CVE-2014-1296
Apple Security Advisory 2014-04-22-1
Severity Score
5.3
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction.
CFNetwork en Apple iOS anterior a 7.1.1, Apple OS X hasta 10.9.2 y Apple TV anterior a 6.1.1 no asegura que una cabecera HTTP de configuración de cookie está completa antes de interpretar el valor de la cabecera, lo que permite a atacantes remotos evadir restricciones de acceso mediante la provocación de el cierre de una conexión TCP durante la transmisión de una cabecera, tal y como fue demostrado por una restricción HTTPOnly.
iTunes 11.2 is now available and addresses a credential interception issue. Set-Cookie HTTP headers would be processed even if the connection closed before the header line was complete. An attacker could strip security settings from the cookie by forcing the connection to close before the security settings were sent, and then obtain the value of the unprotected cookie. This issue was addressed by ignoring incomplete HTTP header lines.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2014-01-08 CVE Reserved
- 2014-04-23 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (3)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://archives.neohapsis.com/archives/bugtraq/2014-04/0134.html | 2019-03-08 | |
| http://archives.neohapsis.com/archives/bugtraq/2014-04/0135.html | 2019-03-08 | |
| http://archives.neohapsis.com/archives/bugtraq/2014-04/0136.html | 2019-03-08 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | <= 7.1 Search vendor "Apple" for product "Iphone Os" and version " <= 7.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | 7.0 Search vendor "Apple" for product "Iphone Os" and version "7.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | 7.0.1 Search vendor "Apple" for product "Iphone Os" and version "7.0.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | 7.0.2 Search vendor "Apple" for product "Iphone Os" and version "7.0.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | 7.0.3 Search vendor "Apple" for product "Iphone Os" and version "7.0.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | 7.0.4 Search vendor "Apple" for product "Iphone Os" and version "7.0.4" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | 7.0.5 Search vendor "Apple" for product "Iphone Os" and version "7.0.5" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | 7.0.6 Search vendor "Apple" for product "Iphone Os" and version "7.0.6" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.8.0 Search vendor "Apple" for product "Mac Os X" and version "10.8.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.8.1 Search vendor "Apple" for product "Mac Os X" and version "10.8.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.8.2 Search vendor "Apple" for product "Mac Os X" and version "10.8.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.8.3 Search vendor "Apple" for product "Mac Os X" and version "10.8.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.8.4 Search vendor "Apple" for product "Mac Os X" and version "10.8.4" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.8.5 Search vendor "Apple" for product "Mac Os X" and version "10.8.5" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.8.5 Search vendor "Apple" for product "Mac Os X" and version "10.8.5" | supplemental_update |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | <= 10.9.2 Search vendor "Apple" for product "Mac Os X" and version " <= 10.9.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.9 Search vendor "Apple" for product "Mac Os X" and version "10.9" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.9.1 Search vendor "Apple" for product "Mac Os X" and version "10.9.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.7.0 Search vendor "Apple" for product "Mac Os X" and version "10.7.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.7.1 Search vendor "Apple" for product "Mac Os X" and version "10.7.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.7.2 Search vendor "Apple" for product "Mac Os X" and version "10.7.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.7.3 Search vendor "Apple" for product "Mac Os X" and version "10.7.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.7.4 Search vendor "Apple" for product "Mac Os X" and version "10.7.4" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | 10.7.5 Search vendor "Apple" for product "Mac Os X" and version "10.7.5" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Server Search vendor "Apple" for product "Mac Os X Server" | 10.7.0 Search vendor "Apple" for product "Mac Os X Server" and version "10.7.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Server Search vendor "Apple" for product "Mac Os X Server" | 10.7.1 Search vendor "Apple" for product "Mac Os X Server" and version "10.7.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Server Search vendor "Apple" for product "Mac Os X Server" | 10.7.2 Search vendor "Apple" for product "Mac Os X Server" and version "10.7.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Server Search vendor "Apple" for product "Mac Os X Server" | 10.7.3 Search vendor "Apple" for product "Mac Os X Server" and version "10.7.3" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Server Search vendor "Apple" for product "Mac Os X Server" | 10.7.4 Search vendor "Apple" for product "Mac Os X Server" and version "10.7.4" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Server Search vendor "Apple" for product "Mac Os X Server" | 10.7.5 Search vendor "Apple" for product "Mac Os X Server" and version "10.7.5" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Tvos Search vendor "Apple" for product "Tvos" | <= 6.1 Search vendor "Apple" for product "Tvos" and version " <= 6.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Tvos Search vendor "Apple" for product "Tvos" | 6.0 Search vendor "Apple" for product "Tvos" and version "6.0" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Tvos Search vendor "Apple" for product "Tvos" | 6.0.1 Search vendor "Apple" for product "Tvos" and version "6.0.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Tvos Search vendor "Apple" for product "Tvos" | 6.0.2 Search vendor "Apple" for product "Tvos" and version "6.0.2" | - |
Affected
| ||||||