CVE-2010-3827:iphone_os: Apple iOS before 4.2 does not properly validate sig...

VRDA Feed by

Vulnerability Response Decision Assistance Feed : Information for vulnerability impact analysis

[ about VRDA Feed | JPCERT/CC ]

Vulnerability Analysis Result (Revision No : 1)

[ Download XML ]

CVE-2010-3827

iphone_os: Apple iOS before 4.2 does not properly validate sig...

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-3827

Original

Apple iOS before 4.2 does not properly validate signatures before displaying a configuration profile in the configuration installation utility, which allows remote attackers to spoof profiles via unspecified vectors.

Translation (Show)

About This Analysis Information

Analysis Information Provider:

NIST NVD

First Published:

2010-11-26

Source Information Category:

Advisory, Alert

Last Updated:

2010-11-29

Affected Product Tags

cpe:/o:apple:iphone_os:1.0.0

cpe:/o:apple:iphone_os:1.0.1

cpe:/o:apple:iphone_os:1.0.2

cpe:/o:apple:iphone_os:1.1.0

cpe:/o:apple:iphone_os:1.1.1

cpe:/o:apple:iphone_os:1.1.2

cpe:/o:apple:iphone_os:1.1.3

cpe:/o:apple:iphone_os:1.1.4

cpe:/o:apple:iphone_os:1.1.5

cpe:/o:apple:iphone_os:2.0

cpe:/o:apple:iphone_os:2.0.0

cpe:/o:apple:iphone_os:2.0.1

cpe:/o:apple:iphone_os:2.0.2

cpe:/o:apple:iphone_os:2.1

cpe:/o:apple:iphone_os:2.1.1

cpe:/o:apple:iphone_os:2.2

cpe:/o:apple:iphone_os:2.2.1

cpe:/o:apple:iphone_os:3.0

cpe:/o:apple:iphone_os:3.0.1

cpe:/o:apple:iphone_os:3.1

cpe:/o:apple:iphone_os:3.1.2

cpe:/o:apple:iphone_os:3.1.3

cpe:/o:apple:iphone_os:3.2

cpe:/o:apple:iphone_os:3.2.1

cpe:/o:apple:iphone_os:3.2.2

cpe:/o:apple:iphone_os:4.0

cpe:/o:apple:iphone_os:4.0.1

cpe:/o:apple:iphone_os:4.0.2

cpe:/o:apple:iphone_os:4.1 and previous versions

Vulnerability Analysis Results

[Access Vector] ^[?]

Undefined^[?]

Local^[?]

Adjacent Network^[?]

Network^[?]

[Access Complexit] ^[?]

Undefined^[?]

High^[?]

Medium^[?]

Low^[?]

[Authentication] ^[?]

Undefined^[?]

Multiple^[?]

Single^[?]

None^[?]

[Confidentiality Impact] ^[?]

Undefined^[?]

None^[?]

Partial^[?]

Complete^[?]

[Integrity Impact] ^[?]

Undefined^[?]

None^[?]

Partial^[?]

Complete^[?]

[Availability Impact] ^[?]

Undefined^[?]

None^[?]

Partial^[?]

Complete^[?]

Alternatives

References

APPLE APPLE-SA-2010-11-22-1

CONFIRM http://support.apple.com/kb/HT4456

Vulnerability Type Input Validation (CWE-20)