PT-2015-3757 · Apple · Ios

Publicado 2015-01-30 · Atualizado 2015-11-17 · CVE-2014-4494

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.1.3

Description The issue concerns the Springboard component in Apple iOS, which fails to properly validate signatures. This allows attackers to bypass intended restrictions on the first launch of an app by using an enterprise distribution certificate to sign a crafted app.

Recommendations For versions prior to 8.1.3, update to version 8.1.3 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-4494

Produtos afetados

Ios

Referências · 4

• http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-4494 · Nota de Segurança
• http://support.apple.com/HT204245 · Aviso do Fabricante
• http://securitytracker.com/id/1031652 · Nota