CVSS: 4.3EPSS: 0%CPEs: 33EXPL: 0CVE-2009-0958
https://notcve.org/view.php?id=CVE-2009-0958
Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 stores an exception for a hostname when the user accepts an untrusted Exchange server certificate, which causes it to be accepted without prompting in future usage and allows remote Exchange servers to obtain sensitive information such as credentials. Apple iPhone OS v1.0 hasta v2.2.1 e iPhone OS para iPod touch v1.1 hasta v2.2.1 guarda una excepción para un nombre de servidor (hostname) cuando el usuario acepta un certificado de servidor Exchange no confiable, provocando que sea aceptado en usos futuros sin consultar al usuario y permitiendo que servidores Exchange remotos obtengan información sensible como las credenciales de acceso. • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://osvdb.org/55236 http://support.apple.com/kb/HT3639 http://www.securityfocus.com/bid/35414 http://www.securityfocus.com/bid/35447 http://www.vupen.com/english/advisories/2009/1621 https://exchange.xforce.ibmcloud.com/vulnerabilities/51208 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 2%CPEs: 33EXPL: 0CVE-2009-1683
https://notcve.org/view.php?id=CVE-2009-1683
The Telephony component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service (device reset) via a crafted ICMP echo request, which triggers an assertion error related to a "logic issue." El componente Telephony en Apple iPhone OS v1.0 hasta v2.2.1 e iPhone OS para iPod touch v1.1 hasta v2.2.1 permite a atacantes remotos provocar una denegación de servicio (reinicializar el dispositivo) mediante una petición de eco ICMP manipulada, disparando un error de aserción relacionado con un "elemento lógico". • http://jvn.jp/en/jp/JVN87239696/index.html http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000040.html http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://support.apple.com/kb/HT3639 http://www.securityfocus.com/bid/35414 http://www.vupen.com/english/advisories/2009/1621 •
CVSS: 7.1EPSS: 1%CPEs: 33EXPL: 0CVE-2009-0959
https://notcve.org/view.php?id=CVE-2009-0959
The MPEG-4 video codec in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service (device reset) via a crafted MPEG-4 video file that triggers an "input validation issue." El codificador de vídeo MPEG-4 en Apple iPhone OS v1.0 hasta v2.2.1 e iPhone OS para iPod touch v1.1 hasta v2.2.1 permite a atacantes remotos provocar una denegación de servicio (reinicialización de dispositivo) mediante un fichero de vídeo MPEG-4 manipulado que dispara un "evento de validación de entrada". • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://osvdb.org/55237 http://support.apple.com/kb/HT3639 http://www.securityfocus.com/bid/35414 http://www.securityfocus.com/bid/35433 http://www.vupen.com/english/advisories/2009/1621 https://exchange.xforce.ibmcloud.com/vulnerabilities/51211 • CWE-20: Improper Input Validation •
CVSS: 2.1EPSS: 0%CPEs: 33EXPL: 0CVE-2009-1679
https://notcve.org/view.php?id=CVE-2009-1679
The Profiles component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1, when installing a configuration profile, can replace the password policy from Exchange ActiveSync with a weaker password policy, which allows physically proximate attackers to bypass the intended policy. El componente Profiles en Apple iPhone OS v1.0 hasta v2.2.1 e iPhone OS para iPod touch v1.1 hasta v2.2.1, cuando instalan un perfil de configuración, puede reemplazar la política de contraseña desde Exchange ActiveSync por una política de contraseña débil, permitiendo a atacantes próximos físicamente eludir la política prevista. • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://osvdb.org/55239 http://support.apple.com/kb/HT3639 http://www.securityfocus.com/bid/35414 http://www.securityfocus.com/bid/35436 http://www.vupen.com/english/advisories/2009/1621 https://exchange.xforce.ibmcloud.com/vulnerabilities/51212 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 33EXPL: 0CVE-2009-0960
https://notcve.org/view.php?id=CVE-2009-0960
The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not provide an option to disable remote image loading in HTML email, which allows remote attackers to determine the device address and when an e-mail is read via an HTML email containing an image URL. El componente Mail en iPhone OS versiones 1.0 hasta 2.2.1 y iPhone OS para iPod touch versiones 1.1 hasta 2.2.1, de Apple, no proporciona una opción para deshabilitar la carga remota de imágenes en el correo electrónico HTML, lo que permite a los atacantes remotos determinar la dirección del dispositivo y cuando se lee un correo electrónico por medio de un correo electrónico HTML que contiene una URL de imagen. • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://support.apple.com/kb/HT3639 http://www.securityfocus.com/bid/35414 http://www.securityfocus.com/bid/35434 http://www.vupen.com/english/advisories/2009/1621 https://exchange.xforce.ibmcloud.com/vulnerabilities/51209 •