CVE Vulnerabilities

CVE-2016-4685

Inadequate Encryption Strength

Published: Feb 20, 2017 | Modified: Feb 21, 2017
CVSS 3.x
5.9
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu

An issue was discovered in certain Apple products. iOS before 10.1 is affected. The issue involves the iTunes Backup component, which improperly hashes passwords, making it easier to decrypt files.

Weakness

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Affected Software

Name Vendor Start Version End Version
Iphone_os Apple * 10.0.3 (including)

Potential Mitigations

References