Homepage About Snyk

Improper Access Control Affecting libimobiledevice Open this link in a new tab package, versions >=0.0.0

0.0
medium

  • Attack Complexity

    Low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-COCOAPODS-LIBIMOBILEDEVICE-470931

  • published

    2 Oct 2019

  • disclosed

    13 Jun 2016

  • credit

    Unknown

Report a new vulnerability Found a mistake?

Introduced: 13 Jun 2016

CVE-2016-5104 Open this link in a new tab
CWE-284 Open this link in a new tab

How to fix?

There is no fixed version for libimobiledevice.

Overview

libimobiledevice is a library to communicate with services of Apple iOS devices using native protocols.

Affected versions of this package are vulnerable to Improper Access Control libimobiledeviceis vulnerable to exposure of iOS decive to an attacker placed on the local network. The attack is possible because of a flaw in the socket_create function in common/socket.c in libimobiledevice and libusbmuxd, leading to the bypass of intended access restrictions. Therefore, the attacker can communicate with services on iOS devices by connecting to an IPv4 TCP socket.