CVE-2014-4366

Current Description

Mail in Apple iOS before 8 does not prevent sending a LOGIN command to a LOGINDISABLED IMAP server, which allows remote attackers to obtain sensitive cleartext information by sniffing the network.

Basic Data

PublishedSeptember 18, 2014
Last ModifiedAugust 29, 2017
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeCWE-255
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityLOW
CVSS 2 - AuthenticationNONE
CVSS 2 - Confidentiality ImpactPARTIAL
CVSS 2 - Availability ImpactNONE
CVSS 2 - Base Score5.0
SeverityMEDIUM
Exploitability Score10.0
Impact Score2.9
Obtain All Privilegefalse
Obtain User Privilegefalse
Obtain Other Privilegefalse

Base Metric V3

No data provided.

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3OSAppleIphone Os7.0*******
    2.3OSAppleIphone Os7.0.1*******
    2.3OSAppleIphone Os7.0.2*******
    2.3OSAppleIphone Os7.0.3*******
    2.3OSAppleIphone Os7.0.4*******
    2.3OSAppleIphone Os7.0.5*******
    2.3OSAppleIphone Os7.0.6*******
    2.3OSAppleIphone Os7.1*******
    2.3OSAppleIphone Os7.1.1*******
    2.3OSAppleIphone Os********7.1.2

Vulnerable Software List

VendorProductVersions
Apple Iphone Os *, 7.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.1, 7.1.1

References

NameSourceURLTags
APPLE-SA-2014-09-17-1http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.htmlAPPLE
http://support.apple.com/kb/HT6441http://support.apple.com/kb/HT6441CONFIRM
69882http://www.securityfocus.com/bid/69882BID
69914http://www.securityfocus.com/bid/69914BID
1030866http://www.securitytracker.com/id/1030866SECTRACK
appleios-cve20144366-info-disc(96098)https://exchange.xforce.ibmcloud.com/vulnerabilities/96098XF