← back
CVE-2014-4492

CVE-2014-4492

EPSS 19.7%
libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an _networkd context via a crafted XPC message from a sandboxed app, as demonstrated by lack of verification of the XPC dictionary data type.
Affected products
n/a · n/a
public PoCs found — 3
cve_referencepacketstormsecurity.com/files/134393/Mac-OS-X-Networkd-XPC-Type-Confusion-Sandbox-Escape.htmlunverifiedcve_referencewww.exploit-db.com/exploits/35847unverifiedexploitdbwww.exploit-db.com/exploits/35847unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://lists.apple.com/archives/security-announce/2015/Jan/msg00000.htmlhttp://lists.apple.com/archives/security-announce/2015/Jan/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2015/Jan/msg00003.htmlhttp://packetstormsecurity.com/files/134393/Mac-OS-X-Networkd-XPC-Type-Confusion-Sandbox-Escape.htmlhttps://code.google.com/p/google-security-research/issues/detail?id=92http://support.apple.com/HT204244http://support.apple.com/HT204245http://support.apple.com/HT204246http://www.exploit-db.com/exploits/35847http://www.osvdb.org/114862