Vulnerability Description
The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate device names, disclosing the user's name. To resolve this issue, Firefox added a special case that renames devices containing the substring 'AirPods' to simply 'AirPods'. This vulnerability affects Thunderbird < 68.6, Firefox < 74, Firefox < ESR68.6, and Firefox ESR < 68.6.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 74.0 |
| Mozilla | Firefox Esr | < 68.6.0 |
| Mozilla | Thunderbird | < 68.6.0 |
| Canonical | Ubuntu Linux | 16.04 |
Related Weaknesses (CWE)
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1616661Issue TrackingPermissions RequiredVendor Advisory
- https://usn.ubuntu.com/4328-1/Third Party Advisory
- https://usn.ubuntu.com/4335-1/Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-08/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-09/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-10/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1616661Issue TrackingPermissions RequiredVendor Advisory
- https://usn.ubuntu.com/4328-1/Third Party Advisory
- https://usn.ubuntu.com/4335-1/Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-08/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-09/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2020-10/Vendor Advisory
FAQ
What is CVE-2020-6812?
CVE-2020-6812 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The first time AirPods are connected to an iPhone, they become named after the user's name by default (e.g. Jane Doe's AirPods.) Websites with camera or microphone permission are able to enumerate dev...
How severe is CVE-2020-6812?
CVE-2020-6812 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-6812?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird, Canonical Ubuntu Linux.