Sign-up

ID

VAR-201804-1170


CVE

CVE-2018-4172


TITLE

Apple iOS of "iPhone Find " In the component iCloud Vulnerabilities that bypass password requests

Trust: 0.8

sources: JVNDB: JVNDB-2018-003660

DESCRIPTION

An issue was discovered in certain Apple products. iOS before 11.3 is affected. The issue involves the "Find My iPhone" component. It allows physically proximate attackers to bypass the iCloud password requirement for disabling the "Find My iPhone" feature via vectors involving a backup restore. Apple iOS is prone to multiple security vulnerabilities. Attackers can exploit these issues to execute arbitrary code, gain sensitive information, bypass security mechanisms, and conduct spoofing attacks and perform unauthorized actions. Failed exploits will result in denial-of-service condition. Versions prior to Apple iOS 11.3 are vulnerable. Find My iPhone is one of the components that provides the function of recovering an accidentally lost iPhone

Trust: 1.98

sources: NVD: CVE-2018-4172 // JVNDB: JVNDB-2018-003660 // BID: 103578 // VULHUB: VHN-134203

AFFECTED PRODUCTS

vendor:applemodel:iphone osscope:ltversion:11.3

Trust: 1.0

vendor:applemodel:iosscope:ltversion:11.3 (ipad air or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:11.3 (iphone 5s or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:11.3 (ipod touch first 6 generation )

Trust: 0.8

vendor:applemodel:iphone osscope:eqversion:1.1.0

Trust: 0.6

vendor:applemodel:iphone osscope:eqversion:1.0.2

Trust: 0.6

vendor:applemodel:iphone osscope:eqversion:1.0.1

Trust: 0.6

vendor:applemodel:iphone osscope:eqversion:1.1.1

Trust: 0.6

vendor:applemodel:iphone osscope:eqversion:1.0.0

Trust: 0.6

vendor:applemodel:ipod touchscope:eqversion:0

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:0

Trust: 0.3

vendor:applemodel:ipad airscope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:50

Trust: 0.3

vendor:applemodel:iosscope:eqversion:40

Trust: 0.3

vendor:applemodel:iosscope:eqversion:30

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.10

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.2.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10

Trust: 0.3

vendor:applemodel:iosscope:neversion:11.3

Trust: 0.3

sources: BID: 103578 // JVNDB: JVNDB-2018-003660 // CNNVD: CNNVD-201804-141 // NVD: CVE-2018-4172

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-4172
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-4172
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201804-141
value: MEDIUM

Trust: 0.6

VULHUB: VHN-134203
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2018-4172
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:N/I:N/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-134203
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:N/I:N/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-4172
baseSeverity: MEDIUM
baseScore: 4.6
vectorString: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 0.9
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-134203 // JVNDB: JVNDB-2018-003660 // CNNVD: CNNVD-201804-141 // NVD: CVE-2018-4172

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-254

Trust: 0.9

sources: VULHUB: VHN-134203 // JVNDB: JVNDB-2018-003660 // NVD: CVE-2018-4172

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201804-141

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201804-141

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-003660

PATCH
title:HT208693url:https://support.apple.com/en-us/HT208693
Trust: 0.8
title:HT208693url:https://support.apple.com/ja-jp/HT208693
Trust: 0.8
title:Apple iOS Find My iPhone Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=82993
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-003660 // 
            
            
            
            CNNVD: CNNVD-201804-141

EXTERNAL IDS
db:NVDid:CVE-2018-4172
Trust: 2.8
db:BIDid:103578
Trust: 2.0
db:SECTRACKid:1040604
Trust: 1.7
db:JVNid:JVNVU92378299
Trust: 0.8
db:JVNDBid:JVNDB-2018-003660
Trust: 0.8
db:CNNVDid:CNNVD-201804-141
Trust: 0.7
db:VULHUBid:VHN-134203
Trust: 0.1
sources:
            
            
            VULHUB: VHN-134203 // 
            
            
            
            BID: 103578 // 
            
            
            
            JVNDB: JVNDB-2018-003660 // 
            
            
            
            CNNVD: CNNVD-201804-141 // 
            
            
            
            NVD: CVE-2018-4172

REFERENCES
url:http://www.securityfocus.com/bid/103578
Trust: 1.7
url:https://support.apple.com/ht208693
Trust: 1.7
url:http://www.securitytracker.com/id/1040604
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4172
Trust: 0.8
url:http://jvn.jp/vu/jvnvu92378299/index.html
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-4172
Trust: 0.8
url:https://www.apple.com/
Trust: 0.3
url:http://www.apple.com/ios/
Trust: 0.3
url:https://support.apple.com/en-ie/ht208693
Trust: 0.3
sources:
            
            
            VULHUB: VHN-134203 // 
            
            
            
            BID: 103578 // 
            
            
            
            JVNDB: JVNDB-2018-003660 // 
            
            
            
            CNNVD: CNNVD-201804-141 // 
            
            
            
            NVD: CVE-2018-4172

CREDITS
Ben Compton and Jason Colley of Cerner Corporation, Zaheen Hafzar M M (@zaheenhafzer), xisigr of Tencent's Xuanwu Lab (tencent.com), Zhiyang Zeng (@Wester) of Tencent Security Platform Department, @mjonsson, Arjan van der Oest of Voiceworks BV, Nico Golde
Trust: 0.3
sources:
            
            
            BID: 103578

SOURCES
db:VULHUBid:VHN-134203
db:BIDid:103578
db:JVNDBid:JVNDB-2018-003660
db:CNNVDid:CNNVD-201804-141
db:NVDid:CVE-2018-4172

LAST UPDATE DATE
2024-11-23T20:43:12.488000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-134203date:2019-10-03T00:00:00
db:BIDid:103578date:2018-03-29T00:00:00
db:JVNDBid:JVNDB-2018-003660date:2018-05-31T00:00:00
db:CNNVDid:CNNVD-201804-141date:2019-10-23T00:00:00
db:NVDid:CVE-2018-4172date:2024-11-21T04:06:54.317

SOURCES RELEASE DATE
db:VULHUBid:VHN-134203date:2018-04-03T00:00:00
db:BIDid:103578date:2018-03-29T00:00:00
db:JVNDBid:JVNDB-2018-003660date:2018-05-31T00:00:00
db:CNNVDid:CNNVD-201804-141date:2018-04-03T00:00:00
db:NVDid:CVE-2018-4172date:2018-04-03T06:29:07.967