CVE-2014-1267: Input Validation
The Configuration Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 does not properly evaluate the expiration date of a mobile configuration profile, which allows attackers to bypass intended access restrictions by using a profile after the date has passed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apple iOS Configuration Profilesto a version that resolves this vulnerability.Fixed in 7.1 - Upgrade
Upgrade
Apple TV Configuration Profilesto a version that resolves this vulnerability.Fixed in 6.1
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1267?
CVE-2014-1267 is classified as a medium severity vulnerability due to its potential to allow attackers to bypass access restrictions.
How do I fix CVE-2014-1267?
To mitigate CVE-2014-1267, update to the latest versions of Apple iOS (7.1 or later) or tvOS (6.1 or later) to ensure proper expiration validation.
What does CVE-2014-1267 affect?
CVE-2014-1267 affects Apple iOS versions prior to 7.1 and Apple TV versions prior to 6.1, specifically related to configuration profile expiration handling.
What kind of attack can CVE-2014-1267 facilitate?
CVE-2014-1267 can facilitate unauthorized access by allowing attackers to use an expired mobile configuration profile for continued access.
Are there any known exploits for CVE-2014-1267?
While specific exploits for CVE-2014-1267 are not publicly documented, the vulnerability presents a risk for attacks targeting access controls.