PT-2014-5911 · Apple · Ios

Carl Mehner · Publicado 2014-10-22 · Atualizado 2017-08-29 · CVE-2014-4449

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.1

Description The issue concerns the iCloud Data Access feature in Apple iOS, which fails to verify X.509 certificates from TLS servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information by using a crafted certificate.

Recommendations For versions prior to 8.1, update to version 8.1 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2014-4449

Produtos afetados

Ios

Referências · 7

• http://securitytracker.com/id/1031077 · Nota
• https://support.apple.com/kb/HT6541 · Aviso do Fabricante
• http://securityfocus.com/archive/1/533747 · Aviso do Fabricante
• http://secunia.com/advisories/61825 · Nota
• http://securityfocus.com/bid/70659 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/97665 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-4449 · Nota de Segurança