CVE-2009-2794 Security feature bypass in n/a

Medium 4.6 Published 10 Sep 2009 Updated 7 Aug 2024

Local users can bypass Microsoft Exchange security restrictions on iOS devices by manipulating passcode timeout settings, requiring an OS update.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2009-2794?

CVE-2009-2794 is a medium-severity vulnerability in Apple Iphone Os, published on 10 Sep 2009. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The Exchange Support component in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not properly implement the "Maximum inactivity time lock" functionality, which allows local users to bypass intended Microsoft Exchange restrictions by choosing a large Require Passcode time value.

Weakness: CWE-362

Which versions are affected by CVE-2009-2794?

It affects 1 product.

Products include Apple Iphone Os.

How do I fix CVE-2009-2794?

No fix has been published for CVE-2009-2794 yet. Limit exposure of the affected software until one is available.

Is CVE-2009-2794 being exploited?

There is no known exploitation of CVE-2009-2794 in the wild and no public exploit code.

All Apple Iphone Os vulnerabilities

Sources

Also known as GHSA-fppw-cm5c-3hfp.