PT-2014-5889 · Apple · Os X

Emil Sjölander · Published 2014-10-18 · Updated 2017-08-29 · CVE-2014-4425

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple OS X versions prior to 10.10

Description The issue concerns the CFPreferences component in Apple OS X, which fails to properly enforce the setting that requires a password after sleep or screen saver begins. This makes it easier for physically proximate attackers to gain access to an unattended workstation.

Recommendations For Apple OS X versions prior to 10.10, consider enabling the "require password after sleep or screen saver begins" setting and ensuring workstations are attended at all times to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-4425

Affected Products

Os X

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-4425 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html · Vendor Advisory
• https://support.apple.com/kb/HT6535 · Vendor Advisory
• http://securitytracker.com/id/1031063 · Note
• http://securityfocus.com/bid/70630 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/97640 · Note