CVEvulnerability
CVE-2009-2794
4.6 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-09-10
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-362
Description
The Exchange Support component in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not properly implement the "Maximum inactivity time lock" functionality, which allows local users to bypass intended Microsoft Exchange restrictions by choosing a large Require Passcode time value.
Affected configurations
• apple iphone os 2.0
• apple iphone os 2.0.0
• apple iphone os 2.0.1
• apple iphone os 2.0.2
• apple iphone os 2.1
• apple iphone os 2.1.1
• apple iphone os 2.2
• apple iphone os 2.2.1
• apple iphone os 3.0
• apple iphone os 3.0.1
Related
Weakness · CWE (1)
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
References
- http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html Patch, Vendor Advisory
- http://secunia.com/advisories/36677 Vendor Advisory
- http://support.apple.com/kb/HT3860 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/36342 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53181 exchange.xforce.ibmcloud.com
- http://lists.apple.com/archives/security-announce/2009/Sep/msg00001.html Patch, Vendor Advisory
- http://secunia.com/advisories/36677 Vendor Advisory
- http://support.apple.com/kb/HT3860 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/36342 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53181 exchange.xforce.ibmcloud.com