ID CVE-2014-4389
Summary Integer overflow in IOKit in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted API arguments.
References
Vulnerable Configurations
  • Apple iPhone OS 7.0
    cpe:2.3:o:apple:iphone_os:7.0
  • Apple iPhone OS 7.0.1
    cpe:2.3:o:apple:iphone_os:7.0.1
  • Apple iPhone OS 7.0.2
    cpe:2.3:o:apple:iphone_os:7.0.2
  • Apple iPhone OS 7.0.3
    cpe:2.3:o:apple:iphone_os:7.0.3
  • Apple iPhone OS 7.0.4
    cpe:2.3:o:apple:iphone_os:7.0.4
  • Apple iPhone OS 7.0.5
    cpe:2.3:o:apple:iphone_os:7.0.5
  • Apple iPhone OS 7.0.6
    cpe:2.3:o:apple:iphone_os:7.0.6
  • Apple iPhone OS 7.1
    cpe:2.3:o:apple:iphone_os:7.1
  • Apple iPhone OS 7.1.1
    cpe:2.3:o:apple:iphone_os:7.1.1
  • Apple iPhone OS 7.1.2
    cpe:2.3:o:apple:iphone_os:7.1.2
  • Apple tvOS 6.0
    cpe:2.3:o:apple:tvos:6.0
  • Apple tvOS 6.0.1
    cpe:2.3:o:apple:tvos:6.0.1
  • Apple tvOS 6.0.2
    cpe:2.3:o:apple:tvos:6.0.2
  • Apple tvOS 6.1
    cpe:2.3:o:apple:tvos:6.1
  • Apple tvOS 6.1.1
    cpe:2.3:o:apple:tvos:6.1.1
  • Apple tvOS 6.1.2
    cpe:2.3:o:apple:tvos:6.1.2
  • Apple tvOS 6.2
    cpe:2.3:o:apple:tvos:6.2
  • Apple Mac OS X 10.9.4
    cpe:2.3:o:apple:mac_os_x:10.9.4
CVSS
Base: 9.3 (as of 14-12-2015 - 09:04)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
nessus via4
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2014-004.NASL
    description The remote host is running a version of Mac OS X 10.7 or 10.8 that does not have Security Update 2014-004 applied. This update contains several security-related fixes for the following components : - CoreGraphics - Intel Graphics Driver - IOAcceleratorFamily - IOHIDFamily - IOKit - Libnotify - OpenSSL - QT Media Foundation Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 77749
    published 2014-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77749
    title Mac OS X Multiple Vulnerabilities (Security Update 2014-004)
  • NASL family Misc.
    NASL id APPLETV_7_0.NASL
    description According to its banner, the remote Apple TV device is a version prior to 7. It is, therefore, affected by multiple vulnerabilities, the most serious of which can result in arbitrary code execution.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 77822
    published 2014-09-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77822
    title Apple TV < 7 Multiple Vulnerabilities
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_10_10_2.NASL
    description The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.2. This update contains several security-related fixes for the following components : - bash - Bluetooth - CFNetwork Cache - CommerceKit Framework - CoreGraphics - CoreSymbolication - CPU Software - FontParser - Foundation - Intel Graphics Driver - IOAcceleratorFamily - IOHIDFamily - IOKit - IOUSBFamily - Kernel - LaunchServices - libnetcore - LoginWindow - lukemftp - OpenSSL - Safari - SceneKit - Security - security_taskgate - Spotlight - SpotlightIndex - sysmond - UserAccountUpdater Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 81087
    published 2015-01-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81087
    title Mac OS X 10.10.x < 10.10.2 Multiple Vulnerabilities (POODLE)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_10_9_5.NASL
    description The remote host is running a version of Mac OS X 10.9.x that is prior to version 10.9.5. This update contains several security-related fixes for the following components : - apache_mod_php - Bluetooth - CoreGraphics - Foundation - Intel Graphics Driver - IOAcceleratorFamily - IOHIDFamily - IOKit - Kernel - Libnotify - OpenSSL - QT Media Foundation - ruby Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 77748
    published 2014-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77748
    title Mac OS X 10.9.x < 10.9.5 Multiple Vulnerabilities
refmap via4
apple
  • APPLE-SA-2014-09-17-1
  • APPLE-SA-2014-09-17-2
  • APPLE-SA-2015-01-27-4
bid
  • 69882
  • 69950
confirm
sectrack 1030866
xf appleios-cve20144389-overflow(96112)
Last major update 06-01-2017 - 22:00
Published 18-09-2014 - 06:55
Last modified 08-03-2019 - 11:06
Back to Top