Vulnerabilities > CVE-2014-4428 - Cryptographic Issues vulnerability in Apple mac OS X
Attack vector
ADJACENT_NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Bluetooth in Apple OS X before 10.10 does not require encryption for HID Low Energy devices, which allows remote attackers to spoof a device by leveraging previous pairing.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Signature Spoofing by Key Recreation An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Nessus
NASL family MacOS X Local Security Checks NASL id MACOSX_10_10.NASL description The remote host is running a version of Mac OS X is prior to version 10.10. This update contains several security-related fixes for the following components : - 802.1X - AFP File Server - apache - App Sandbox - Bash - Bluetooth - Certificate Trust Policy - CFPreferences - CoreStorage - CUPS - Dock - fdesetup - iCloud Find My Mac - IOAcceleratorFamily - IOHIDFamily - IOKit - Kernel - LaunchServices - LoginWindow - Mail - MCX Desktop Config Profiles - NetFS Client Framework - QuickTime - Safari - Secure Transport - Security - Security - Code Signing Note that successful exploitation of the most serious issues can result in arbitrary code execution. last seen 2020-06-01 modified 2020-06-02 plugin id 78550 published 2014-10-17 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/78550 title Mac OS X < 10.10 Multiple Vulnerabilities (POODLE) (Shellshock) NASL family Misc. NASL id APPLETV_7_0_1.NASL description According to its banner, the remote Apple TV device is a version prior to 7.0.1. It is, therefore, affected by the following vulnerabilities : - An error exists related to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. A man-in-the-middle attacker can decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections. This is also known as the last seen 2020-06-01 modified 2020-06-02 plugin id 78871 published 2014-11-05 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/78871 title Apple TV < 7.0.1 Multiple Vulnerabilities (POODLE)
References
- http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
- http://secunia.com/advisories/61825
- http://secunia.com/advisories/61827
- http://www.securityfocus.com/archive/1/533746
- http://www.securityfocus.com/archive/1/533747
- http://www.securityfocus.com/bid/70636
- http://www.securitytracker.com/id/1031063
- https://exchange.xforce.ibmcloud.com/vulnerabilities/97641
- https://support.apple.com/kb/HT6535
- https://support.apple.com/kb/HT6541
- https://support.apple.com/kb/HT6542