CVE-2014-1296: Medium severity Apple iPhone OS vulnerability
CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1296?
CVE-2014-1296 has been assigned a severity rating that allows remote attackers to bypass access restrictions affecting Apple iOS, macOS, and tvOS.
How do I fix CVE-2014-1296?
To fix CVE-2014-1296, update your Apple device to the latest version of the operating system, which addresses this vulnerability.
What systems are affected by CVE-2014-1296?
CVE-2014-1296 affects Apple iOS versions prior to 7.1.1, macOS versions up to 10.9.2, and tvOS versions prior to 6.1.1.
What kind of attacks can exploit CVE-2014-1296?
Exploitation of CVE-2014-1296 can allow remote attackers to manipulate HTTP Set-Cookie headers, leading to unauthorized access.
Is CVE-2014-1296 a common vulnerability?
CVE-2014-1296 is recognized as a notable vulnerability due to its impact on multiple Apple platforms, affecting a wide user base.