CVEvulnerability

CVE-2014-1266

7.4 HIGH Published 2014-02-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-02-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
CWE-295

Description

The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.

Affected configurations

• apple iphone os (>= 6.0 < 6.1.6) • apple iphone os (>= 7.0 < 7.0.6) • apple mac os x (>= 10.9 < 10.9.2) • apple tvos (>= 6.0 < 6.0.2)

Related

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

Referenced by CWE · observed example (10)

  • CWE-1114 Inappropriate Whitespace Style weakness
  • CWE-1164 Irrelevant Code weakness
  • CWE-295 Improper Certificate Validation weakness
  • CWE-300 Channel Accessible by Non-Endpoint weakness
  • CWE-393 Return of Wrong Status Code weakness
  • CWE-483 Incorrect Block Delimitation weakness
  • CWE-561 Dead Code weakness
  • CWE-691 Insufficient Control Flow Management weakness
  • CWE-705 Incorrect Control Flow Scoping weakness
  • CWE-923 Improper Restriction of Communication Channel to Intended Endpoints weakness

References