PT-2013-5098 · Apple · Ios

Andreas Kurtz + 1 · Published 2013-06-18 · Updated 2013-10-25 · CVE-2013-4616

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:A/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 7

Description The issue concerns the generation of default Wi-Fi passwords in Apple iOS. Specifically, the WifiPasswordController generateDefaultPassword method relies on the UITextChecker suggestWordInLanguage method for selecting Wi-Fi hotspot WPA2 PSK passphrases. This approach results in an insufficient number of possible passphrases, making it easier for remote attackers to obtain access via a brute-force attack.

Recommendations For Apple iOS versions prior to 7, consider changing the default Wi-Fi password to a stronger, manually generated passphrase to minimize the risk of exploitation. As a temporary workaround, restrict access to sensitive data and networks until a secure password can be set.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2013-4616

Affected Products

Ios

References · 8

• http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4616 · Security Note
• http://secunia.com/advisories/54886 · Vendor Advisory
• http://www1.cs.fau.de/filepool/projects/hotspot/hotspot.pdf · Note
• http://support.apple.com/kb/HT5934 · Note
• http://securitytracker.com/id/1029054 · Note
• http://www1.cs.fau.de/hotspot · Note
• http://lists.owasp.org/pipermail/owasp-mobile-security-project/2013-June/000640.html · Note