CVE-2009-2794: Race Condition
First published: Thu Sep 10 2009(Updated: )
The Exchange Support component in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not properly implement the "Maximum inactivity time lock" functionality, which allows local users to bypass intended Microsoft Exchange restrictions by choosing a large Require Passcode time value.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| iPhone OS | =2.0.2 | |
| iPhone OS | =3.0 | |
| iPhone OS | =2.2 | |
| iPhone OS | =3.0.1 | |
| iPhone OS | =2.0.1 | |
| iPhone OS | =2.1 | |
| iPhone OS | =3.0 | |
| iPhone OS | =2.2.1 | |
| iPhone OS | =2.2 | |
| iPhone OS | =2.1.1 | |
| iPhone OS | =2.0.0 | |
| iPhone OS | =2.0.2 | |
| iPhone OS | =2.0 | |
| iPhone OS | =2.0.1 | |
| iPhone OS | =2.2.1 | |
| iPhone OS | =2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2009-2794?
CVE-2009-2794 is considered a medium severity vulnerability due to its potential to allow unauthorized access to Exchange mail accounts.
How do I fix CVE-2009-2794?
To fix CVE-2009-2794, update your Apple iPhone OS to version 3.1 or later.
What does CVE-2009-2794 affect?
CVE-2009-2794 affects Apple iPhone OS versions prior to 3.1 and some versions of iPod touch.
What is the exploit method for CVE-2009-2794?
CVE-2009-2794 can be exploited locally by bypassing the Maximum inactivity time lock feature.
Who is impacted by CVE-2009-2794?
Local users of affected iPhone and iPod touch devices may be impacted by CVE-2009-2794.
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/last-modified-date
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/apple
- canonical/iphone os
- version/iphone os/2.0.2
- version/iphone os/3.0
- version/iphone os/2.2
- version/iphone os/3.0.1
- version/iphone os/2.0.1
- version/iphone os/2.1
- version/iphone os/2.2.1
- version/iphone os/2.1.1
- version/iphone os/2.0.0
- version/iphone os/2.0