CVE-2014-1347: Medium severity Apple iTunes vulnerability
Published May 18, 2014
·Updated
Apple iTunes before 11.2.1 on OS X sets world-writable permissions for /Users and /Users/Shared during reboots, which allows local users to modify files, and consequently obtain access to arbitrary user accounts, via standard filesystem operations.
Affected Software
14 affected components
Apple iTunes<=11.2
Apple iTunes=11.0
Apple iTunes=11.0.1
Apple iTunes=11.0.2
Apple iTunes=11.0.3
Apple iTunes=11.0.4
Apple iTunes=11.0.5
Apple iTunes=11.1
Apple iTunes=11.1.1
Apple iTunes=11.1.2
Apple iTunes=11.1.3
Apple iTunes=11.1.4
Apple iTunes=11.1.5
Apple iOS and macOS
Any of the following
Event History
May 18, 2014
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Data Sourced
via NVD·11:12 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-1347?
CVE-2014-1347 is classified as a medium severity vulnerability due to its potential local exploitation.
2
How do I fix CVE-2014-1347?
To fix CVE-2014-1347, update Apple iTunes to version 11.2.1 or later.
3
What platforms are affected by CVE-2014-1347?
CVE-2014-1347 affects Apple iTunes versions prior to 11.2.1 on OS X.
4
What type of vulnerability is CVE-2014-1347?
CVE-2014-1347 is a local privilege escalation vulnerability caused by improper file permissions.
5
Can CVE-2014-1347 be exploited remotely?
No, CVE-2014-1347 can only be exploited by local users with access to the affected system.