CVE-2010-3831:iphone_os: Photos in Apple iOS before 4.2 enables support for ...

VRDA Feed by

Vulnerability Response Decision Assistance Feed : Information for vulnerability impact analysis

[ about VRDA Feed | JPCERT/CC ]

Vulnerability Analysis Result (Revision No : 1)

[ Download XML ]

CVE-2010-3831

iphone_os: Photos in Apple iOS before 4.2 enables support for ...

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-3831

Original

Photos in Apple iOS before 4.2 enables support for HTTP Basic Authentication over an unencrypted connection, which allows man-in-the-middle attackers to read MobileMe account passwords by spoofing a MobileMe Gallery server during a "Send to MobileMe" action.

Translation (Show)

About This Analysis Information

Analysis Information Provider:

NIST NVD

First Published:

2010-11-26

Source Information Category:

Advisory, Alert

Last Updated:

2010-11-29

Affected Product Tags

cpe:/o:apple:iphone_os:1.0.0

cpe:/o:apple:iphone_os:1.0.1

cpe:/o:apple:iphone_os:1.0.2

cpe:/o:apple:iphone_os:1.1.0

cpe:/o:apple:iphone_os:1.1.1

cpe:/o:apple:iphone_os:1.1.2

cpe:/o:apple:iphone_os:1.1.3

cpe:/o:apple:iphone_os:1.1.4

cpe:/o:apple:iphone_os:1.1.5

cpe:/o:apple:iphone_os:2.0

cpe:/o:apple:iphone_os:2.0.0

cpe:/o:apple:iphone_os:2.0.1

cpe:/o:apple:iphone_os:2.0.2

cpe:/o:apple:iphone_os:2.1

cpe:/o:apple:iphone_os:2.1.1

cpe:/o:apple:iphone_os:2.2

cpe:/o:apple:iphone_os:2.2.1

cpe:/o:apple:iphone_os:3.0

cpe:/o:apple:iphone_os:3.0.1

cpe:/o:apple:iphone_os:3.1

cpe:/o:apple:iphone_os:3.1.2

cpe:/o:apple:iphone_os:3.1.3

cpe:/o:apple:iphone_os:3.2

cpe:/o:apple:iphone_os:3.2.1

cpe:/o:apple:iphone_os:3.2.2

cpe:/o:apple:iphone_os:4.0

cpe:/o:apple:iphone_os:4.0.1

cpe:/o:apple:iphone_os:4.0.2

cpe:/o:apple:iphone_os:4.1 and previous versions

Vulnerability Analysis Results

[Access Vector] ^[?]

Undefined^[?]

Local^[?]

Adjacent Network^[?]

Network^[?]

[Access Complexit] ^[?]

Undefined^[?]

High^[?]

Medium^[?]

Low^[?]

[Authentication] ^[?]

Undefined^[?]

Multiple^[?]

Single^[?]

None^[?]

[Confidentiality Impact] ^[?]

Undefined^[?]

None^[?]

Partial^[?]

Complete^[?]

[Integrity Impact] ^[?]

Undefined^[?]

None^[?]

Partial^[?]

Complete^[?]

[Availability Impact] ^[?]

Undefined^[?]

None^[?]

Partial^[?]

Complete^[?]

Alternatives

References

APPLE APPLE-SA-2010-11-22-1

CONFIRM http://support.apple.com/kb/HT4456

Vulnerability Type Information Leak / Disclosure (CWE-200)