PT-2009-3542 · Apple · Ios+1

Aviv Raff + 8 · Published 2009-06-19 · Updated 2022-08-09 · CVE-2009-0960

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple iPhone OS versions 1.0 through 2.2.1 Apple iPhone OS for iPod touch versions 1.1 through 2.2.1

Description The issue concerns the Mail component, which does not offer an option to disable remote image loading in HTML emails. This allows remote attackers to determine the device's address and when an email is read by sending an HTML email that contains an image URL.

Recommendations For Apple iPhone OS versions 1.0 through 2.2.1, consider disabling HTML email rendering until a fix is available. For Apple iPhone OS for iPod touch versions 1.1 through 2.2.1, consider disabling HTML email rendering until a fix is available.

Fix

Related Identifiers

CVE-2009-0960

Affected Products

Ios

Ipod Touch

References · 7

• http://vupen.com/english/advisories/2009/1621 · Vendor Advisory
• http://support.apple.com/kb/HT3639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0960 · Security Note
• http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51209 · Note
• http://securityfocus.com/bid/35434 · Note
• http://securityfocus.com/bid/35414 · Note