CVE-2014-1266
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 5.7%
The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.
Produtos afetados
n/a · n/aReferências
http://it.slashdot.org/comments.pl?sid=4821073&cid=46310187https://news.ycombinator.com/item?id=7281378http://support.apple.com/kb/HT6146http://support.apple.com/kb/HT6147http://support.apple.com/kb/HT6148http://support.apple.com/kb/HT6150https://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-23.htmlhttps://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-24.htmlhttps://www.imperialviolet.org/2014/02/22/applebug.html