PT-2017-15406 · Apple · Pages+2

Philipp Eckel · Published 2017-04-02 · Updated 2017-07-12 · CVE-2017-2391

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pages versions prior to 6.1 on macOS Pages versions prior to 3.1 on iOS Numbers versions prior to 4.1 on macOS Numbers versions prior to 3.1 on iOS Keynote versions prior to 7.1 on macOS Keynote versions prior to 3.1 on iOS

Description The issue involves the "Export" component and allows users to bypass iWork PDF password protection. This is achieved by leveraging the use of 40-bit RC4, which is considered insecure.

Recommendations For Pages on macOS, update to version 6.1 or later. For Pages on iOS, update to version 3.1 or later. For Numbers on macOS, update to version 4.1 or later. For Numbers on iOS, update to version 3.1 or later. For Keynote on macOS, update to version 7.1 or later. For Keynote on iOS, update to version 3.1 or later.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2017-2391

Affected Products

Keynote

Numbers

Pages

References · 7

• https://support.apple.com/HT207595 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2391 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2391 · Vendor Advisory
• http://securitytracker.com/id/1038136 · Note
• http://securitytracker.com/id/1038135 · Note
• http://securityfocus.com/bid/97126 · Note
• http://securitytracker.com/id/1038134 · Note