Description
The Data Security component in Apple iOS before 4.2.10 and 4.3.x before 4.3.5 does not check the basicConstraints parameter during validation of X.509 certificate chains, which allows man-in-the-middle attackers to spoof an SSL server by using a non-CA certificate to sign a certificate for an arbitrary domain.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
jan0/isslfix ★ 9 · Jul 31, 2011
CVE-2011-0228 fix for older idevices/firmwares
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- APPLE-SA-2011-07-25-1 vendor-advisory
- https://www.trustwave.com/spiderlabs/advisories/TWSL2011-007.txt
- 48877 vdb-entry
- http://support.apple.com/kb/HT4824
- 45369 third-party-advisory
- 20110725 TWSL2011-007: iOS SSL Implementation Does Not Validate Certificate Chain mailing-list
- APPLE-SA-2011-07-25-2 vendor-advisory
- http://support.apple.com/kb/HT4825
- 8361 third-party-advisory
- 1025837 vdb-entry