PT-2012-4986 · Apple · Uikit+2

Ben Smith · Published 2012-09-20 · Updated 2017-08-29 · CVE-2012-3746

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions iOS versions prior to 6

Description The issue concerns the UIWebView component in UIKit, which fails to properly utilize the Data Protection feature. This allows attackers to access cleartext file content by directly accessing the device's filesystem.

Recommendations For versions prior to 6, update to iOS version 6 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2012-3746

Affected Products

Uikit

Uiwebview

Ios

References · 5

• http://support.apple.com/kb/HT5503 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3746 · Security Note
• http://osvdb.org/85633 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78706 · Note