An issue was discovered in certain Apple products. iOS before 11.2.1 is affected. tvOS before 11.2.1 is affected. The issue involves the "HomeKit" component. It allows remote attackers to modify the application state by leveraging incorrect message handling, as demonstrated by use of an Apple Watch to obtain an encryption key and unlock a door.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/102182 | Third Party Advisory VDB Entry |
| http://www.securitytracker.com/id/1040008 | Third Party Advisory VDB Entry |
| https://support.apple.com/HT208357 | Vendor Advisory |
| https://support.apple.com/HT208359 | Vendor Advisory |
| https://www.engadget.com/2017/12/21/apple-ignored-a-major-homekit-security-flaw-for-six-weeks/ | Press/Media Coverage |
| http://www.securityfocus.com/bid/102182 | Third Party Advisory VDB Entry |
| http://www.securitytracker.com/id/1040008 | Third Party Advisory VDB Entry |
| https://support.apple.com/HT208357 | Vendor Advisory |
| https://support.apple.com/HT208359 | Vendor Advisory |
| https://www.engadget.com/2017/12/21/apple-ignored-a-major-homekit-security-flaw-for-six-weeks/ | Press/Media Coverage |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 03:11
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/102182 - Third Party Advisory, VDB Entry | |
| References | () http://www.securitytracker.com/id/1040008 - Third Party Advisory, VDB Entry | |
| References | () https://support.apple.com/HT208357 - Vendor Advisory | |
| References | () https://support.apple.com/HT208359 - Vendor Advisory | |
| References | () https://www.engadget.com/2017/12/21/apple-ignored-a-major-homekit-security-flaw-for-six-weeks/ - Press/Media Coverage |
Information
Published : 2017-12-25 21:29
Updated : 2024-11-21 03:11
NVD link : CVE-2017-13903
Mitre link : CVE-2017-13903
CVE.ORG link : CVE-2017-13903
JSON object : View
Products Affected
apple
- iphone_os
- tvos
CWE