CVE-2009-0961: Medium severity iphone os vulnerability

Published Jun 19, 2009

Updated

The Mail component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 dismisses the call approval dialog when another alert appears, which might allow remote attackers to force the iPhone to place a call without user approval by causing an application to trigger an alert.

Affected Software

19 affected components

apple iPhone OS=1.0.0

apple iPhone OS=1.0.1

apple iPhone OS=1.0.2

apple iPhone OS=1.1.0

apple iPhone OS=1.1.1

apple iPhone OS=1.1.2

apple iPhone OS=1.1.3

apple iPhone OS=1.1.4

apple iPhone OS=1.1.5

apple iPhone OS=2.0

apple iPhone OS=2.0.0

apple iPhone OS=2.0.1

apple iPhone OS=2.0.2

apple iPhone OS=2.1

apple iPhone OS=2.1.1

apple iPhone OS=2.2

apple iPhone OS=2.2.1

apple iPhone OS

Apple iPod touch

Remediation

Patch Available

http://support.apple.com/kb/HT3639

Event History

Jun 19, 2009

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Data Sourced

04:30 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-0961?

CVE-2009-0961 is classified as a high severity vulnerability, allowing potential remote exploitation.

How do I fix CVE-2009-0961?

To fix CVE-2009-0961, you should update your Apple iPhone OS or iPod touch to the latest version available.

What versions are affected by CVE-2009-0961?

CVE-2009-0961 affects Apple iPhone OS versions 1.0 through 2.2.1 and iPhone OS for iPod touch versions 1.1 through 2.2.1.

What kind of attack does CVE-2009-0961 allow?

CVE-2009-0961 allows remote attackers to make calls without user approval by exploiting the vulnerability in the Mail component.

Is there a workaround for CVE-2009-0961?

There are no known workarounds for CVE-2009-0961; updating to a secure version is the only recommended solution.