Sign-up

ID

VAR-201403-0266


CVE

CVE-2014-1287


TITLE

Apple iOS and Apple TV of USB Vulnerability in arbitrary code execution on host

Trust: 0.8

sources: JVNDB: JVNDB-2014-001673

DESCRIPTION

USB Host in Apple iOS before 7.1 and Apple TV before 6.1 allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted USB messages. Apple iOS and TV are prone to multiple vulnerabilities. Attackers can exploit these issues to execute arbitrary code, gain unauthorized access, bypass security restrictions, and perform other attacks. Failed attacks may cause denial-of-service conditions. The following products are vulnerable: Apple iOS versions prior to 7.1 Apple TV versions prior to 6.1. The vulnerability is caused by memory corruption when the program processes USB information. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-03-10-2 Apple TV 6.1 Apple TV 6.1 is now available and addresses the following: Apple TV Available for: Apple TV 2nd generation and later Impact: An attacker with access to an Apple TV may access sensitive user information from logs Description: Sensitive user information was logged. This issue was addressed by logging less information. CVE-ID CVE-2014-1279 : David Schuetz working at Intrepidus Group Apple TV Available for: Apple TV 2nd generation and later Impact: Profile expiration dates were not honored Description: Expiration dates of mobile configuration profiles were not evaluated correctly. The issue was resolved through improved handling of configuration profiles. CVE-ID CVE-2014-1267 Apple TV Available for: Apple TV 2nd generation and later Impact: A malicious application can cause an unexpected system termination Description: A reachable assertion issue existed in CoreCapture's handling of IOKit API calls. The issue was addressed through additional validation of input from IOKit. CVE-ID CVE-2014-1271 : Filippo Bigarella Apple TV Available for: Apple TV 2nd generation and later Impact: A local user may be able to change permissions on arbitrary files Description: CrashHouseKeeping followed symbolic links while changing permissions on files. This issue was addressed by not following symbolic links when changing permissions on files. CVE-ID CVE-2014-1272 : evad3rs Apple TV Available for: Apple TV 2nd generation and later Impact: Code signing requirements may be bypassed Description: Text relocation instructions in dynamic libraries may be loaded by dyld without code signature validation. This issue was addressed by ignoring text relocation instructions. CVE-ID CVE-2014-1273 : evad3rs Apple TV Available for: Apple TV 2nd generation and later Impact: Viewing a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in the handling of JPEG2000 images in PDF files. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-1275 : Felix Groebert of the Google Security Team Apple TV Available for: Apple TV 2nd generation and later Impact: Viewing a maliciously crafted TIFF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in libtiff's handling of TIFF images. This issue was addressed through additional validation of TIFF images. CVE-ID CVE-2012-2088 Apple TV Available for: Apple TV 2nd generation and later Impact: Viewing a maliciously crafted JPEG file may lead to the disclosure of memory contents Description: An uninitialized memory access issue existed in libjpeg's handling of JPEG markers, resulting in the disclosure of memory contents. This issue was addressed through additional validation of JPEG files. CVE-ID CVE-2013-6629 : Michal Zalewski Apple TV Available for: Apple TV 2nd generation and later Impact: A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel Description: An out of bounds memory access issue existed in the ARM ptmx_get_ioctl function. This issue was addressed through improved bounds checking. CVE-ID CVE-2014-1278 : evad3rs Apple TV Available for: Apple TV 2nd generation and later Impact: A configuration profile may be hidden from the user Description: A configuration profile with a long name could be loaded onto the device but was not displayed in the profile UI. The issue was addressed through improved handling of profile names. This issue was addressed through additional validation of USB messages. CVE-ID CVE-2014-1287 : Andy Davis of NCC Group WebKit Available for: Apple TV 2nd generation and later Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. CVE-ID CVE-2013-2909 : Atte Kettunen of OUSPG CVE-2013-2926 : cloudfuzzer CVE-2013-2928 : Google Chrome Security Team CVE-2013-5196 : Google Chrome Security Team CVE-2013-5197 : Google Chrome Security Team CVE-2013-5198 : Apple CVE-2013-5199 : Apple CVE-2013-5225 : Google Chrome Security Team CVE-2013-5228 : Keen Team (@K33nTeam) working with HP's Zero Day Initiative CVE-2013-6625 : cloudfuzzer CVE-2013-6635 : cloudfuzzer CVE-2014-1269 : Apple CVE-2014-1270 : Apple CVE-2014-1289 : Apple CVE-2014-1290 : ant4g0nist (SegFault) working with HP's Zero Day Initiative, Google Chrome Security Team CVE-2014-1291 : Google Chrome Security Team CVE-2014-1292 : Google Chrome Security Team CVE-2014-1293 : Google Chrome Security Team CVE-2014-1294 : Google Chrome Security Team Apple TV Available for: Apple TV 2nd generation and later Impact: Playing a maliciously crafted video could lead to the device becoming unresponsive Description: A null dereference issue existed in the handling of MPEG-4 encoded files. This issue was addressed through improved memory handling. CVE-ID CVE-2014-1280 : rg0rd Installation note: Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> General -> Update Software". To check the current version of software, select "Settings -> General -> About". Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJTGlvfAAoJEPefwLHPlZEw8GEP/ikatTiohUPRvpjubarcXePV z6ixKxmqUUvSy+AlyFTsCpvB1IEipSx5hKbYsxk5+4qAVsYG3VEpLNJKBarUHQN8 K1+I77xF5osLxrypWV6vEDqqFDcZyflumtvfdj7EmWf/FcWnOooRQt7wVVrzrCCh 40nfspy1YjNi1EO2p6dDlzi+yvEGF5CHg8R1zSFf7ozLPoCABlnbdzXxh+nYoI+E y65R4Eo7OBhVH5mJvBczjsHu/GljR3y/yi3NSnoV5ga5SfaaOlwa8emgNooeEs3u ghkfm2UxkjtdNkpVMfwFp35oLESIl6pMd2dtH2sU4MwRK3h8rvFeS/zJRZmwEIXO 5+9tNop1hmF52aVKRZAJ4/A9kbTC3pKd0PxvKsveB6Pgxbq9eDfueMC/r6FtOZDa is95LuLtf26h8xQt8FovY7Cm80ckOT4mJnvzfmpGmUSK4PHsNfJwfJOBa1yMHTJg CDfg+jGhHy7DJuawekzQjcvkz34YWg7Lp25ZJilvZf8dGB2R4g+hikdOrWKI4vFj x7LGZg6IPaHFt0MPgjnoV1FhABnXksD41uIAQP2LhDrHWnRgTeJoGwQ2SuZjSA6w T/DzhicTLq6MDSBjlbt6EJ4gtxWlYDfeAfJcFb/Aret+2L7570q18EkLRbiI8e6k 3NksAqBIKSpadFt+M8wt =xjrI -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2014-1287 // JVNDB: JVNDB-2014-001673 // BID: 66089 // VULHUB: VHN-69226 // PACKETSTORM: 125646

AFFECTED PRODUCTS

vendor:applemodel:iphone osscope:eqversion:7.0

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:7.0.4

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:7.0.5

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:7.0.1

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:7.0.2

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:7.0.3

Trust: 1.6

vendor:applemodel:tvosscope:lteversion:6.0.2

Trust: 1.0

vendor:applemodel:tvosscope:eqversion:6.0.1

Trust: 1.0

vendor:applemodel:iphone osscope:lteversion:7.0.6

Trust: 1.0

vendor:applemodel:tvosscope:eqversion:6.0

Trust: 1.0

vendor:applemodel:tvscope:ltversion:6.1 (apple tv first 2 after generation )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:7.1 (ipad 2 or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:7.1 (iphone 4 or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:7.1 (ipod touch first 5 after generation )

Trust: 0.8

vendor:applemodel:tvscope:eqversion:6.0.1

Trust: 0.6

vendor:applemodel:tvscope:eqversion:6.0.2

Trust: 0.6

vendor:applemodel:tvscope:eqversion:6.0

Trust: 0.6

vendor:applemodel:iphone osscope:eqversion:7.0.6

Trust: 0.6

vendor:applemodel:ipod touchscope:eqversion:0

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:4.0

Trust: 0.3

vendor:applemodel:ipadscope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.10

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.0

Trust: 0.3

vendor:applemodel:tvscope:eqversion:5.0

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.4

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.0

Trust: 0.3

vendor:applemodel:tvscope:eqversion:2.1

Trust: 0.3

sources: BID: 66089 // JVNDB: JVNDB-2014-001673 // CNNVD: CNNVD-201403-268 // NVD: CVE-2014-1287

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-1287
value: HIGH

Trust: 1.0

NVD: CVE-2014-1287
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201403-268
value: HIGH

Trust: 0.6

VULHUB: VHN-69226
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2014-1287
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-69226
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-69226 // JVNDB: JVNDB-2014-001673 // CNNVD: CNNVD-201403-268 // NVD: CVE-2014-1287

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-69226 // JVNDB: JVNDB-2014-001673 // NVD: CVE-2014-1287

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201403-268

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201403-268

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-001673

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-69226

PATCH
title:HT6163url:http://support.apple.com/kb/HT6163
Trust: 0.8
title:HT6162url:http://support.apple.com/kb/HT6162
Trust: 0.8
title:HT6162url:http://support.apple.com/kb/HT6162?viewlocale=ja_JP
Trust: 0.8
title:HT6163url:http://support.apple.com/kb/HT6163?viewlocale=ja_JP
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2014-001673

EXTERNAL IDS
db:NVDid:CVE-2014-1287
Trust: 2.9
db:JVNid:JVNVU94229445
Trust: 0.8
db:JVNid:JVNVU90170014
Trust: 0.8
db:JVNDBid:JVNDB-2014-001673
Trust: 0.8
db:CNNVDid:CNNVD-201403-268
Trust: 0.7
db:BIDid:66089
Trust: 0.3
db:SEEBUGid:SSVID-85627
Trust: 0.1
db:PACKETSTORMid:125727
Trust: 0.1
db:EXPLOIT-DBid:32333
Trust: 0.1
db:VULHUBid:VHN-69226
Trust: 0.1
db:PACKETSTORMid:125646
Trust: 0.1
sources:
            
            
            VULHUB: VHN-69226 // 
            
            
            
            BID: 66089 // 
            
            
            
            JVNDB: JVNDB-2014-001673 // 
            
            
            
            PACKETSTORM: 125646 // 
            
            
            
            CNNVD: CNNVD-201403-268 // 
            
            
            
            NVD: CVE-2014-1287

REFERENCES
url:http://support.apple.com/kb/ht6162
Trust: 1.7
url:http://support.apple.com/kb/ht6163
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-1287
Trust: 0.8
url:http://jvn.jp/vu/jvnvu94229445/
Trust: 0.8
url:http://jvn.jp/vu/jvnvu90170014/
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-1287
Trust: 0.8
url:http://www.apple.com/ios/
Trust: 0.3
url:http://www.apple.com/appletv/features.html
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-1291
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-6629
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-1269
Trust: 0.1
url:http://support.apple.com/kb/ht1222
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-1270
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-5228
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-1267
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-2928
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-5196
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-1271
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-1275
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2012-2088
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-1278
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-5198
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-1287
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-1273
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-2926
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-1279
Trust: 0.1
url:https://www.apple.com/support/security/pgp/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-1290
Trust: 0.1
url:http://gpgtools.org
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-6635
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-1289
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-1282
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-1280
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-2909
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-5225
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-6625
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-1272
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-5197
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-5199
Trust: 0.1
sources:
            
            
            VULHUB: VHN-69226 // 
            
            
            
            BID: 66089 // 
            
            
            
            JVNDB: JVNDB-2014-001673 // 
            
            
            
            PACKETSTORM: 125646 // 
            
            
            
            CNNVD: CNNVD-201403-268 // 
            
            
            
            NVD: CVE-2014-1287

CREDITS
Apple, Filippo Bigarella, evad3rs, Felix Groebert of the Google Security Team, rg0rd, Assaf Hefetz, Yair Amit and Adi Sharabani of Skycure and Andy Davis of NCC Group
Trust: 0.3
sources:
            
            
            BID: 66089

SOURCES
db:VULHUBid:VHN-69226
db:BIDid:66089
db:JVNDBid:JVNDB-2014-001673
db:PACKETSTORMid:125646
db:CNNVDid:CNNVD-201403-268
db:NVDid:CVE-2014-1287

LAST UPDATE DATE
2025-04-13T19:40:22.723000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-69226date:2019-03-08T00:00:00
db:BIDid:66089date:2014-03-10T00:00:00
db:JVNDBid:JVNDB-2014-001673date:2014-03-17T00:00:00
db:CNNVDid:CNNVD-201403-268date:2019-03-13T00:00:00
db:NVDid:CVE-2014-1287date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-69226date:2014-03-14T00:00:00
db:BIDid:66089date:2014-03-10T00:00:00
db:JVNDBid:JVNDB-2014-001673date:2014-03-17T00:00:00
db:PACKETSTORMid:125646date:2014-03-11T02:19:09
db:CNNVDid:CNNVD-201403-268date:2014-03-14T00:00:00
db:NVDid:CVE-2014-1287date:2014-03-14T10:55:06.207