12 · CVE-2017-2383

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions iTunes before 12.6 on Windows iCloud before 6.2 on Windows

Description The issue involves cleartext client-certificate transmission in the "APNs Server" component, allowing man-in-the-middle attackers to track users via correlation with this certificate. This is related to the use of plaintext client certificates and their transmission to a vulnerable component.

Recommendations For iTunes before 12.6 on Windows, update to version 12.6 or later to resolve the issue. For iCloud before 6.2 on Windows, update to version 6.2 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

BDU:2017-00916

CVE-2017-2383

Produtos afetados

Icloud

Itunes

Referências · 7

• http://securityfocus.com/bid/97175 · Nota
• https://support.apple.com/HT207599 · Aviso do Fabricante
• http://securitytracker.com/id/1038157 · Nota
• https://support.apple.com/HT207607 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2383 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-2383 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-00916 · Nota de Segurança