CVE-2015-5824

Vulnerability

The vulnerability resides in the NSURL implementation within the CFNetwork SSL component of Apple iOS versions prior to 9. When an SSL server changes its X.509 certificate, the system does not properly verify the new certificate, allowing an attacker to present a crafted certificate that will be accepted without proper validation. This affects all iOS devices running versions before 9.

Exploitation

An attacker with a man-in-the-middle network position can intercept SSL/TLS traffic between an iOS device and a server. After the legitimate server changes its certificate (e.g., due to renewal), the attacker can present a crafted certificate that the vulnerable NSURL implementation will accept. No additional authentication or user interaction is required beyond the normal SSL handshake.

Impact

Successful exploitation allows the attacker to spoof the targeted server, decrypt and read sensitive information transmitted over the SSL connection, and potentially modify data in transit. The attacker gains the ability to impersonate any SSL server whose certificate change is not properly validated, leading to full compromise of confidentiality and integrity of the communication.

Mitigation

Apple addressed this issue in iOS 9, released on September 16, 2015 [1]. Users should upgrade to iOS 9 or later to receive the fix. No workaround is available for earlier versions. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.