Sign-up

ID

VAR-201411-0494


CVE

CVE-2014-4463


TITLE

Apple iOS Vulnerabilities that bypass lock screen protection mechanisms

Trust: 0.8

sources: JVNDB: JVNDB-2014-005519

DESCRIPTION

Apple iOS before 8.1.1 allows physically proximate attackers to bypass the lock-screen protection mechanism, and view or transmit a Photo Library photo, via the FaceTime "Leave a Message" feature. Apple iOS is prone to a local security-bypass vulnerability. An attacker with physical access to a device can exploit this issue to access photos in the Photo Library. Successful exploits may lead to other attacks. This issue is fixed in iOS 8.1.1. Apple iOS is an operating system developed by Apple (Apple) for mobile devices. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-11-17-1 iOS 8.1.1 iOS 8.1.1 is now available and addresses the following: CFNetwork Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Website cache may not be fully cleared after leaving private browsing Description: A privacy issue existed where browsing data could remain in the cache after leaving private browsing. This issue was addressed through a change in caching behavior. CVE-ID CVE-2014-4460 dyld Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A local user may be able to execute unsigned code Description: A state management issue existed in the handling of Mach-O executable files with overlapping segments. This issue was addressed through improved validation of segment sizes. CVE-ID CVE-2014-4455 : @PanguTeam Kernel Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A validation issue existed in the handling of certain metadata fields of IOSharedDataQueue objects. This issue was addressed through relocation of the metadata. CVE-ID CVE-2014-4461 : @PanguTeam Lock Screen Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: An attacker in possession of a device may exceed the maximum number of failed passcode attempts Description: In some circumstances, the failed passcode attempt limit was not enforced. This issue was addressed through additional enforcement of this limit. CVE-ID CVE-2014-4451 : Stuart Ryan of University of Technology, Sydney Lock Screen Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A person with physical access to the phone may be able to access photos in the Photo Library Description: The Leave a Message option in FaceTime may have allowed viewing and sending photos from the device. This issue was addressed through improved state management. CVE-ID CVE-2014-4463 Sandbox Profiles Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: A malicious application may be able to launch arbitrary binaries on a trusted device Description: A permissions issue existed with the debugging functionality for iOS that allowed the spawning of applications on trusted devices that were not being debugged. This was addressed by changes to debugserver's sandbox. CVE-ID CVE-2014-4457 : @PanguTeam Spotlight Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Unnecessary information is included as part of the initial connection between Spotlight or Safari and the Spotlight Suggestions servers Description: The initial connection made by Spotlight or Safari to the Spotlight Suggestions servers included a user's approximate location before a user entered a query. This issue was addressed by removing this information from the initial connection and only sending the user's approximate location as part of queries. CVE-ID CVE-2014-4453 : Ashkan Soltani WebKit Available for: iPhone 4s and later, iPod touch (5th generation) and later, iPad 2 and later Impact: Visiting a maliciously crafted website may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. CVE-ID CVE-2014-4452 CVE-2014-4462 Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "8.1.1". Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJUajYFAAoJEBcWfLTuOo7tGxsP/RccLDIt/LMluE7bcG9NSz4w tw8AHhkfiDZ+T/nnhqAiS2RQ2cgSfMg8KVzCtbrtXrEgebFTUVlos1vIjMSEkqgp GmSDFn64vZIExVo8w9iTLG/AdW0sERz3h2xVSEr/154AG2SHnL1+nY5abHHycTIG Uuo60+t2OVPtREIcrffmwj6hsYAX1dLAI0QV7PdvjpCc82Snf+yJZCFyjQ23AkQn P9NElRnK+pbhqqnfZXKO3Hbgf5IkuzeSl4Rwrj8nehu+hcEp32a8zH2wbbzDsFTO AyM02SAGLmBM30QcoJYK/s0lCGJBbr9rM5+9dUH6KXc8q/OTLJ0YETdHqwsO29cf XEl5uQT4IHGjlij2f/xYsa0OXbLfyXNeaT5YGlUSIUKNFXRhD6rPccL5V5Ktjnac JxOv0og5L4OBtPykc0XhmRqTIkEC4Cf3RmewA+b8ivsp/LuPjYsdfN1tZ8MXa1a8 C7hhUQSSSTtA3v7oO/LpU8Qw7kV79SkeQcYYTP07QI87cU2HHDejBHCfGjK9cz65 Uf4Sa/leCT0JyQYnx0XOafFTzxIJ2641HtTjuQ3sTKungkE5CR/KyVk2Wul3YqcA Meo//heYRLNa1XANfzV70TcsnQ2lcirzOqiufC+jljsfkQtlAXWim9H9BCc4102b ugp50lE7/p+CbwYvqaZg =x/RM -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2014-4463 // JVNDB: JVNDB-2014-005519 // BID: 71141 // VULHUB: VHN-72403 // PACKETSTORM: 129158

AFFECTED PRODUCTS

vendor:applemodel:iphone osscope:eqversion:8.0

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:8.0.2

Trust: 1.6

vendor:applemodel:iphone osscope:eqversion:8.0.1

Trust: 1.6

vendor:applemodel:iphone osscope:lteversion:8.1

Trust: 1.0

vendor:applemodel:iosscope:ltversion:8.1.1 (ipad 2 or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:8.1.1 (iphone 4s or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:8.1.1 (ipod touch first 5 after generation )

Trust: 0.8

vendor:applemodel:iphone osscope:eqversion:8.1

Trust: 0.6

vendor:applemodel:ipod touchscope:eqversion:0

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:0

Trust: 0.3

vendor:applemodel:ipadscope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.10

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.0

Trust: 0.3

sources: BID: 71141 // JVNDB: JVNDB-2014-005519 // CNNVD: CNNVD-201411-316 // NVD: CVE-2014-4463

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-4463
value: LOW

Trust: 1.0

NVD: CVE-2014-4463
value: LOW

Trust: 0.8

CNNVD: CNNVD-201411-316
value: LOW

Trust: 0.6

VULHUB: VHN-72403
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2014-4463
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-72403
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-72403 // JVNDB: JVNDB-2014-005519 // CNNVD: CNNVD-201411-316 // NVD: CVE-2014-4463

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

sources: VULHUB: VHN-72403 // JVNDB: JVNDB-2014-005519 // NVD: CVE-2014-4463

THREAT TYPE

local

Trust: 0.9

sources: BID: 71141 // CNNVD: CNNVD-201411-316

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201411-316

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-005519

PATCH
title:APPLE-SA-2014-11-17-1url:http://lists.apple.com/archives/security-announce/2014/Nov/msg00000.html
Trust: 0.8
title:HT6590url:https://support.apple.com/en-eu/HT6590
Trust: 0.8
title:HT6590url:https://support.apple.com/ja-jp/HT6590
Trust: 0.8
title:OSXUpd10.10.1url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=52402
Trust: 0.6
title:AppleTV3,1_7.0.2_12B435_Restoreurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=52403
Trust: 0.6
title:iPhone7,2_8.1.1_12B436_Restoreurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=52401
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2014-005519 // 
            
            
            
            CNNVD: CNNVD-201411-316

EXTERNAL IDS
db:NVDid:CVE-2014-4463
Trust: 2.9
db:BIDid:71141
Trust: 1.4
db:SECTRACKid:1031232
Trust: 1.1
db:SECUNIAid:62504
Trust: 1.1
db:JVNDBid:JVNDB-2014-005519
Trust: 0.8
db:CNNVDid:CNNVD-201411-316
Trust: 0.7
db:VULHUBid:VHN-72403
Trust: 0.1
db:PACKETSTORMid:129158
Trust: 0.1
sources:
            
            
            VULHUB: VHN-72403 // 
            
            
            
            BID: 71141 // 
            
            
            
            JVNDB: JVNDB-2014-005519 // 
            
            
            
            PACKETSTORM: 129158 // 
            
            
            
            CNNVD: CNNVD-201411-316 // 
            
            
            
            NVD: CVE-2014-4463

REFERENCES
url:http://lists.apple.com/archives/security-announce/2014/nov/msg00000.html
Trust: 1.7
url:http://www.securityfocus.com/bid/71141
Trust: 1.1
url:https://support.apple.com/en-us/ht204418
Trust: 1.1
url:https://support.apple.com/en-us/ht6590
Trust: 1.1
url:http://www.securitytracker.com/id/1031232
Trust: 1.1
url:http://secunia.com/advisories/62504
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/98778
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4463
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4463
Trust: 0.8
url:http://www.apple.com/ios/
Trust: 0.3
url:http://www.apple.com/ipad/
Trust: 0.3
url:http://www.apple.com/iphone/
Trust: 0.3
url:http://www.apple.com/ipodtouch/
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2014-4460
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4462
Trust: 0.1
url:https://www.apple.com/itunes/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4455
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4457
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4461
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4453
Trust: 0.1
url:https://www.apple.com/support/security/pgp/
Trust: 0.1
url:http://support.apple.com/kb/ht1222
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4463
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4451
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4452
Trust: 0.1
url:http://gpgtools.org
Trust: 0.1
sources:
            
            
            VULHUB: VHN-72403 // 
            
            
            
            BID: 71141 // 
            
            
            
            JVNDB: JVNDB-2014-005519 // 
            
            
            
            PACKETSTORM: 129158 // 
            
            
            
            CNNVD: CNNVD-201411-316 // 
            
            
            
            NVD: CVE-2014-4463

CREDITS
Apple
Trust: 0.4
sources:
            
            
            BID: 71141 // 
            
            
            
            PACKETSTORM: 129158

SOURCES
db:VULHUBid:VHN-72403
db:BIDid:71141
db:JVNDBid:JVNDB-2014-005519
db:PACKETSTORMid:129158
db:CNNVDid:CNNVD-201411-316
db:NVDid:CVE-2014-4463

LAST UPDATE DATE
2025-04-13T21:10:40.363000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-72403date:2017-08-29T00:00:00
db:BIDid:71141date:2014-12-10T14:57:00
db:JVNDBid:JVNDB-2014-005519date:2014-11-19T00:00:00
db:CNNVDid:CNNVD-201411-316date:2014-11-19T00:00:00
db:NVDid:CVE-2014-4463date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-72403date:2014-11-18T00:00:00
db:BIDid:71141date:2014-11-17T00:00:00
db:JVNDBid:JVNDB-2014-005519date:2014-11-19T00:00:00
db:PACKETSTORMid:129158date:2014-11-19T00:41:28
db:CNNVDid:CNNVD-201411-316date:2014-11-19T00:00:00
db:NVDid:CVE-2014-4463date:2014-11-18T11:59:10.733