IOKit in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 places kernel pointers into an object data structure, which makes it easier for local users to bypass the ASLR protection mechanism by reading unspecified attributes of the object.

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS 7.x prior to 7.1.1 are exposed to the following vulnerabilities :

  - Information disclosure of user cookies in CFNetwork HTTPProtocol

  - Information disclosure of kernel pointers in IOKit Kernel

  - Potential man-in-the-middle attack via Secure Transport

  - Memory corruptions in Webkit

The following have since been patched in version 6.1.1:

  - Set-Cookie HTTP headers are processed even if the connection closed before the header was complete. An attacker could leverage this to strip security settings and obtain the HTTP cookie. (CVE-2014-1296)
  - Information disclosure due to the IOKit object storing kernel pointers, which could be used by a local attacker to defeat kernel address space layout randomization. (CVE-2014-1320)
  - A 'triple handshake' vulnerability could be leveraged by an attacker on the local network to perform a man-in-the-middle attack. (CVE-2014-1295)
  - Multiple memory corruption issues in the underlying WebKit library. (CVE-2013-2871, CVE-2014-1298, CVE-2014-1299, CVE-2014-1300, CVE-2014-1302, CVE-2014-1303, CVE-2014-1304, CVE-2014-1305, CVE-2014-1307, CVE-2014-1308, CVE-2014-1309, CVE-2014-1310, CVE-2014-1311, CVE-2014-1312, CVE-2014-1313, CVE-2014-1713)

The remote host is running a version of Mac OS X that is older than 10.9.3, and is thus missing security-related fixes for the following components:

  - CFNetwork HTTPProtocol
  - CoreServicesUIAgent
  - FontParser
  - Heimdal Kerberos
  - ImageIO
  - Intel Graphics Driver
  - IOKit Kernel
  - Kernel
  - Power Management
  - Ruby
  - Security
  - Secure Transport
  - Window Server

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.7, 10.8, or 10.9 that does not have Security Update 2014-002 applied. This update contains several security-related fixes for the following components :

  - CFNetwork HTTPProtocl
  - CoreServicesUIAgent
  - FontParser
  - Heimdal Kerberos
  - ImageIO
  - Intel Graphics Driver
  - IOKit Kernel
  - Kernel
  - Power Management
  - Ruby
  - Security - Secure Transport
  - Window Server

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The mobile device is running a version of iOS that is prior to version 7.1.1. It is, therefore, affected by vulnerabilities in the following components :

  - CFNetwork HTTPProtocol
  - IOKit Kernel
  - Secure Transport
  - WebKit

ID	Name	Product	Family	Severity
8275	Apple iOS 7.x < 7.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	medium
8274	Apple TV < 6.1.1 Multiple Vulnerabilities	Nessus Network Monitor	Internet Services	medium
8265	Mac OS X < 10.9.3 Multiple Vulnerabilities (Security Update 2014-002)	Nessus Network Monitor	Web Clients	critical
73648	Mac OS X Multiple Vulnerabilities (Security Update 2014-002)	Nessus	MacOS X Local Security Checks	critical
73647	Apple iOS < 7.1.1 Multiple Vulnerabilities	Nessus	Mobile Devices	critical

Detections

Analytics

CVE-2014-1320

low

Tenable Plugins

medium

medium

critical

critical

critical