CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the header's value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction.

Versions of iTunes earlier than 11.2 are affected by multiple vulnerabilities :

 - A flaw exists in the way Set-Cookie HTTP headers are processed when the connection is closed before the header line was complete.  An attacker could strip security settings from the cookie by forcing the connection to close before the security settings were sent, and then obtain the value of the unprotected cookie. (CVE-2014-1296)
 - A memory corruption issue exists in iTunes MP4 parsing.  A maliciously crafted audio or movie file could be used to trigger an unexpected application termination or arbitrary code execution. (CVE-2014-8842)

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS 7.x prior to 7.1.1 are exposed to the following vulnerabilities :

  - Information disclosure of user cookies in CFNetwork HTTPProtocol

  - Information disclosure of kernel pointers in IOKit Kernel

  - Potential man-in-the-middle attack via Secure Transport

  - Memory corruptions in Webkit

The following have since been patched in version 6.1.1:

  - Set-Cookie HTTP headers are processed even if the connection closed before the header was complete. An attacker could leverage this to strip security settings and obtain the HTTP cookie. (CVE-2014-1296)
  - Information disclosure due to the IOKit object storing kernel pointers, which could be used by a local attacker to defeat kernel address space layout randomization. (CVE-2014-1320)
  - A 'triple handshake' vulnerability could be leveraged by an attacker on the local network to perform a man-in-the-middle attack. (CVE-2014-1295)
  - Multiple memory corruption issues in the underlying WebKit library. (CVE-2013-2871, CVE-2014-1298, CVE-2014-1299, CVE-2014-1300, CVE-2014-1302, CVE-2014-1303, CVE-2014-1304, CVE-2014-1305, CVE-2014-1307, CVE-2014-1308, CVE-2014-1309, CVE-2014-1310, CVE-2014-1311, CVE-2014-1312, CVE-2014-1313, CVE-2014-1713)

The remote host is running a version of Mac OS X that is older than 10.9.3, and is thus missing security-related fixes for the following components:

  - CFNetwork HTTPProtocol
  - CoreServicesUIAgent
  - FontParser
  - Heimdal Kerberos
  - ImageIO
  - Intel Graphics Driver
  - IOKit Kernel
  - Kernel
  - Power Management
  - Ruby
  - Security
  - Secure Transport
  - Window Server

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The version of Apple iTunes running on the remote host is prior to version 11.2. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the CFNetwork HTTPProtocol due to a     failure to properly ensure that a Set-Cookie HTTP header     is complete before interpreting the header's value. A     man-in-the-middle attacker can exploit this to bypass     security settings by closing the connection before the     security settings are sent, resulting in the disclosure     of sensitive information. (CVE-2014-1296)

  - A memory corruption issue exists due to improper     validation of user-supplied input when handling MP4     files. An attacker can exploit this, by convincing a     user to open a specially crafted MP4 file, to corrupt     memory, resulting in the execution of arbitrary code.
    (CVE-2014-8842)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote host is prior to version 11.2. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in the CFNetwork HTTPProtocol due to a     failure to properly ensure that a Set-Cookie HTTP header     is complete before interpreting the header's value. A     man-in-the-middle attacker can exploit this to bypass     security settings by closing the connection before the     security settings are sent, resulting in the disclosure     of sensitive information. (CVE-2014-1296)

  - A memory corruption issue exists due to improper     validation of user-supplied input when handling MP4     files. An attacker can exploit this, by convincing a     user to open a specially crafted MP4 file, to corrupt     memory, resulting in the execution of arbitrary code.
    (CVE-2014-8842)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.7, 10.8, or 10.9 that does not have Security Update 2014-002 applied. This update contains several security-related fixes for the following components :

  - CFNetwork HTTPProtocl
  - CoreServicesUIAgent
  - FontParser
  - Heimdal Kerberos
  - ImageIO
  - Intel Graphics Driver
  - IOKit Kernel
  - Kernel
  - Power Management
  - Ruby
  - Security - Secure Transport
  - Window Server

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The mobile device is running a version of iOS that is prior to version 7.1.1. It is, therefore, affected by vulnerabilities in the following components :

  - CFNetwork HTTPProtocol
  - IOKit Kernel
  - Secure Transport
  - WebKit

ID	Name	Product	Family	Severity
9397	iTunes for Windows < 11.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
8275	Apple iOS 7.x < 7.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	medium
8274	Apple TV < 6.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	medium
8265	Mac OS X < 10.9.3 Multiple Vulnerabilities (Security Update 2014-002)	Nessus Network Monitor	Web Clients	critical
74041	Apple iTunes < 11.2 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	medium
74040	Apple iTunes < 11.2 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	medium
73648	Mac OS X Multiple Vulnerabilities (Security Update 2014-002)	Nessus	MacOS X Local Security Checks	critical
73647	Apple iOS < 7.1.1 Multiple Vulnerabilities	Nessus	Mobile Devices	critical

Detections

Analytics

CVE-2014-1296

medium

Tenable Plugins

high

medium

medium

critical

medium

medium

critical

critical