Sign-up

ID

VAR-200801-0013


CVE

CVE-2008-0034


TITLE

Apple iPhone Vulnerabilities that prevent authentication in passcode lock

Trust: 0.8

sources: JVNDB: JVNDB-2008-001032

DESCRIPTION

Unspecified vulnerability in Passcode Lock in Apple iPhone 1.0 through 1.1.2 allows users with physical access to execute applications without entering the passcode via vectors related to emergency calls. Attackers with physical access to the device can exploit this issue to gain unauthorized access to applications. This may aid in various attacks, including information disclosure. Versions prior to iPhone 1.1.3 and 2.1 are vulnerable. Apple iPhone is a smart phone of Apple (Apple). ---------------------------------------------------------------------- A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI has been released. The new version includes many new and advanced features, which makes it even easier to stay patched. Download and test it today: https://psi.secunia.com/ Read more about this new version: https://psi.secunia.com/?page=changelog ---------------------------------------------------------------------- TITLE: Apple iPhone / iPod touch Multiple Vulnerabilities SECUNIA ADVISORY ID: SA28497 VERIFY ADVISORY: http://secunia.com/advisories/28497/ CRITICAL: Highly critical IMPACT: Security Bypass, Cross Site Scripting, System access WHERE: >From remote OPERATING SYSTEM: Apple iPhone 1.x http://secunia.com/product/15128/ Apple iPod touch 1.x http://secunia.com/product/16074/ DESCRIPTION: Two vulnerabilities and a security issue have been reported in Apple iPhone and iPod touch, which can be exploited by malicious people to conduct cross-site scripting attacks, bypass certain security restrictions, or to compromise a vulnerable device. 1) An unspecified error in the handling of URLs exists in Safari. This can be exploited to cause a memory corruption when a user is enticed to access a specially crafted URL. Successful exploitation may allow execution of arbitrary code. This security issue is reported in iPhone v1.0 through v1.1.2 only. 3) An error in Safari can be exploited by malicious people to conduct cross-site scripting attacks. For more information see vulnerability #21 in: SA28136 SOLUTION: Update to version 1.1.3 (downloadable and installable via iTunes). PROVIDED AND/OR DISCOVERED BY: Reported by the vendor. ORIGINAL ADVISORY: Apple: http://docs.info.apple.com/article.html?artnum=307302 OTHER REFERENCES: SA28136: http://secunia.com/advisories/28136/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2008-0034 // JVNDB: JVNDB-2008-001032 // BID: 27297 // VULHUB: VHN-30159 // PACKETSTORM: 62684

AFFECTED PRODUCTS

vendor:applemodel:iphonescope:eqversion:1.0

Trust: 1.6

vendor:applemodel:iphonescope:eqversion:1.02

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:1.0.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.0.2

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.1.2

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.1.1

Trust: 1.0

vendor:applemodel:iphonescope:eqversion:1.1.2

Trust: 0.9

vendor:applemodel:iphonescope:eqversion:1.1.1

Trust: 0.9

vendor:applemodel:iphonescope:eqversion:1.0.2

Trust: 0.9

vendor:applemodel:iphonescope:eqversion:1.0.1

Trust: 0.9

vendor:applemodel:iphonescope:eqversion:v1.0 to v1.1.2 version

Trust: 0.8

vendor:applemodel:iphonescope:eqversion:2.0.2

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:2.0.1

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:2.0

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:1

Trust: 0.3

vendor:applemodel:iphonescope:neversion:1.1.3

Trust: 0.3

vendor:applemodel:iphonescope:neversion:2.1

Trust: 0.3

sources: BID: 27297 // JVNDB: JVNDB-2008-001032 // CNNVD: CNNVD-200801-209 // NVD: CVE-2008-0034

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2008-0034
value: MEDIUM

Trust: 1.0

NVD: CVE-2008-0034
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-200801-209
value: MEDIUM

Trust: 0.6

VULHUB: VHN-30159
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2008-0034
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-30159
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-30159 // JVNDB: JVNDB-2008-001032 // CNNVD: CNNVD-200801-209 // NVD: CVE-2008-0034

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-DesignError

Trust: 0.8

sources: JVNDB: JVNDB-2008-001032 // NVD: CVE-2008-0034

THREAT TYPE

local

Trust: 0.9

sources: BID: 27297 // CNNVD: CNNVD-200801-209

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-200801-209

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2008-001032

PATCH
title:iPhone v1.1.3 and iPod touch v1.1.3url:http://docs.info.apple.com/article.html?artnum=307302-en
Trust: 0.8
title:iPhone v1.1.3 and iPod touch v1.1.3url:http://docs.info.apple.com/article.html?artnum=307302-ja
Trust: 0.8
title:Apple iPhone Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=203152
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2008-001032 // 
            
            
            
            CNNVD: CNNVD-200801-209

EXTERNAL IDS
db:BIDid:27297
Trust: 2.8
db:NVDid:CVE-2008-0034
Trust: 2.8
db:SECUNIAid:28497
Trust: 2.6
db:SECTRACKid:1019219
Trust: 2.5
db:VUPENid:ADV-2008-0147
Trust: 1.7
db:XFid:39701
Trust: 0.8
db:JVNDBid:JVNDB-2008-001032
Trust: 0.8
db:CNNVDid:CNNVD-200801-209
Trust: 0.7
db:VULHUBid:VHN-30159
Trust: 0.1
db:PACKETSTORMid:62684
Trust: 0.1
sources:
            
            
            VULHUB: VHN-30159 // 
            
            
            
            BID: 27297 // 
            
            
            
            JVNDB: JVNDB-2008-001032 // 
            
            
            
            PACKETSTORM: 62684 // 
            
            
            
            CNNVD: CNNVD-200801-209 // 
            
            
            
            NVD: CVE-2008-0034

REFERENCES
url:http://www.securityfocus.com/bid/27297
Trust: 2.5
url:http://www.securitytracker.com/id?1019219
Trust: 2.5
url:http://secunia.com/advisories/28497
Trust: 2.5
url:http://docs.info.apple.com/article.html?artnum=307302
Trust: 1.8
url:http://lists.apple.com/archives/security-announce/2008/jan/msg00000.html
Trust: 1.7
url:http://www.vupen.com/english/advisories/2008/0147
Trust: 1.7
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/39701
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-0034
Trust: 0.8
url:http://www.frsirt.com/english/advisories/2008/0147
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/39701
Trust: 0.8
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-0034
Trust: 0.8
url:http://software.cisco.com/download/navigator.html?mdfid=283613663
Trust: 0.3
url:http://www.apple.com/itunes/
Trust: 0.3
url:http://forums.macrumors.com/showthread.php?t=551617
Trust: 0.3
url:http://docs.info.apple.com/article.html?artnum=307301
Trust: 0.3
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/product/15128/
Trust: 0.1
url:http://secunia.com/advisories/28497/
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
url:http://secunia.com/advisories/28136/
Trust: 0.1
url:https://psi.secunia.com/?page=changelog
Trust: 0.1
url:https://psi.secunia.com/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/product/16074/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-30159 // 
            
            
            
            BID: 27297 // 
            
            
            
            JVNDB: JVNDB-2008-001032 // 
            
            
            
            PACKETSTORM: 62684 // 
            
            
            
            CNNVD: CNNVD-200801-209 // 
            
            
            
            NVD: CVE-2008-0034

CREDITS
Apple
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200801-209

SOURCES
db:VULHUBid:VHN-30159
db:BIDid:27297
db:JVNDBid:JVNDB-2008-001032
db:PACKETSTORMid:62684
db:CNNVDid:CNNVD-200801-209
db:NVDid:CVE-2008-0034

LAST UPDATE DATE
2025-04-10T21:09:40.245000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-30159date:2017-08-08T00:00:00
db:BIDid:27297date:2008-09-12T17:20:00
db:JVNDBid:JVNDB-2008-001032date:2008-01-30T00:00:00
db:CNNVDid:CNNVD-200801-209date:2022-08-10T00:00:00
db:NVDid:CVE-2008-0034date:2025-04-09T00:30:58.490

SOURCES RELEASE DATE
db:VULHUBid:VHN-30159date:2008-01-16T00:00:00
db:BIDid:27297date:2008-01-15T00:00:00
db:JVNDBid:JVNDB-2008-001032date:2008-01-30T00:00:00
db:PACKETSTORMid:62684date:2008-01-17T04:45:41
db:CNNVDid:CNNVD-200801-209date:2008-01-15T00:00:00
db:NVDid:CVE-2008-0034date:2008-01-16T02:00:00