CVE-2009-2796 - Vulnerability Details - OpenCVE

The UIKit component in Apple iPhone OS 3.0, and iPhone OS 3.0.1 for iPod touch, allows physically proximate attackers to discover a password by watching a user undo deletions of characters in the password.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Apple	Iphone Os

Configuration 1 [-]

OR	cpe:2.3:o:apple:iphone_os:3.0:::::::*
	cpe:2.3:o:apple:iphone_os:3.0.1:::::::*

No data.

References

Link	Providers
http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html
http://secunia.com/advisories/36677
http://support.apple.com/kb/HT3860
http://www.securityfocus.com/bid/36335
https://exchange.xforce.ibmcloud.com/vulnerabilities/53185

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-09-10T21:00:00

Updated: 2024-08-07T06:07:35.921Z

Reserved: 2009-08-17T00:00:00

Link: CVE-2009-2796

Vulnrichment

No data.

NVD

Status : Modified

Published: 2009-09-10T21:30:01.203

Modified: 2024-11-21T01:05:45.340

Link: CVE-2009-2796

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2009-09-09T00:00:00", "descriptions": [{"lang": "en", "value": "The UIKit component in Apple iPhone OS 3.0, and iPhone OS 3.0.1 for iPod touch, allows physically proximate attackers to discover a password by watching a user undo deletions of characters in the password."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "ipod-iphone-password-info-disclosure(53185)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53185"}, {"name": "36335", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/36335"}, {"name": "APPLE-SA-2009-09-09-1", "tags": ["vendor-advisory", "x_refsource_APPLE"], "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html"}, {"name": "36677", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/36677"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://support.apple.com/kb/HT3860"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-2796", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The UIKit component in Apple iPhone OS 3.0, and iPhone OS 3.0.1 for iPod touch, allows physically proximate attackers to discover a password by watching a user undo deletions of characters in the password."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "ipod-iphone-password-info-disclosure(53185)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53185"}, {"name": "36335", "refsource": "BID", "url": "http://www.securityfocus.com/bid/36335"}, {"name": "APPLE-SA-2009-09-09-1", "refsource": "APPLE", "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html"}, {"name": "36677", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/36677"}, {"name": "http://support.apple.com/kb/HT3860", "refsource": "CONFIRM", "url": "http://support.apple.com/kb/HT3860"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T06:07:35.921Z"}, "title": "CVE Program Container", "references": [{"name": "ipod-iphone-password-info-disclosure(53185)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53185"}, {"name": "36335", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/36335"}, {"name": "APPLE-SA-2009-09-09-1", "tags": ["vendor-advisory", "x_refsource_APPLE", "x_transferred"], "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html"}, {"name": "36677", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/36677"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://support.apple.com/kb/HT3860"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-2796", "datePublished": "2009-09-10T21:00:00", "dateReserved": "2009-08-17T00:00:00", "dateUpdated": "2024-08-07T06:07:35.921Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:apple:iphone_os:3.0:*:*:*:*:*:*:*", "matchCriteriaId": "863383DA-0BC6-4A96-835A-A96128EC0202", "vulnerable": true}, {"criteria": "cpe:2.3:o:apple:iphone_os:3.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "2CFF5BE7-2BF6-48CE-B74B-B1A05383C10F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The UIKit component in Apple iPhone OS 3.0, and iPhone OS 3.0.1 for iPod touch, allows physically proximate attackers to discover a password by watching a user undo deletions of characters in the password."}, {"lang": "es", "value": "El componente UIKit en Apple iPhone OS v3.0, y iPhone OS v3.0.1 para iPod touch, permite a atacantes que est\u00e9n f\u00edsicamente pr\u00f3ximos podr\u00edan descubrir la contrase\u00f1a vigilando al usuario cuando borra caracteres del la contrase\u00f1a"}], "id": "CVE-2009-2796", "lastModified": "2024-11-21T01:05:45.340", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-09-10T21:30:01.203", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/36677"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://support.apple.com/kb/HT3860"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/36335"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53185"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/36677"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://support.apple.com/kb/HT3860"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/36335"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53185"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}