Lucene search

[email protected]CVE-2014-4364

HistorySep 18, 2014 - 10:55 a.m.

CVE-2014-4364

2014-09-1810:55:08

CWE-310

[email protected]

web.nvd.nist.gov

cve-2014-4364

apple

ios

apple tv

802.1x

authentication

remote attack

2.9 Low

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:M/Au:N/C:P/I:N/A:N

5.6 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

5.5 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.4%

JSON

The 802.1X subsystem in Apple iOS before 8 and Apple TV before 7 does not require strong authentication methods, which allows remote attackers to calculate credentials by offering LEAP authentication from a crafted Wi-Fi AP and then performing a cryptographic attack against the MS-CHAPv1 hash.

Affected configurations

NVD

Node

appleiphone_osRange≤7.1.2

appleiphone_osMatch7.0

appleiphone_osMatch7.0.1

appleiphone_osMatch7.0.2

appleiphone_osMatch7.0.3

appleiphone_osMatch7.0.4

appleiphone_osMatch7.0.5

appleiphone_osMatch7.0.6

appleiphone_osMatch7.1

appleiphone_osMatch7.1.1

Node

appletvosRange≤6.2

appletvosMatch6.0

appletvosMatch6.0.1

appletvosMatch6.0.2

appletvosMatch6.1

appletvosMatch6.1.1

appletvosMatch6.1.2

CPENameOperatorVersion
apple:iphone_osapple iphone osle7.1.2
apple:iphone_osapple iphone oseq7.0
apple:iphone_osapple iphone oseq7.0.1
apple:iphone_osapple iphone oseq7.0.2
apple:iphone_osapple iphone oseq7.0.3
apple:iphone_osapple iphone oseq7.0.4
apple:iphone_osapple iphone oseq7.0.5
apple:iphone_osapple iphone oseq7.0.6
apple:iphone_osapple iphone oseq7.1
apple:iphone_osapple iphone oseq7.1.1

CPE	Name	Operator	Version
apple:iphone_os	apple iphone os	le	7.1.2
apple:iphone_os	apple iphone os	eq	7.0
apple:iphone_os	apple iphone os	eq	7.0.1
apple:iphone_os	apple iphone os	eq	7.0.2
apple:iphone_os	apple iphone os	eq	7.0.3
apple:iphone_os	apple iphone os	eq	7.0.4
apple:iphone_os	apple iphone os	eq	7.0.5
apple:iphone_os	apple iphone os	eq	7.0.6
apple:iphone_os	apple iphone os	eq	7.1
apple:iphone_os	apple iphone os	eq	7.1.1

References

archives.neohapsis.com/archives/bugtraq/2014-09/0106.html

archives.neohapsis.com/archives/bugtraq/2014-09/0107.html

archives.neohapsis.com/archives/bugtraq/2014-10/0101.html

support.apple.com/kb/HT6441

support.apple.com/kb/HT6442

www.securityfocus.com/bid/69882

www.securityfocus.com/bid/69913

www.securitytracker.com/id/1030866

exchange.xforce.ibmcloud.com/vulnerabilities/96097

support.apple.com/kb/HT6535

2.9 Low

CVSS2

Attack Vector

ADJACENT_NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:M/Au:N/C:P/I:N/A:N

5.6 Medium

CVSS3

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

5.5 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.4%

JSON

Related for CVE-2014-4364

prion1 cvelist1 nvd1 securityvulns6 nessus2 openvas1