CVE-2015-6997: Medium severity iphone os vulnerability
Published Oct 23, 2015
·Updated
The X.509 certificate-trust implementation in Apple iOS before 9.1 does not recognize that the kSecRevocationRequirePositiveResponse flag implies a revocation-checking requirement, which makes it easier for man-in-the-middle attackers to spoof endpoints by leveraging access to a revoked certificate.
Affected Software
2 affected components
Apple iPhone OS<=9.0.2
Apple WatchOS<=2.0
Event History
Oct 23, 2015
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-6997?
CVE-2015-6997 has a medium severity rating due to its potential for man-in-the-middle attacks.
2
How do I fix CVE-2015-6997?
To fix CVE-2015-6997, update affected devices to iOS version 9.1 or later.
3
Which versions of Apple iOS are affected by CVE-2015-6997?
CVE-2015-6997 affects Apple iOS versions prior to 9.1.
4
What type of attack is possible due to CVE-2015-6997?
CVE-2015-6997 makes devices vulnerable to man-in-the-middle attacks leveraging revoked certificates.
5
Is Apple watchOS also affected by CVE-2015-6997?
Yes, watchOS versions prior to 2.1 are also affected by CVE-2015-6997.