PT-2017-3077 · Apple+1 · Ios+1

Ilya Nesterov + 1 · Publicado 2017-09-19 · Atualizado 2017-10-26 · CVE-2017-7088

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions iOS versions prior to 11

Description The issue involves the Exchange ActiveSync component and allows remote attackers to erase a device by hijacking a cleartext AutoDiscover V1 session during the setup of an Exchange account. This occurs due to improper permission handling when setting up an account, which can be exploited by a remote attacker to delete data on the device.

Recommendations For iOS versions prior to 11, consider disabling the Exchange ActiveSync component until a fix is available to prevent remote attackers from exploiting this issue. Restrict access to the AutoDiscover V1 session to minimize the risk of exploitation. Avoid using the Exchange ActiveSync component for setting up Exchange accounts until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-275

Identificadores relacionados

BDU:2017-02447

CVE-2017-7088

Produtos afetados

Exchange Activesync

Ios

Referências · 6

• https://support.apple.com/HT208112 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-02447 · Nota de Segurança
• http://securitytracker.com/id/1039385 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7088 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-7088 · Aviso do Fabricante
• http://securityfocus.com/bid/100892 · Nota