CVE-2013-3948: Input Validation

Published Jun 5, 2013

Updated

Apple iOS 6.1.3 does not follow redirects during determination of the hostname to display in an iOS Enterprise Deployment installation dialog, which makes it easier for remote attackers to trigger installation of arbitrary applications via a download-manifest itms-services:// URL that leverages an open redirect vulnerability within a trusted domain.

Affected Software

1 affected component

apple iPhone OS=6.1.3

Event History

Jun 5, 2013

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2013-3948?

CVE-2013-3948 is classified as a high severity vulnerability due to its potential to allow remote attackers to install arbitrary applications.

How do I fix CVE-2013-3948?

The recommended fix for CVE-2013-3948 is to update to a later version of iOS that is not affected by this vulnerability.

What systems are affected by CVE-2013-3948?

CVE-2013-3948 specifically affects Apple iOS version 6.1.3.

What type of attack does CVE-2013-3948 enable?

CVE-2013-3948 enables remote attackers to exploit the vulnerability by triggering the installation of arbitrary applications via a specially crafted download-manifest.

What is the impact of exploiting CVE-2013-3948?

Exploiting CVE-2013-3948 may lead to unauthorized application installations, potentially compromising the device's security and user's data.