Multiple manufacturers' simple certificate registration protocol authentication Security Restriction Bypass Vulnerability

Release date:
Updated on:

Affected Systems:
Apple iOS 4
Apple iPad
Apple iPod Touch
Description:
--------------------------------------------------------------------------------
Bugtraq id: 54216

The iPhone is a 4-Band GSM mobile phone. IPad is a touch screen tablet. IPod touch is a portable media player launched by Apple. Apple iOS is the latest operating system running on Apple's iPhone and iPod touch devices.

A security restriction bypass vulnerability exists in the implementation of simple certificate registration protocols used by multiple vendors. Attackers exploit this vulnerability to escalate their permissions by requesting certificates of higher-privilege users, thus bypassing certain security restrictions, illegal access.

<* Source: Ted Shorter
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Apple
-----
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://support.apple.com/