CVE-2014-4492
Apple Mac OSX networkd - 'effective_audit_token' XPC Type Confusion Sandbox Escape
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an _networkd context via a crafted XPC message from a sandboxed app, as demonstrated by lack of verification of the XPC dictionary data type.
libnetcore en Apple iOS anterior a 8.1.3, Apple OS X anterior a 10.10.2, y Apple TV anterior a 7.0.3 no verifica que ciertos valores tienen los tipos de datos esperados, lo que permite a atacantes ejecutar código arbitrario en un contexto _networkd a través de un mensaje XPC manipulado de una aplicación con sandbox, tal y como fue demostrado mediante la falta de verificación de un tipo de datos del diccionario de XPC.
networkd is the system daemon which implements the com.apple.networkd XPC service. It's unsandboxed but runs as its own user. com.apple.networkd is reachable from many sandboxes including the Safari WebProcess and ntpd (plus all those which allow system-network). networkd parses quite complicated XPC messages and there are many cases where xpc_dictionary_get_value and xpc_array_get_value are used without subsequent checking of the type of the returned value.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2014-06-20 CVE Reserved
- 2015-01-20 First Exploit
- 2015-01-28 CVE Published
- 2024-07-26 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-19: Data Processing Errors
CAPEC
References (11)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/134393/Mac-OS-X-Networkd-XPC-Type-Confusion-Sandbox-Escape.html | X_refsource_misc |
|
| http://www.osvdb.org/114862 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/35847 | 2015-01-20 | |
| http://www.exploit-db.com/exploits/35847 | 2024-08-06 | |
| https://code.google.com/p/google-security-research/issues/detail?id=92 | 2024-08-06 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.html | 2019-03-08 | |
| http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html | 2019-03-08 | |
| http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html | 2019-03-08 | |
| http://support.apple.com/HT204244 | 2019-03-08 | |
| http://support.apple.com/HT204245 | 2019-03-08 | |
| http://support.apple.com/HT204246 | 2019-03-08 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apple Search vendor "Apple" | Iphone Os Search vendor "Apple" for product "Iphone Os" | <= 8.1.2 Search vendor "Apple" for product "Iphone Os" and version " <= 8.1.2" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Mac Os X Search vendor "Apple" for product "Mac Os X" | <= 10.10.1 Search vendor "Apple" for product "Mac Os X" and version " <= 10.10.1" | - |
Affected
| ||||||
| Apple Search vendor "Apple" | Tvos Search vendor "Apple" for product "Tvos" | <= 7.0.1 Search vendor "Apple" for product "Tvos" and version " <= 7.0.1" | - |
Affected
| ||||||