CVE-2017-2412 Information disclosure in n/a
Man-in-the-middle attackers can intercept and modify iTunes Store traffic due to cleartext HTTP usage in iOS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-2412?
CVE-2017-2412 is a medium-severity vulnerability in Apple Iphone Os, published on 2 Apr 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "iTunes Store" component. It allows man-in-the-middle attackers to modify the client-server data stream to iTunes sandbox web services by leveraging use of cleartext HTTP.
Weakness: CWE-319
Which versions are affected by CVE-2017-2412?
It affects 1 product.
Products include Apple Iphone Os.
How do I fix CVE-2017-2412?
No fix has been published for CVE-2017-2412 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-2412 being exploited?
There is no known exploitation of CVE-2017-2412 in the wild and no public exploit code.
Other vulnerabilities in Apple Iphone Os
Sources
Also known as GHSA-j88g-qvq3-g942.