PT-2014-4572 · Openssl+1 · Openssl+1

Hynek Schlawack · Publicado 2014-03-05 · Atualizado 2014-03-05 · CVE-2014-2234

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apple OS X versions 10.9.2 and earlier

Description The issue allows remote attackers to bypass extra verification within a custom application via a crafted certificate chain that is acceptable to the Trust Evaluation Agent (TEA) feature but not acceptable to that application. This is due to the Apple patch for OpenSSL not terminating certain TLS/SSL handshakes as specified in the SSL CTX set verify callback function's documentation.

Recommendations For Apple OS X versions 10.9.2 and earlier, consider updating to a newer version that includes the fix for this issue. As a temporary workaround, consider restricting the use of the TEA feature in custom applications to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-2234

Produtos afetados

Os X

Openssl

Referências · 2

• 🔥 https://hynek.me/articles/apple-openssl-verification-surprises · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2234 · Nota de Segurança