CVE-2014-1296
First published: Wed Apr 23 2014(Updated: )
CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| iOS | <=7.1 | |
| iOS | =7.0 | |
| iOS | =7.0.1 | |
| iOS | =7.0.2 | |
| iOS | =7.0.3 | |
| iOS | =7.0.4 | |
| iOS | =7.0.5 | |
| iOS | =7.0.6 | |
| Apple iOS and macOS | =10.8.0 | |
| Apple iOS and macOS | =10.8.1 | |
| Apple iOS and macOS | =10.8.2 | |
| Apple iOS and macOS | =10.8.3 | |
| Apple iOS and macOS | =10.8.4 | |
| Apple iOS and macOS | =10.8.5 | |
| Apple iOS and macOS | =10.8.5-supplemental_update | |
| Apple iOS and macOS | <=10.9.2 | |
| Apple iOS and macOS | =10.9 | |
| Apple iOS and macOS | =10.9.1 | |
| Apple iOS and macOS | =10.7.0 | |
| Apple iOS and macOS | =10.7.1 | |
| Apple iOS and macOS | =10.7.2 | |
| Apple iOS and macOS | =10.7.3 | |
| Apple iOS and macOS | =10.7.4 | |
| Apple iOS and macOS | =10.7.5 | |
| Apple macOS Server | =10.7.0 | |
| Apple macOS Server | =10.7.1 | |
| Apple macOS Server | =10.7.2 | |
| Apple macOS Server | =10.7.3 | |
| Apple macOS Server | =10.7.4 | |
| Apple macOS Server | =10.7.5 | |
| tvOS | <=6.1 | |
| tvOS | =6.0 | |
| tvOS | =6.0.1 | |
| tvOS | =6.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-1296?
CVE-2014-1296 has been assigned a severity rating that allows remote attackers to bypass access restrictions affecting Apple iOS, macOS, and tvOS.
How do I fix CVE-2014-1296?
To fix CVE-2014-1296, update your Apple device to the latest version of the operating system, which addresses this vulnerability.
What systems are affected by CVE-2014-1296?
CVE-2014-1296 affects Apple iOS versions prior to 7.1.1, macOS versions up to 10.9.2, and tvOS versions prior to 6.1.1.
What kind of attacks can exploit CVE-2014-1296?
Exploitation of CVE-2014-1296 can allow remote attackers to manipulate HTTP Set-Cookie headers, leading to unauthorized access.
Is CVE-2014-1296 a common vulnerability?
CVE-2014-1296 is recognized as a notable vulnerability due to its impact on multiple Apple platforms, affecting a wide user base.
- agent/type
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/apple
- canonical/ios
- version/ios/7.1
- version/ios/7.0
- version/ios/7.0.1
- version/ios/7.0.2
- version/ios/7.0.3
- version/ios/7.0.4
- version/ios/7.0.5
- version/ios/7.0.6
- canonical/apple ios and macos
- version/apple ios and macos/10.8.0
- version/apple ios and macos/10.8.1
- version/apple ios and macos/10.8.2
- version/apple ios and macos/10.8.3
- version/apple ios and macos/10.8.4
- version/apple ios and macos/10.8.5
- version/apple ios and macos/10.8.5-supplemental_update
- version/apple ios and macos/10.9.2
- version/apple ios and macos/10.9
- version/apple ios and macos/10.9.1
- version/apple ios and macos/10.7.0
- version/apple ios and macos/10.7.1
- version/apple ios and macos/10.7.2
- version/apple ios and macos/10.7.3
- version/apple ios and macos/10.7.4
- version/apple ios and macos/10.7.5
- canonical/apple macos server
- version/apple macos server/10.7.0
- version/apple macos server/10.7.1
- version/apple macos server/10.7.2
- version/apple macos server/10.7.3
- version/apple macos server/10.7.4
- version/apple macos server/10.7.5
- canonical/tvos
- version/tvos/6.1
- version/tvos/6.0
- version/tvos/6.0.1
- version/tvos/6.0.2