PT-2017-3077 · Apple+1 · Ios+1

Ilya Nesterov + 1 · Published 2017-09-19 · Updated 2017-10-26 · CVE-2017-7088

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions iOS versions prior to 11

Description The issue involves the Exchange ActiveSync component and allows remote attackers to erase a device by hijacking a cleartext AutoDiscover V1 session during the setup of an Exchange account. This occurs due to improper permission handling when setting up an account, which can be exploited by a remote attacker to delete data on the device.

Recommendations For iOS versions prior to 11, consider disabling the Exchange ActiveSync component until a fix is available to prevent remote attackers from exploiting this issue. Restrict access to the AutoDiscover V1 session to minimize the risk of exploitation. Avoid using the Exchange ActiveSync component for setting up Exchange accounts until the issue is resolved.

Fix

Weakness Enumeration

CWE-275

Related Identifiers

BDU:2017-02447

CVE-2017-7088

Affected Products

Exchange Activesync

Ios

References · 6

• https://support.apple.com/HT208112 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02447 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-7088 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7088 · Vendor Advisory
• http://securitytracker.com/id/1039385 · Note
• http://securityfocus.com/bid/100892 · Note