PT-2014-1613 · Apple · Tv+4

Published 2014-04-23 · Updated 2019-03-08 · CVE-2014-1296

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CFNetwork in Apple iOS versions prior to 7.1.1 CFNetwork in Apple OS X versions prior to 10.9.2 CFNetwork in Apple TV versions prior to 6.1.1

Description The issue allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a Set-Cookie HTTP header. This is because the CFNetwork does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value. An example of such bypassed restriction is the HTTPOnly restriction.

Recommendations For Apple iOS versions prior to 7.1.1, update to version 7.1.1 or later to resolve the issue. For Apple OS X versions prior to 10.9.2, update to version 10.9.2 or later to resolve the issue. For Apple TV versions prior to 6.1.1, update to version 6.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources that rely on the Set-Cookie HTTP header for access control until a patch is applied.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2015-00531

CVE-2014-1296

Affected Products

Cfnetwork

Os X

Tv

Ios

Itunes

References · 7

• https://bdu.fstec.ru/vul/2015-00531 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1296 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1296 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html · Vendor Advisory
• http://support.apple.com/kb/HT6245 · Note