cnvd - cnvd-2017-04648

CNVD-2017-04648

Vulnerability from cnvd - Published: 2017-04-19

Title

Apple iOS/Mac信息泄露漏洞

Description

iOS是由苹果公司为移动设备所开发的操作系统，支持的设备包括iPhone、iPod touch、iPad、Apple TV。 Apple多款产品存在信息泄露漏洞，攻击者可利用此漏洞获取敏感信息。

Severity

中

Patch Name

Apple iOS/Mac信息泄露漏洞的补丁

Patch Description

iOS是由苹果公司为移动设备所开发的操作系统，支持的设备包括iPhone、iPod touch、iPad、Apple TV。 Apple多款产品存在信息泄露漏洞，攻击者可利用此漏洞获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可参考如下厂商提供的安全补丁以修复该漏洞： https://www.apple.com/

Reference

http://www.securityfocus.com/bid/97126 https://nvd.nist.gov/vuln/detail/CVE-2017-2391

Impacted products

Name
['Apple pages 5.0', 'Apple pages 5.0.1', 'Apple pages 2.0', 'Apple pages 2.0.1', 'Apple pages 2.0.2', 'Apple Pages 5.1', 'Apple Pages 5.6', 'Apple Pages 2.1', 'Apple Numbers 3.6', 'Apple Numbers 3.5', 'Apple Keynote 2.0.2', 'Apple Keynote 2.0.1', 'Apple Keynote 2.0', 'Apple Keynote 6.5', 'Apple Keynote 6.0', 'Apple Keynote 5.2', 'Apple Keynote 5.1.1', 'Apple Keynote 5.0.5', 'Apple Keynote 5.0.4', 'Apple Keynote 5.0.3', 'Apple Keynote 5.0.2', 'Apple Keynote 5.0.1', 'Apple Keynote 5.0']

Name

['Apple pages 5.0', 'Apple pages 5.0.1', 'Apple pages 2.0', 'Apple pages 2.0.1', 'Apple pages 2.0.2', 'Apple Pages 5.1', 'Apple Pages 5.6', 'Apple Pages 2.1', 'Apple Numbers 3.6', 'Apple Numbers 3.5', 'Apple Keynote 2.0.2', 'Apple Keynote 2.0.1', 'Apple Keynote 2.0', 'Apple Keynote 6.5', 'Apple Keynote 6.0', 'Apple Keynote 5.2', 'Apple Keynote 5.1.1', 'Apple Keynote 5.0.5', 'Apple Keynote 5.0.4', 'Apple Keynote 5.0.3', 'Apple Keynote 5.0.2', 'Apple Keynote 5.0.1', 'Apple Keynote 5.0']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "97126"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-2391"
    }
  },
  "description": "iOS\u662f\u7531\u82f9\u679c\u516c\u53f8\u4e3a\u79fb\u52a8\u8bbe\u5907\u6240\u5f00\u53d1\u7684\u64cd\u4f5c\u7cfb\u7edf\uff0c\u652f\u6301\u7684\u8bbe\u5907\u5305\u62eciPhone\u3001iPod touch\u3001iPad\u3001Apple TV\u3002\r\n\r\nApple\u591a\u6b3e\u4ea7\u54c1\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "Philipp Eckel of ThoughtWorks",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u5382\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u8865\u4e01\u4ee5\u4fee\u590d\u8be5\u6f0f\u6d1e\uff1a\r\nhttps://www.apple.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-04648",
  "openTime": "2017-04-19",
  "patchDescription": "iOS\u662f\u7531\u82f9\u679c\u516c\u53f8\u4e3a\u79fb\u52a8\u8bbe\u5907\u6240\u5f00\u53d1\u7684\u64cd\u4f5c\u7cfb\u7edf\uff0c\u652f\u6301\u7684\u8bbe\u5907\u5305\u62eciPhone\u3001iPod touch\u3001iPad\u3001Apple TV\u3002\r\n\r\nApple\u591a\u6b3e\u4ea7\u54c1\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apple iOS/Mac\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Apple pages 5.0",
      "Apple pages 5.0.1",
      "Apple pages 2.0",
      "Apple pages 2.0.1",
      "Apple pages 2.0.2",
      "Apple Pages  5.1",
      "Apple Pages 5.6",
      "Apple Pages 2.1",
      "Apple Numbers 3.6",
      "Apple Numbers 3.5",
      "Apple Keynote 2.0.2",
      "Apple Keynote 2.0.1",
      "Apple Keynote 2.0",
      "Apple Keynote 6.5",
      "Apple Keynote 6.0",
      "Apple Keynote 5.2",
      "Apple Keynote 5.1.1",
      "Apple Keynote 5.0.5",
      "Apple Keynote 5.0.4",
      "Apple Keynote 5.0.3",
      "Apple Keynote 5.0.2",
      "Apple Keynote  5.0.1",
      "Apple Keynote  5.0"
    ]
  },
  "referenceLink": "http://www.securityfocus.com/bid/97126\r\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-2391",
  "serverity": "\u4e2d",
  "submitTime": "2017-03-28",
  "title": "Apple iOS/Mac\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2017-2391 (GCVE-0-2017-2391)

Vulnerability from cvelistv5 – Published: 2017-04-02 01:36 – Updated: 2024-08-05 13:55

Summary

An issue was discovered in certain Apple products. Pages before 6.1, Numbers before 4.1, and Keynote before 7.1 on macOS and Pages before 3.1, Numbers before 3.1, and Keynote before 3.1 on iOS are affected. The issue involves the "Export" component. It allows users to bypass iWork PDF password protection by leveraging use of 40-bit RC4.

Severity ?

No CVSS data available.

CWE

Assigner

apple

References

URL

Tags

	http://www.securitytracker.com/id/1038135	vdb-entryx_refsource_SECTRACK
	http://www.securitytracker.com/id/1038134	vdb-entryx_refsource_SECTRACK
	https://support.apple.com/HT207595	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1038136	vdb-entryx_refsource_SECTRACK
	http://www.securityfocus.com/bid/97126	vdb-entryx_refsource_BID

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T13:55:05.427Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1038135",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038135"
          },
          {
            "name": "1038134",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038134"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.apple.com/HT207595"
          },
          {
            "name": "1038136",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038136"
          },
          {
            "name": "97126",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97126"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-03-28T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in certain Apple products. Pages before 6.1, Numbers before 4.1, and Keynote before 7.1 on macOS and Pages before 3.1, Numbers before 3.1, and Keynote before 3.1 on iOS are affected. The issue involves the \"Export\" component. It allows users to bypass iWork PDF password protection by leveraging use of 40-bit RC4."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-11T09:57:01",
        "orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
        "shortName": "apple"
      },
      "references": [
        {
          "name": "1038135",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038135"
        },
        {
          "name": "1038134",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038134"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.apple.com/HT207595"
        },
        {
          "name": "1038136",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038136"
        },
        {
          "name": "97126",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97126"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@apple.com",
          "ID": "CVE-2017-2391",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in certain Apple products. Pages before 6.1, Numbers before 4.1, and Keynote before 7.1 on macOS and Pages before 3.1, Numbers before 3.1, and Keynote before 3.1 on iOS are affected. The issue involves the \"Export\" component. It allows users to bypass iWork PDF password protection by leveraging use of 40-bit RC4."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1038135",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038135"
            },
            {
              "name": "1038134",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038134"
            },
            {
              "name": "https://support.apple.com/HT207595",
              "refsource": "CONFIRM",
              "url": "https://support.apple.com/HT207595"
            },
            {
              "name": "1038136",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038136"
            },
            {
              "name": "97126",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97126"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
    "assignerShortName": "apple",
    "cveId": "CVE-2017-2391",
    "datePublished": "2017-04-02T01:36:00",
    "dateReserved": "2016-12-01T00:00:00",
    "dateUpdated": "2024-08-05T13:55:05.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-04648

CVE-2017-2391 (GCVE-0-2017-2391)

Tags

Sightings

Nomenclature