CVE-2014-1295: Medium severity Apple iPhone OS vulnerability
Secure Transport in Apple iOS before 7.1.1, Apple OS X 10.8.x and 10.9.x through 10.9.2, and Apple TV before 6.1.1 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple handshake attack."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1295?
CVE-2014-1295 has been classified as a high severity vulnerability due to its potential to allow man-in-the-middle attacks.
How do I fix CVE-2014-1295?
To address CVE-2014-1295, update your Apple iOS, macOS, or tvOS to the latest version that is not affected by the vulnerability.
Which versions are affected by CVE-2014-1295?
CVE-2014-1295 affects Apple iOS versions before 7.1.1, macOS 10.8.x and 10.9.x before 10.9.2, and tvOS before 6.1.1.
What type of attack does CVE-2014-1295 enable?
CVE-2014-1295 enables man-in-the-middle attacks, allowing attackers to intercept and access sensitive information during network sessions.
Is CVE-2014-1295 an implementation flaw?
Yes, CVE-2014-1295 is an implementation flaw in Apple's Secure Transport that fails to verify server X.509 certificates during renegotiation.