| Vulnerability Name: | CVE-2012-3742 (CCN-78708) |
| Assigned: | 2012-09-19 |
| Published: | 2012-09-19 |
| Updated: | 2017-08-29 |
| Summary: | Safari in Apple iOS before 6 does not properly restrict use of an unspecified Unicode character that looks similar to the https lock indicator, which allows remote attackers to spoof https connections by placing this character in the TITLE element of a web page.
|
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): None
Integrity (I): Low
Availibility (A): None |
|
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None |
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None |
|
| Vulnerability Type: | CWE-264
|
| Vulnerability Consequences: | Other |
| References: | Source: MITRE
Type: CNA
CVE-2012-3742
Source: APPLE
Type: Vendor Advisory
APPLE-SA-2012-09-19-1
Source: OSVDB
Type: UNKNOWN
85632
Source: CCN
Type: SA50586
Apple iOS Multiple Vulnerabilities
Source: CCN
Type: Apple KB HT5503
About the security content of iOS 6
Source: CONFIRM
Type: Vendor Advisory
http://support.apple.com/kb/HT5503
Source: CCN
Type: OSVDB ID: 85632
Apple iOS Safari Unicode Character Secure Connection Lock Icon Spoofing
Source: XF
Type: UNKNOWN
apple-ios-safari-cve20123742(78708)
Source: XF
Type: UNKNOWN
apple-ios-safari-cve20123742(78708)
|
| Vulnerable Configuration: | Configuration 1:
cpe:/o:apple:iphone_os:1.0.0:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:1.0.1:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:1.0.2:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:1.1.0:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:1.1.1:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:1.1.2:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:1.1.3:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:1.1.4:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:1.1.5:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:2.0:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:2.0.0:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:2.0.1:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:2.0.2:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:2.1:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:2.1.1:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:2.2:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:2.2.1:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:3.0:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:3.0.1:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:3.1:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:3.1.2:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:3.1.3:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:3.2:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:3.2.1:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:3.2.2:*:*:*:*:*:*:*OR cpe:/o:apple:ios:4.0:*:*:*:*:*:*:*OR cpe:/o:apple:ios:4.0.1:*:*:*:*:*:*:*OR cpe:/o:apple:ios:4.0.2:*:*:*:*:*:*:*OR cpe:/o:apple:ios:4.1:*:*:*:*:*:*:*OR cpe:/o:apple:ios:4.2.1:*:*:*:*:*:*:*OR cpe:/o:apple:ios:4.2.5:*:*:*:*:*:*:*OR cpe:/o:apple:ios:4.2.8:*:*:*:*:*:*:*OR cpe:/o:apple:ios:4.3.0:*:*:*:*:*:*:*OR cpe:/o:apple:ios:4.3.1:*:*:*:*:*:*:*OR cpe:/o:apple:ios:4.3.2:*:*:*:*:*:*:*OR cpe:/o:apple:ios:4.3.3:*:*:*:*:*:*:*OR cpe:/o:apple:ios:4.3.5:*:*:*:*:*:*:*OR cpe:/o:apple:ios:5.0:*:*:*:*:*:*:*OR cpe:/o:apple:ios:5.0.1:*:*:*:*:*:*:*OR cpe:/o:apple:iphone_os:*:*:*:*:*:*:*:* (Version <= 5.1.1)
 Denotes that component is vulnerable |
| Oval Definitions |
|
| BACK |