CVE-2008-3612

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-09-11 · updated 2026-06-16
Weakness: CWE-330

Description

The Networking subsystem in Apple iPod touch 2.0 through 2.0.2, and iPhone 2.0 through 2.0.2, uses predictable TCP initial sequence numbers, which allows remote attackers to spoof or hijack a TCP connection.

Affected products

Apple Iphone Os: from 2.0.0 through 2.0.2

References

http://lists.apple.com/archives/security-announce//2008/Sep/msg00003.html
http://lists.apple.com/archives/security-announce//2008/Sep/msg00004.html
http://secunia.com/advisories/31823
http://secunia.com/advisories/31900
http://support.apple.com/kb/HT3026
http://support.apple.com/kb/HT3129
http://www.securityfocus.com/bid/31092
http://www.securitytracker.com/id?1020848
http://www.vupen.com/english/advisories/2008/2525
http://www.vupen.com/english/advisories/2008/2558
http://lists.apple.com/archives/security-announce//2008/Sep/msg00003.html
http://lists.apple.com/archives/security-announce//2008/Sep/msg00004.html

Get alerted when CVE-2008-3612 or the next vulnerability affects your stack