Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

iPhone and iPod touch OS can allow connection hijacking

CVE-2008-3612 · published 18 years ago
Summary

The networking part of iPhone OS and iPod touch OS versions 2.0 to 2.0.2 picks numbers for new network connections in a predictable way. Because of this, an attacker on the same network could pretend to be you and take over an active connection, potentially seeing or changing data. Update the devices to a newer OS version or apply any patches provided by the manufacturer to stop the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
apple iphone_os >= 2.0.0, <= 2.0.2
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
Original advisory text
The Networking subsystem in Apple iPod touch 2.0 through 2.0.2, and iPhone 2.0 through 2.0.2, uses predictable TCP initial sequence numbers, which allows remote attackers to spoof or hijack a TCP c...
The Networking subsystem in Apple iPod touch 2.0 through 2.0.2, and iPhone 2.0 through 2.0.2, uses predictable TCP initial sequence numbers, which allows remote attackers to spoof or hijack a TCP connection.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
4% chance of attack within 30 days
Type
CWE-330Use of Insufficiently Random Values
Timeline
Published11 Sep 2008
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2008-3612 · NVD
Track software like this
Free during beta