var-200906-0082
Vulnerability from variot
The Profiles component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1, when installing a configuration profile, can replace the password policy from Exchange ActiveSync with a weaker password policy, which allows physically proximate attackers to bypass the intended policy. Apple iPhone and iPod touch are prone to multiple vulnerabilities. Successfully exploiting these issues may allow attackers to bypass security restrictions, obtain sensitive information, or cause denial-of-service conditions. These issues affect the following: iPhone OS 1.0 through 2.2.1 iPhone OS for iPod touch 1.1 through 2.2.1 This BID is being retired. The following individual records have been created to better document these issues: 35433 Apple iPhone and iPod touch MPEG-4 Video Codec Denial of Service Vulnerability 35434 Apple iPhone and iPod touch Mail Client Information Disclosure Weakness 35436 Apple iPhone and iPod touch Configuration Profile Handling Information Disclosure Vulnerability 35425 Apple iPhone Call Approval Dialog Security Bypass Vulnerability 35445 Apple iPhone and iPod touch ICMP Echo Request Remote Denial of Service Vulnerability 35446 Apple iPhone and iPod touch HTMLSelectElement Denial of Service Vulnerability 35447 Apple iPhone and iPod touch Untrusted Certificate Exception Information Disclosure Vulnerability 35448 Apple iPhone and iPod touch Safari Search History Information Disclosure Vulnerability
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-200906-0082", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "iphone os", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "2.0.1" }, { "model": "iphone os", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "1.1.5" }, { "model": "iphone os", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "2.2" }, { "model": "iphone os", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "1.1.3" }, { "model": "iphone os", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "2.0.2" }, { "model": "iphone os", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "2.1" }, { "model": "iphone os", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "2.0" }, { "model": "iphone os", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "2.1.1" }, { "model": "iphone os", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "1.1.4" }, { "model": "iphone os", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "2.0.0" }, { "model": "iphone os", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "1.1.0" }, { "model": "iphone os", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "1.0.0" }, { "model": "iphone os", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "1.1.1" }, { "model": "ipod touch", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "*" }, { "model": "iphone os", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "2.2.1" }, { "model": "iphone os", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "1.0.2" }, { "model": "iphone os", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "1.1.2" }, { "model": "iphone os", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "*" }, { "model": "iphone os", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "1.0.1" }, { "model": "ios", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "1.0 to 2.2.1" }, { "model": "ios for ipod touch", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "1.1 to 2.2.1" }, { "model": "ipod touch", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "2.2.1" }, { "model": "ipod touch", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "2.0.2" }, { "model": "ipod touch", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "2.0.1" }, { "model": "ipod touch", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "1.1.4" }, { "model": "ipod touch", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "1.1.3" }, { "model": "ipod touch", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "1.1.2" }, { "model": "ipod touch", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "1.1.1" }, { "model": "ipod touch", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "2.2" }, { "model": "ipod touch", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "2.1" }, { "model": "ipod touch", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "2.0" }, { "model": "ipod touch", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "1.1" }, { "model": "iphone", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "2.2.1" }, { "model": "iphone", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "2.0.2" }, { "model": "iphone", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "2.0.1" }, { "model": "iphone", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "1.1.4" }, { "model": "iphone", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "1.1.3" }, { "model": "iphone", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "1.1.2" }, { "model": "iphone", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "1.1.1" }, { "model": "iphone", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "1.0.2" }, { "model": "iphone", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "1.0.1" }, { "model": "iphone", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "2.2" }, { "model": "iphone", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "2.1" }, { "model": "iphone", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "2.0" }, { "model": "iphone", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "1.1" }, { "model": "iphone", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "1" }, { "model": "iphone", "scope": "eq", "trust": 0.6, "vendor": "apple", "version": "0" }, { "model": "ipod touch", "scope": "ne", "trust": 0.6, "vendor": "apple", "version": "3.0" }, { "model": "iphone", "scope": "ne", "trust": 0.6, "vendor": "apple", "version": "3.0" }, { "model": "ipod touch", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "0" } ], "sources": [ { "db": "BID", "id": "35414" }, { "db": "BID", "id": "35436" }, { "db": "JVNDB", "id": "JVNDB-2009-001851" }, { "db": "CNNVD", "id": "CNNVD-200906-314" }, { "db": "NVD", "id": "CVE-2009-1679" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/o:apple:iphone_os", "vulnerable": true }, { "cpe22Uri": "cpe:/o:apple:iphone_os_for_ipod_touch", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2009-001851" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Oskar Lissheim-BoethiusOliver QuasChristian Schmitz", "sources": [ { "db": "CNNVD", "id": "CNNVD-200906-314" } ], "trust": 0.6 }, "cve": "CVE-2009-1679", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "NONE", "exploitabilityScore": 3.9, "id": "CVE-2009-1679", "impactScore": 2.9, "integrityImpact": "PARTIAL", "severity": "LOW", "trust": 1.0, "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Medium", "accessVector": "Local", "authentication": "None", "author": "NVD", "availabilityImpact": "Complete", "baseScore": 6.9, "confidentialityImpact": "Complete", "exploitabilityScore": null, "id": "CVE-2009-1679", "impactScore": null, "integrityImpact": "Complete", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "NONE", "exploitabilityScore": 3.9, "id": "VHN-39125", "impactScore": 2.9, "integrityImpact": "PARTIAL", "severity": "LOW", "trust": 0.1, "vectorString": "AV:L/AC:L/AU:N/C:N/I:P/A:N", "version": "2.0" } ], "cvssV3": [], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2009-1679", "trust": 1.0, "value": "LOW" }, { "author": "NVD", "id": "CVE-2009-1679", "trust": 0.8, "value": "Medium" }, { "author": "CNNVD", "id": "CNNVD-200906-314", "trust": 0.6, "value": "LOW" }, { "author": "VULHUB", "id": "VHN-39125", "trust": 0.1, "value": "LOW" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-39125" }, { "db": "JVNDB", "id": "JVNDB-2009-001851" }, { "db": "CNNVD", "id": "CNNVD-200906-314" }, { "db": "NVD", "id": "CVE-2009-1679" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "The Profiles component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1, when installing a configuration profile, can replace the password policy from Exchange ActiveSync with a weaker password policy, which allows physically proximate attackers to bypass the intended policy. Apple iPhone and iPod touch are prone to multiple vulnerabilities. \nSuccessfully exploiting these issues may allow attackers to bypass security restrictions, obtain sensitive information, or cause denial-of-service conditions. \nThese issues affect the following:\niPhone OS 1.0 through 2.2.1\niPhone OS for iPod touch 1.1 through 2.2.1\nThis BID is being retired. The following individual records have been created to better document these issues:\n35433 Apple iPhone and iPod touch MPEG-4 Video Codec Denial of Service Vulnerability\n35434 Apple iPhone and iPod touch Mail Client Information Disclosure Weakness\n35436 Apple iPhone and iPod touch Configuration Profile Handling Information Disclosure Vulnerability\n35425 Apple iPhone Call Approval Dialog Security Bypass Vulnerability\n35445 Apple iPhone and iPod touch ICMP Echo Request Remote Denial of Service Vulnerability\n35446 Apple iPhone and iPod touch HTMLSelectElement Denial of Service Vulnerability\n35447 Apple iPhone and iPod touch Untrusted Certificate Exception Information Disclosure Vulnerability\n35448 Apple iPhone and iPod touch Safari Search History Information Disclosure Vulnerability", "sources": [ { "db": "NVD", "id": "CVE-2009-1679" }, { "db": "JVNDB", "id": "JVNDB-2009-001851" }, { "db": "BID", "id": "35414" }, { "db": "BID", "id": "35436" }, { "db": "VULHUB", "id": "VHN-39125" } ], "trust": 2.25 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "BID", "id": "35436", "trust": 2.8 }, { "db": "NVD", "id": "CVE-2009-1679", "trust": 2.8 }, { "db": "OSVDB", "id": "55239", "trust": 2.5 }, { "db": "VUPEN", "id": "ADV-2009-1621", "trust": 2.5 }, { "db": "BID", "id": "35414", "trust": 2.0 }, { "db": "XF", "id": "51212", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2009-001851", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-200906-314", "trust": 0.6 }, { "db": "VULHUB", "id": "VHN-39125", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-39125" }, { "db": "BID", "id": "35414" }, { "db": "BID", "id": "35436" }, { "db": "JVNDB", "id": "JVNDB-2009-001851" }, { "db": "CNNVD", "id": "CNNVD-200906-314" }, { "db": "NVD", "id": "CVE-2009-1679" } ] }, "id": "VAR-200906-0082", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-39125" } ], "trust": 0.01 }, "last_update_date": "2024-11-23T20:24:53.740000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "HT3639", "trust": 0.8, "url": "http://support.apple.com/kb/HT3639" }, { "title": "HT3639", "trust": 0.8, "url": "http://support.apple.com/kb/HT3639?viewlocale=ja_JP" }, { "title": "Apple iPhone Fixes for permissions and access control issues vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=203141" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2009-001851" }, { "db": "CNNVD", "id": "CNNVD-200906-314" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-264", "trust": 1.1 }, { "problemtype": "CWE-255", "trust": 0.8 } ], "sources": [ { "db": "VULHUB", "id": "VHN-39125" }, { "db": "JVNDB", "id": "JVNDB-2009-001851" }, { "db": "NVD", "id": "CVE-2009-1679" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.5, "url": "http://www.securityfocus.com/bid/35436" }, { "trust": 2.5, "url": "http://osvdb.org/55239" }, { "trust": 2.5, "url": "http://www.vupen.com/english/advisories/2009/1621" }, { "trust": 2.0, "url": "http://support.apple.com/kb/ht3639" }, { "trust": 1.7, "url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00005.html" }, { "trust": 1.7, "url": "http://www.securityfocus.com/bid/35414" }, { "trust": 1.7, "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/51212" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-1679" }, { "trust": 0.8, "url": "http://xforce.iss.net/xforce/xfdb/51212" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-1679" }, { "trust": 0.6, "url": "http://www.apple.com/iphone/" }, { "trust": 0.6, "url": "http://www.apple.com/ipodtouch/" } ], "sources": [ { "db": "VULHUB", "id": "VHN-39125" }, { "db": "BID", "id": "35414" }, { "db": "BID", "id": "35436" }, { "db": "JVNDB", "id": "JVNDB-2009-001851" }, { "db": "CNNVD", "id": "CNNVD-200906-314" }, { "db": "NVD", "id": "CVE-2009-1679" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-39125" }, { "db": "BID", "id": "35414" }, { "db": "BID", "id": "35436" }, { "db": "JVNDB", "id": "JVNDB-2009-001851" }, { "db": "CNNVD", "id": "CNNVD-200906-314" }, { "db": "NVD", "id": "CVE-2009-1679" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2009-06-19T00:00:00", "db": "VULHUB", "id": "VHN-39125" }, { "date": "2009-06-17T00:00:00", "db": "BID", "id": "35414" }, { "date": "2009-06-17T00:00:00", "db": "BID", "id": "35436" }, { "date": "2009-08-06T00:00:00", "db": "JVNDB", "id": "JVNDB-2009-001851" }, { "date": "2009-06-19T00:00:00", "db": "CNNVD", "id": "CNNVD-200906-314" }, { "date": "2009-06-19T16:30:00.327000", "db": "NVD", "id": "CVE-2009-1679" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2017-08-17T00:00:00", "db": "VULHUB", "id": "VHN-39125" }, { "date": "2009-06-19T23:09:00", "db": "BID", "id": "35414" }, { "date": "2009-06-19T16:19:00", "db": "BID", "id": "35436" }, { "date": "2009-08-06T00:00:00", "db": "JVNDB", "id": "JVNDB-2009-001851" }, { "date": "2022-08-10T00:00:00", "db": "CNNVD", "id": "CNNVD-200906-314" }, { "date": "2024-11-21T01:03:03.857000", "db": "NVD", "id": "CVE-2009-1679" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "local", "sources": [ { "db": "BID", "id": "35436" }, { "db": "CNNVD", "id": "CNNVD-200906-314" } ], "trust": 0.9 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Apple iPhone OS Vulnerability that bypasses policies in profile components", "sources": [ { "db": "JVNDB", "id": "JVNDB-2009-001851" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "permissions and access control issues", "sources": [ { "db": "CNNVD", "id": "CNNVD-200906-314" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.