PT-2009-5587 · Apple · Iphone Mail+1

Published 2009-09-21 · Updated 2021-05-23 · CVE-2009-3273

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple iPhone OS (affected versions not specified) iPhone OS for iPod touch (affected versions not specified)

Description The issue concerns the failure to validate X.509 certificates in iPhone Mail, allowing man-in-the-middle attackers to spoof arbitrary SSL e-mail servers by using a crafted certificate.

Recommendations For Apple iPhone OS, update to a version that properly validates X.509 certificates. For iPhone OS for iPod touch, update to a version that properly validates X.509 certificates. As a temporary workaround, consider disabling SSL e-mail servers until a patch is available.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2009-3273

Affected Products

Iphone Mail

Ios

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2009-3273 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53234 · Note
• http://securityfocus.com/archive/1/506428/100/0/threaded · Note
• http://securityfocus.com/bid/36370 · Note