Vulnerabilities > CVE-2014-4364 - Cryptographic Issues vulnerability in Apple Iphone OS
Attack vector
ADJACENT_NETWORK Attack complexity
HIGH Privileges required
NONE Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
The 802.1X subsystem in Apple iOS before 8 and Apple TV before 7 does not require strong authentication methods, which allows remote attackers to calculate credentials by offering LEAP authentication from a crafted Wi-Fi AP and then performing a cryptographic attack against the MS-CHAPv1 hash.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Signature Spoofing by Key Recreation An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Nessus
NASL family MacOS X Local Security Checks NASL id MACOSX_10_10.NASL description The remote host is running a version of Mac OS X is prior to version 10.10. This update contains several security-related fixes for the following components : - 802.1X - AFP File Server - apache - App Sandbox - Bash - Bluetooth - Certificate Trust Policy - CFPreferences - CoreStorage - CUPS - Dock - fdesetup - iCloud Find My Mac - IOAcceleratorFamily - IOHIDFamily - IOKit - Kernel - LaunchServices - LoginWindow - Mail - MCX Desktop Config Profiles - NetFS Client Framework - QuickTime - Safari - Secure Transport - Security - Security - Code Signing Note that successful exploitation of the most serious issues can result in arbitrary code execution. last seen 2020-06-01 modified 2020-06-02 plugin id 78550 published 2014-10-17 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/78550 title Mac OS X < 10.10 Multiple Vulnerabilities (POODLE) (Shellshock) NASL family Misc. NASL id APPLETV_7_0.NASL description According to its banner, the remote Apple TV device is a version prior to 7. It is, therefore, affected by multiple vulnerabilities, the most serious of which can result in arbitrary code execution. last seen 2020-06-01 modified 2020-06-02 plugin id 77822 published 2014-09-24 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/77822 title Apple TV < 7 Multiple Vulnerabilities
References
- http://archives.neohapsis.com/archives/bugtraq/2014-09/0107.html
- http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html
- http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
- https://support.apple.com/kb/HT6535
- http://www.securitytracker.com/id/1030866
- http://www.securityfocus.com/bid/69913
- http://www.securityfocus.com/bid/69882
- http://support.apple.com/kb/HT6442
- http://support.apple.com/kb/HT6441
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96097