CVE-2012-3698

Published: Jul 26, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Apple Xcode before 4.4 does not properly compose a designated requirement (DR) during signing of programs that lack bundle identifiers, which allows remote attackers to read keychain entries via a crafted app, as demonstrated by the keychain entries of a (1) helper tool or (2) command-line tool.

Affected (27)

Products: Apple: Xcode

Apple

1 product

Xcode

Configuration A

27 vulnerable

Vulnerable Software	Affected Versions
Apple Xcode	Up to 4.3.3
Apple Xcode	Version 1.5.0
Apple Xcode	Version 2.0.0
Apple Xcode	Version 2.1.0
Apple Xcode	Version 2.2.0
Apple Xcode	Version 2.3.0
Apple Xcode	Version 2.4.0
Apple Xcode	Version 2.4.1
Apple Xcode	Version 3.1.1
Apple Xcode	Version 3.1.2
Apple Xcode	Version 3.1.3
Apple Xcode	Version 3.1.4
Apple Xcode	Version 3.1
Apple Xcode	Version 3.2.1
Apple Xcode	Version 3.2.2
Apple Xcode	Version 3.2.3
Apple Xcode	Version 3.2.4
Apple Xcode	Version 3.2.5
Apple Xcode	Version 4.0.1
Apple Xcode	Version 4.0.2
Apple Xcode	Version 4.0
Apple Xcode	Version 4.1.1
Apple Xcode	Version 4.2.1
Apple Xcode	Version 4.2
Apple Xcode	Version 4.3.1
Apple Xcode	Version 4.3.2
Apple Xcode	Version 4.3

Related CWEs

CWE-264

References (2)

http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html

Source: product-security@apple.com

Vendor Advisory

http://lists.apple.com/archives/security-announce/2012/Jul/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.