PT-2015-3757 · Apple · Ios

Published 2015-01-30 · Updated 2015-11-17 · CVE-2014-4494

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8.1.3

Description The issue concerns the Springboard component in Apple iOS, which fails to properly validate signatures. This allows attackers to bypass intended restrictions on the first launch of an app by using an enterprise distribution certificate to sign a crafted app.

Recommendations For versions prior to 8.1.3, update to version 8.1.3 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-4494

Affected Products

Ios

References · 4

• http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4494 · Security Note
• http://support.apple.com/HT204245 · Vendor Advisory
• http://securitytracker.com/id/1031652 · Note