An issue was discovered in certain Apple products. iOS before 11 is affected. macOS before 10.13 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue involves the Security component. It allows remote attackers to bypass intended certificate-trust restrictions via a revoked X.509 certificate.
Weakness
The product does not validate, or incorrectly validates, a certificate.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Iphone_os | Apple | * | 10.3.3 (including) |
| Mac_os_x | Apple | * | 10.12.6 (including) |
| Tvos | Apple | * | 10.2.2 (including) |
| Watchos | Apple | * | 3.2.3 (including) |
Potential Mitigations
Related Attack Patterns
References
- http://www.securityfocus.com/bid/100992
- http://www.securitytracker.com/id/1039427
- https://support.apple.com/HT208112
- https://support.apple.com/HT208113
- https://support.apple.com/HT208115
- https://support.apple.com/HT208144
- http://www.securityfocus.com/bid/100992
- http://www.securitytracker.com/id/1039427
- https://support.apple.com/HT208112
- https://support.apple.com/HT208113
- https://support.apple.com/HT208115
- https://support.apple.com/HT208144