Sign-up

ID

VAR-201804-1172


CVE

CVE-2018-4174


TITLE

Apple iOS and macOS of Mail In the component S/MIME Vulnerable to reading encrypted messages

Trust: 0.8

sources: JVNDB: JVNDB-2018-003661

DESCRIPTION

An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. The issue involves the "Mail" component. It allows man-in-the-middle attackers to read S/MIME encrypted messages by leveraging an inconsistency in the user interface. Apple iOS and macOS are prone to multiple security vulnerabilities. An attacker can exploit these issues to perform unauthorized actions, and gain elevated privileges. Failed exploit attempts will likely cause a denial-of-service condition. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers

Trust: 1.98

sources: NVD: CVE-2018-4174 // JVNDB: JVNDB-2018-003661 // BID: 103581 // VULHUB: VHN-134205

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:ltversion:10.13.4

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:11.3

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.13.3

Trust: 0.8

vendor:applemodel:iosscope:ltversion:11.3 (ipad air or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:11.3 (iphone 5s or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:11.3 (ipod touch first 6 generation )

Trust: 0.8

vendor:applemodel:iphone osscope:eqversion:1.1.0

Trust: 0.6

vendor:applemodel:iphone osscope:eqversion:1.0.2

Trust: 0.6

vendor:applemodel:iphone osscope:eqversion:1.0.1

Trust: 0.6

vendor:applemodel:iphone osscope:eqversion:1.1.1

Trust: 0.6

vendor:applemodel:iphone osscope:eqversion:1.0.0

Trust: 0.6

vendor:applemodel:macosscope:eqversion:10.13.3

Trust: 0.3

vendor:applemodel:macosscope:eqversion:10.12.6

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:0

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:0

Trust: 0.3

vendor:applemodel:ipadscope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:50

Trust: 0.3

vendor:applemodel:iosscope:eqversion:40

Trust: 0.3

vendor:applemodel:iosscope:eqversion:30

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.10

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.2.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:11

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:10

Trust: 0.3

vendor:applemodel:macosscope:neversion:10.13.4

Trust: 0.3

vendor:applemodel:iosscope:neversion:11.3

Trust: 0.3

sources: BID: 103581 // JVNDB: JVNDB-2018-003661 // CNNVD: CNNVD-201804-140 // NVD: CVE-2018-4174

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-4174
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-4174
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201804-140
value: MEDIUM

Trust: 0.6

VULHUB: VHN-134205
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-4174
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-134205
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-4174
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.2
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-134205 // JVNDB: JVNDB-2018-003661 // CNNVD: CNNVD-201804-140 // NVD: CVE-2018-4174

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-310

Trust: 0.9

sources: VULHUB: VHN-134205 // JVNDB: JVNDB-2018-003661 // NVD: CVE-2018-4174

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201804-140

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-201804-140

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-003661

PATCH
title:HT208692url:https://support.apple.com/en-us/HT208692
Trust: 0.8
title:HT208693url:https://support.apple.com/en-us/HT208693
Trust: 0.8
title:HT208692url:https://support.apple.com/ja-jp/HT208692
Trust: 0.8
title:HT208693url:https://support.apple.com/ja-jp/HT208693
Trust: 0.8
title:Apple iOS  and macOS High Sierra Mail Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=82992
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-003661 // 
            
            
            
            CNNVD: CNNVD-201804-140

EXTERNAL IDS
db:NVDid:CVE-2018-4174
Trust: 2.8
db:BIDid:103581
Trust: 2.0
db:SECTRACKid:1040604
Trust: 1.7
db:SECTRACKid:1040608
Trust: 1.7
db:JVNid:JVNVU92378299
Trust: 0.8
db:JVNDBid:JVNDB-2018-003661
Trust: 0.8
db:CNNVDid:CNNVD-201804-140
Trust: 0.7
db:VULHUBid:VHN-134205
Trust: 0.1
sources:
            
            
            VULHUB: VHN-134205 // 
            
            
            
            BID: 103581 // 
            
            
            
            JVNDB: JVNDB-2018-003661 // 
            
            
            
            CNNVD: CNNVD-201804-140 // 
            
            
            
            NVD: CVE-2018-4174

REFERENCES
url:http://www.securityfocus.com/bid/103581
Trust: 1.7
url:https://support.apple.com/ht208692
Trust: 1.7
url:https://support.apple.com/ht208693
Trust: 1.7
url:http://www.securitytracker.com/id/1040604
Trust: 1.7
url:http://www.securitytracker.com/id/1040608
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4174
Trust: 0.8
url:http://jvn.jp/vu/jvnvu92378299/index.html
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-4174
Trust: 0.8
url:https://www.apple.com/
Trust: 0.3
url:http://www.apple.com/ios/
Trust: 0.3
url:https://support.apple.com/en-ie/ht208693
Trust: 0.3
url:https://support.apple.com/en-ie/ht208692
Trust: 0.3
sources:
            
            
            VULHUB: VHN-134205 // 
            
            
            
            BID: 103581 // 
            
            
            
            JVNDB: JVNDB-2018-003661 // 
            
            
            
            CNNVD: CNNVD-201804-140 // 
            
            
            
            NVD: CVE-2018-4174

CREDITS
Andreas Hegenberg of folivora.AI GmbH, Samuel Gro? (@5aelo), and an anonymous researcher.
Trust: 0.3
sources:
            
            
            BID: 103581

SOURCES
db:VULHUBid:VHN-134205
db:BIDid:103581
db:JVNDBid:JVNDB-2018-003661
db:CNNVDid:CNNVD-201804-140
db:NVDid:CVE-2018-4174

LAST UPDATE DATE
2024-11-23T21:10:11.547000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-134205date:2019-10-03T00:00:00
db:BIDid:103581date:2018-03-29T00:00:00
db:JVNDBid:JVNDB-2018-003661date:2018-05-31T00:00:00
db:CNNVDid:CNNVD-201804-140date:2019-10-23T00:00:00
db:NVDid:CVE-2018-4174date:2024-11-21T04:06:54.527

SOURCES RELEASE DATE
db:VULHUBid:VHN-134205date:2018-04-03T00:00:00
db:BIDid:103581date:2018-03-29T00:00:00
db:JVNDBid:JVNDB-2018-003661date:2018-05-31T00:00:00
db:CNNVDid:CNNVD-201804-140date:2018-04-03T00:00:00
db:NVDid:CVE-2018-4174date:2018-04-03T06:29:08.030