CVE-2017-2383: Low severity Apple iOS vulnerability
APNs Server. A client certificate was sent in plaintext. This issue was addressed through improved certificate handling.
Other sources
An issue was discovered in certain Apple products. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. The issue involves cleartext client-certificate transmission in the "APNs Server" component. It allows man-in-the-middle attackers to track users via correlation with this certificate.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apple iOS and iPadOSto a version that resolves this vulnerability.Fixed in 10.2.1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2017-2383?
CVE-2017-2383 has a moderate severity level due to the potential exposure of sensitive client certificate information.
How do I fix CVE-2017-2383?
To fix CVE-2017-2383, update affected Apple software to the latest versions, specifically iOS 10.2.1, iCloud 6.2 or higher, and iTunes 12.6 or higher.
Which versions of Apple products are affected by CVE-2017-2383?
CVE-2017-2383 affects iCloud versions prior to 6.2, iTunes versions prior to 12.6, and iOS versions up to 10.2.1.
What type of vulnerability is CVE-2017-2383?
CVE-2017-2383 is a crypto vulnerability involving the transmission of client certificates in plaintext.
Does CVE-2017-2383 require immediate attention?
Yes, CVE-2017-2383 requires immediate attention to mitigate risks associated with exposed client certificates.