PT-2009-5160 · Apple · Uikit+1

Abraham Vegh · Published 2009-09-10 · Updated 2017-08-17 · CVE-2009-2796

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple iPhone OS versions 3.0 through 3.0.1 Apple iPhone OS version 3.0 for iPod touch

Description The issue allows physically proximate attackers to discover a password by watching a user undo deletions of characters in the password, specifically affecting the UIKit component.

Recommendations For Apple iPhone OS versions 3.0 through 3.0.1, consider using a secure method to enter passwords, avoiding the undo feature for password input. For Apple iPhone OS version 3.0 for iPod touch, use an alternative, secure password entry method to minimize the risk of password discovery.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2009-2796

Affected Products

Uikit

Ios

References · 6

• http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html · Vendor Advisory
• http://support.apple.com/kb/HT3860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2796 · Security Note
• http://secunia.com/advisories/36677 · Vendor Advisory
• http://securityfocus.com/bid/36335 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53185 · Note