PT-2007-4995 · Apple · Iphone

Published 2007-09-27 · Updated 2022-08-09 · CVE-2007-3754

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple iPhone version 1.1.1

Description The issue allows remote attackers to steal credentials and read email via a man-in-the-middle (MITM) attack because Mail in Apple iPhone does not warn the user when the mail server changes or is not trusted while using SSL.

Recommendations For Apple iPhone version 1.1.1, consider disabling SSL connections to mail servers until a patch is available, and restrict access to sensitive email accounts to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2007-3754

Affected Products

Iphone

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-3754 · Security Note
• http://securityfocus.com/bid/25856 · Note
• http://osvdb.org/38537 · Note
• http://lists.apple.com/archives/security-announce/2007/Sep/msg00001.html · Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36845 · Note
• http://securitytracker.com/id?1018752 · Note
• http://vupen.com/english/advisories/2007/3287 · Note
• http://docs.info.apple.com/article.html?artnum=306586 · Note
• http://secunia.com/advisories/26983 · Note