CVE-2014-1266

The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple…

published February 22, 2014

CVSS
—
EPSS
6%
Percentile
93.0
In the wild
Unconfirmed
What it is

The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05741 · 93.0th percentile
Published
2014-02-22T15:00Z
EPSS history
Timeline
  • 22 FEB 15:00Z
    The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple…
    cvelistv5