Product:
iOS and Apple TV
Summary
Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged context via an application that provides crafted key-mapping properties. This vulnerability can lead to complete compromise of the affected systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2014-4404 |
Exploitation
To exploit this vulnerability, an attacker must create a malicious application that provides specially crafted key-mapping properties. Once the application is executed on a vulnerable device, it can trigger the buffer overflow, allowing the attacker to execute arbitrary code with elevated privileges.
Affected Products
- iOS: Versions prior to 8 are affected by this vulnerability, allowing for potential arbitrary code execution.
- Apple TV: Versions prior to 7 are also vulnerable, enabling similar exploitation through crafted applications.
Mitigation
To mitigate this vulnerability, users should apply updates as per the vendor’s instructions. Keeping devices updated will help protect against this and other vulnerabilities.
References
- Bugtraq Archive 1
- Bugtraq Archive 2
- Bugtraq Archive 3
- Apple Security Announcement
- Apple Support Document 1
- Apple Support Document 2
- SecurityFocus BID 69882
- SecurityFocus BID 69947
- SecurityTracker ID 1030866
- IBM X-Force Exchange
- Apple Support Document 3
- Apple Support Document 4
- CISA Known Exploited Vulnerabilities Catalog