Vulnerability Details : CVE-2014-4494
Springboard in Apple iOS before 8.1.3 does not properly validate signatures when determining whether to solicit an app trust decision from the user, which allows attackers to bypass intended first-launch restrictions by leveraging access to an enterprise distribution certificate for signing a crafted app.
Vulnerability category: Input validation
Exploit prediction scoring system (EPSS) score for CVE-2014-4494
Probability of exploitation activity in the next 30 days: 0.33%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 67 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-4494
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2014-4494
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-4494
-
http://www.securitytracker.com/id/1031652
Apple iOS Flaws Let Remote Users and Applications Bypass Security Restrictions - SecurityTracker
-
http://support.apple.com/HT204245
About the security content of iOS 8.1.3 - Apple SupportVendor Advisory
-
http://lists.apple.com/archives/security-announce/2015/Jan/msg00001.html
Apple - Lists.apple.comVendor Advisory
Products affected by CVE-2014-4494
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*