CVE-2014-1266
- State
- Published
- Severity
- Not scored
- Published
- Feb 22, 2014
- Updated
- Aug 6, 2024
- Reserved
- Jan 8, 2014
Description
The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://support.apple.com/kb/HT6147
- http://support.apple.com/kb/HT6148
- https://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-23.html
- http://support.apple.com/kb/HT6150
- http://support.apple.com/kb/HT6146
- http://it.slashdot.org/comments.pl?sid=4821073&cid=46310187
- https://www.cs.columbia.edu/~smb/blog/2014-02/2014-02-24.html
- https://www.imperialviolet.org/2014/02/22/applebug.html
- https://news.ycombinator.com/item?id=7281378
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.