PT-2009-4163 · Microsoft+1 · Exchange Activesync+1

Published 2009-06-19 · Updated 2022-08-09 · CVE-2009-1679

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Apple iPhone OS versions 1.0 through 2.2.1 iPhone OS for iPod touch versions 1.1 through 2.2.1

Description: The Profiles component, when installing a configuration profile, can replace the password policy from Exchange ActiveSync with a weaker password policy. This allows physically proximate attackers to bypass the intended policy.

Recommendations: For Apple iPhone OS versions 1.0 through 2.2.1, consider disabling the installation of configuration profiles until a patch is available. For iPhone OS for iPod touch versions 1.1 through 2.2.1, restrict the use of Exchange ActiveSync to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-1679

Affected Products

Exchange Activesync

Ios

References · 9

• http://support.apple.com/kb/HT3639 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1679 · Security Note
• http://vupen.com/english/advisories/2009/1621 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html · Vendor Advisory
• https://t.me/cvenotify/34420 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51212 · Note
• http://securityfocus.com/bid/35436 · Note
• http://securityfocus.com/bid/35414 · Note
• http://osvdb.org/55239 · Note