« Volver al listado

CVE-2009-2794

Estado: ModificadaMedia (4.6)—

El componente Exchange Support en Apple iPhome OS anteriores a la 3.1, e iPhone OS anteriores a 3.1.1 para iPod touch, no implementan de forma adecuada la funcionalidad de bloqueo por tiempo de inactividad máximo, lo que permite a usuarios locales saltarse las restricciones impuestas por Microsoft Exchange seleccionando un valor de tiempo grande para Requiere Passcode.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apple — Iphone OS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-2794",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-09-10T21:30:01.140",
  "references": [
    {
      "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/36677",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://support.apple.com/kb/HT3860",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/36342",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53181",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/36677",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.apple.com/kb/HT3860",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/36342",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53181",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Exchange Support component in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not properly implement the \"Maximum inactivity time lock\" functionality, which allows local users to bypass intended Microsoft Exchange restrictions by choosing a large Require Passcode time value."
    },
    {
      "lang": "es",
      "value": "El componente Exchange Support en Apple iPhome OS anteriores a la 3.1, e iPhone OS anteriores a 3.1.1 para iPod touch, no implementan de forma adecuada la funcionalidad de bloqueo por tiempo de inactividad máximo, lo que permite a usuarios locales saltarse las restricciones impuestas por Microsoft Exchange seleccionando un valor de tiempo grande para Requiere Passcode."
    }
  ],
  "lastModified": "2026-06-16T23:10:14.080",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1641DDFA-3BF1-467F-8EC3-98114FF9F07B"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:2.0.0:-:ipodtouch:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A66D6DC-9A48-4BD6-9E01-0D9FF388457C"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:2.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D61644E2-7AF5-48EF-B3D5-59C7B2AD1A58"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:2.0.1:-:ipodtouch:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C59B8C50-BF5D-4E9A-8E5B-99B34E974B5A"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:2.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D06D54D-97FD-49FD-B251-CC86FBA68CA6"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:2.0.2:-:ipodtouch:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4CE4199-BBF5-4F42-8BBC-BD946079C912"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "25A5D868-0016-44AB-80E6-E5DF91F15455"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:2.1:-:ipodtouch:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34346F55-4972-427B-8F96-780FA91DB95D"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:2.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C14EEA4-6E35-4EBE-9A43-8F6D69318BA0"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B15E90AE-2E15-4BC2-B0B8-AFA2B1297B03"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:2.2:-:ipodtouch:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE65CA8B-68CB-428C-AC32-6F9100F9E507"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:2.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E0C0A8D-3DDD-437A-BB3D-50FAEAF6C440"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:2.2.1:-:ipodtouch:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD136376-331D-494F-9D12-7E631546E8CB"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "863383DA-0BC6-4A96-835A-A96128EC0202"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:3.0:-:ipodtouch:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F07B3FE7-96B3-493A-A230-5642BA11FBDA"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:3.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2CFF5BE7-2BF6-48CE-B74B-B1A05383C10F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}