Sign-up

ID

VAR-201011-0049


CVE

CVE-2010-3827


TITLE

Apple iOS Vulnerabilities that are spoofed profiles

Trust: 0.8

sources: JVNDB: JVNDB-2010-002518

DESCRIPTION

Apple iOS before 4.2 does not properly validate signatures before displaying a configuration profile in the configuration installation utility, which allows remote attackers to spoof profiles via unspecified vectors. Apple iOS for iPhone, iPod touch, and iPad are prone to a security-bypass vulnerability that affects the Configuration Profiles component. An attacker can exploit this issue to bypass the signature-validation mechanism. Successful exploits will allow an attacker to mislead an unsuspecting victim. Apple iOS is the most advanced mobile operating system from Apple. ---------------------------------------------------------------------- Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). Request a free trial: http://secunia.com/products/corporate/vim/ ---------------------------------------------------------------------- TITLE: Apple iOS Multiple Vulnerabilities SECUNIA ADVISORY ID: SA42314 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/42314/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=42314 RELEASE DATE: 2010-11-24 DISCUSS ADVISORY: http://secunia.com/advisories/42314/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/42314/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=42314 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple vulnerabilities have been reported in Apple iOS, which can be exploited by malicious people to conduct cross-site scripting and spoofing attacks, disclose sensitive information, bypass certain security restrictions, or to compromise a user's system. For more information: SA40257 SA41328 SA42151 SA42312 SOLUTION: Upgrade to iOS 4.2 (downloadable and installable via iTunes). ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT4456 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2010-3827 // JVNDB: JVNDB-2010-002518 // BID: 45006 // VULHUB: VHN-46432 // PACKETSTORM: 96086

AFFECTED PRODUCTS

vendor:applemodel:iphone osscope:eqversion:3.2.1

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:4.0

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:4.0.1

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:4.0.2

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:3.1.3

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:3.2.2

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:3.2

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:2.0

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:3.1.2

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:1.0.0

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:2.2.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:2.2

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:2.0.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.1.3

Trust: 1.0

vendor:applemodel:iphone osscope:lteversion:4.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:2.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.0.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:2.0.2

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.1.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:3.0

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.1.4

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:3.0.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.1.5

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:2.1.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:3.1

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.1.0

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.0.2

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:1.1.2

Trust: 1.0

vendor:applemodel:iphone osscope:eqversion:2.0.0

Trust: 1.0

vendor:applemodel:iosscope:eqversion:2.0 to 4.1 (iphone 3g after )

Trust: 0.8

vendor:applemodel:iosscope:eqversion:2.1 to 4.1 (ipod touch (2nd generation) after )

Trust: 0.8

vendor:applemodel:iosscope:eqversion:3.2 to 3.2.2 (ipad for )

Trust: 0.8

vendor:applemodel:ipadscope: - version: -

Trust: 0.8

vendor:applemodel:iphonescope: - version: -

Trust: 0.8

vendor:applemodel:ipod touchscope: - version: -

Trust: 0.8

vendor:applemodel:iphone osscope:eqversion:4.1

Trust: 0.6

vendor:applemodel:iosscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:2.0.2

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:2.1

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:3.1.2

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:2.0

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:3.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:2.2

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:2.0.2

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:3.0

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:3.0.1

Trust: 0.3

vendor:applemodel:iphone ipodtouchscope:eqversion:4.0.1-

Trust: 0.3

vendor:applemodel:ipadscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:3.1.2

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:2.2.1

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:0

Trust: 0.3

vendor:applemodel:ipadscope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:2.0.1

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:2.2.1

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:3.1.3

Trust: 0.3

vendor:applemodel:ipadscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iosscope:neversion:4.2

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:2.0.1

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.2

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:3.1.3

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:iphone iphonescope:eqversion:4.0.1-

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:2.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:4.1

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:3.0

Trust: 0.3

sources: BID: 45006 // JVNDB: JVNDB-2010-002518 // CNNVD: CNNVD-201011-255 // NVD: CVE-2010-3827

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2010-3827
value: MEDIUM

Trust: 1.0

NVD: CVE-2010-3827
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201011-255
value: MEDIUM

Trust: 0.6

VULHUB: VHN-46432
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2010-3827
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-46432
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-46432 // JVNDB: JVNDB-2010-002518 // CNNVD: CNNVD-201011-255 // NVD: CVE-2010-3827

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-46432 // JVNDB: JVNDB-2010-002518 // NVD: CVE-2010-3827

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201011-255

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201011-255

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2010-002518

PATCH
title:HT4456url:http://support.apple.com/kb/HT4456
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2010-002518

EXTERNAL IDS
db:NVDid:CVE-2010-3827
Trust: 2.8
db:SECUNIAid:42314
Trust: 2.0
db:VUPENid:ADV-2010-3046
Trust: 1.9
db:SECTRACKid:1024768
Trust: 1.9
db:XFid:63416
Trust: 0.8
db:JVNDBid:JVNDB-2010-002518
Trust: 0.8
db:CNNVDid:CNNVD-201011-255
Trust: 0.7
db:APPLEid:APPLE-SA-2010-11-22-1
Trust: 0.6
db:BIDid:45006
Trust: 0.4
db:VULHUBid:VHN-46432
Trust: 0.1
db:PACKETSTORMid:96086
Trust: 0.1
sources:
            
            
            VULHUB: VHN-46432 // 
            
            
            
            BID: 45006 // 
            
            
            
            JVNDB: JVNDB-2010-002518 // 
            
            
            
            PACKETSTORM: 96086 // 
            
            
            
            CNNVD: CNNVD-201011-255 // 
            
            
            
            NVD: CVE-2010-3827

REFERENCES
url:http://www.securitytracker.com/id?1024768
Trust: 1.9
url:http://secunia.com/advisories/42314
Trust: 1.9
url:http://www.vupen.com/english/advisories/2010/3046
Trust: 1.9
url:http://support.apple.com/kb/ht4456
Trust: 1.8
url:http://lists.apple.com/archives/security-announce/2010//nov/msg00003.html
Trust: 1.7
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/63416
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-3827
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/63416
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-3827
Trust: 0.8
url:http://www.apple.com
Trust: 0.3
url:http://secunia.com/products/corporate/evm/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/advisories/42314/
Trust: 0.1
url:http://secunia.com/products/corporate/vim/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/42314/#comments
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=42314
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-46432 // 
            
            
            
            BID: 45006 // 
            
            
            
            JVNDB: JVNDB-2010-002518 // 
            
            
            
            PACKETSTORM: 96086 // 
            
            
            
            CNNVD: CNNVD-201011-255 // 
            
            
            
            NVD: CVE-2010-3827

CREDITS
Barry Simpson of Bomgar Corporation
Trust: 0.3
sources:
            
            
            BID: 45006

SOURCES
db:VULHUBid:VHN-46432
db:BIDid:45006
db:JVNDBid:JVNDB-2010-002518
db:PACKETSTORMid:96086
db:CNNVDid:CNNVD-201011-255
db:NVDid:CVE-2010-3827

LAST UPDATE DATE
2025-04-11T21:33:54.735000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-46432date:2017-08-17T00:00:00
db:BIDid:45006date:2010-11-22T00:00:00
db:JVNDBid:JVNDB-2010-002518date:2010-12-20T00:00:00
db:CNNVDid:CNNVD-201011-255date:2010-11-30T00:00:00
db:NVDid:CVE-2010-3827date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:VULHUBid:VHN-46432date:2010-11-26T00:00:00
db:BIDid:45006date:2010-11-22T00:00:00
db:JVNDBid:JVNDB-2010-002518date:2010-12-20T00:00:00
db:PACKETSTORMid:96086date:2010-11-24T11:53:31
db:CNNVDid:CNNVD-201011-255date:2010-11-30T00:00:00
db:NVDid:CVE-2010-3827date:2010-11-26T20:00:02.970