| Vulnerability Name: | CVE-2015-3756 (CCN-105730) | ||||||||
| Assigned: | 2015-08-12 | ||||||||
| Published: | 2015-08-12 | ||||||||
| Updated: | 2016-12-24 | ||||||||
| Summary: | The Certificate UI in Apple iOS before 8.4.1 does not prevent X.509 certificate acceptance within the lock screen, which allows physically proximate attackers to establish arbitrary certificate trust relationships by completing a dialog. | ||||||||
| CVSS v3 Severity: | 4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) 3.5 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
| ||||||||
| CVSS v2 Severity: | 2.1 Low (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)
| ||||||||
| Vulnerability Type: | CWE-254 | ||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||
| References: | Source: MITRE Type: CNA CVE-2015-3756 Source: APPLE Type: Vendor Advisory APPLE-SA-2015-08-13-3 Source: BID Type: UNKNOWN 76337 Source: CCN Type: BID-76337 Apple iOS APPLE-SA-2015-08-13-3 Multiple Security Vulnerabilities Source: SECTRACK Type: UNKNOWN 1033275 Source: XF Type: UNKNOWN appleios-cve20153756-sec-bypass(105730) Source: CCN Type: Apple Web site About the security content of iOS 8.4.1 Source: CONFIRM Type: Vendor Advisory https://support.apple.com/kb/HT205030 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||