CVE-2009-0958

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-06-19 · updated 2026-06-16
Weakness: CWE-200

Description

Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 stores an exception for a hostname when the user accepts an untrusted Exchange server certificate, which causes it to be accepted without prompting in future usage and allows remote Exchange servers to obtain sensitive information such as credentials.

Affected products

Apple Iphone Os: 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2 (+11)
Apple Ipod Touch: all versions

References

http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
http://osvdb.org/55236
http://support.apple.com/kb/HT3639
http://www.securityfocus.com/bid/35414
http://www.securityfocus.com/bid/35447
http://www.vupen.com/english/advisories/2009/1621
https://exchange.xforce.ibmcloud.com/vulnerabilities/51208
http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html
http://osvdb.org/55236
http://support.apple.com/kb/HT3639
http://www.securityfocus.com/bid/35414
http://www.securityfocus.com/bid/35447

Get alerted when CVE-2009-0958 or the next vulnerability affects your stack