CVE-2014-1266 in iOS

Resumen (Inglés)

The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Reservar

2014-01-08

Divulgación

2014-02-22

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
12370	Apple iOS SSL SSLVerifySignedServerKeyExchange goto fail escalada de privilegios	20	Alto	Arreglo oficial	CVE-2014-1266

Fuentes

• MITRE
• NVD
• CVE Details