CVE-2014-1266: Input Validation
The SSLVerifySignedServerKeyExchange function in libsecurityssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1266?
CVE-2014-1266 has been rated as a medium severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2014-1266?
To fix CVE-2014-1266, update affected Apple products to the latest versions provided by Apple.
Which versions are affected by CVE-2014-1266?
CVE-2014-1266 affects Apple iOS versions 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and OS X 10.9.x before 10.9.2.
What products are impacted by CVE-2014-1266?
The impacted products from CVE-2014-1266 include iPhones, iPads, Apple TV devices, and macOS computers.
What type of attack is possible with CVE-2014-1266?
CVE-2014-1266 allows for a man-in-the-middle attack due to improper signature verification in SSL connections.