Summaryinfo

A vulnerability was found in Apple Mac OS X 10.8.5/10.9.5/10.10/10.10.1 and classified as critical. This affects an unknown part of the component IOAcceleratorFamily. Executing a manipulation can lead to null pointer dereference. The identification of this vulnerability is CVE-2014-4486. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Apple Mac OS X 10.8.5/10.9.5/10.10/10.10.1 (Operating System). It has been declared as critical. This vulnerability affects an unknown code of the component IOAcceleratorFamily. The manipulation with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was shared 01/27/2015 by Ian Beer with Google Project Zero as HT204244 as confirmed advisory (Website). The advisory is shared for download at support.apple.com. This vulnerability was named CVE-2014-4486 since 06/20/2014. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The advisory points out:

A null pointer dereference existed in IOAcceleratorFamily's handling of certain IOService userclient types. This issue was addressed through improved validation of IOAcceleratorFamily contexts.

The vulnerability scanner Nessus provides a plugin with the ID 81145 (Apple TV < 7.0.3 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Misc.. The commercial vulnerability scanner Qualys is able to test this issue with plugin 123193 (Apple Mac OS X v10.10.2 and Security Update 2015-001 Not Installed (APPLE-SA-2015-01-27-4)).

Upgrading to version 10.10.2 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at X-Force (100503) and Tenable (81145). Additional details are provided at us-cert.gov. The entries VDB-67778, VDB-68077, VDB-68232 and VDB-68339 are related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Apple

Name

• Mac OS X

Version

• 10.8.5
• 10.9.5
• 10.10
• 10.10.1

License

• commercial

Support

• end of life

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion