CVE-2014-1345

WebKit in Apple iOS before 7.1.2 and Apple Safari before 6.1.5 and 7.x before 7.0.5 does not properly encode domain names in URLs, which allows remote attackers to spoof the address bar via a crafted web site.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html
http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html
http://www.securitytracker.com/id/1030495
http://secunia.com/advisories/59481
http://www.securityfocus.com/bid/68276

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apple:safari:6.1.3:::::::*
	cpe:2.3:a:apple:safari:6.1.2:::::::*
	cpe:2.3:a:apple:safari:6.0:::::::*
	cpe:2.3:a:apple:safari::::::::
	cpe:2.3:a:apple:safari:6.0.4:::::::*
	cpe:2.3:a:apple:safari:6.0.3:::::::*
	cpe:2.3:a:apple:safari:6.0.2:::::::*
	cpe:2.3:a:apple:safari:6.0.1:::::::*
	cpe:2.3:a:apple:safari:6.1.1:::::::*
	cpe:2.3:a:apple:safari:6.1:::::::*
	cpe:2.3:a:apple:safari:6.0.5:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:apple:safari:7.0:::::::*
	cpe:2.3:a:apple:safari:7.0.1:::::::*
	cpe:2.3:a:apple:safari:7.0.2:::::::*
	cpe:2.3:a:apple:safari:7.0.3:::::::*
	cpe:2.3:a:apple:safari:7.0.4:::::::*

Configuration 3 (hide)

OR	cpe:2.3:o:apple:iphone_os:7.0.6:::::::*
	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:iphone_os:7.1:::::::*
	cpe:2.3:o:apple:iphone_os:7.0.3:::::::*
	cpe:2.3:o:apple:iphone_os:7.0.2:::::::*
	cpe:2.3:o:apple:iphone_os:7.0.1:::::::*
	cpe:2.3:o:apple:iphone_os:7.0:::::::*
	cpe:2.3:o:apple:iphone_os:7.0.5:::::::*
	cpe:2.3:o:apple:iphone_os:7.0.4:::::::*

Information

Published : 2014-07-01 03:17

Updated : 2017-01-06 18:59

NVD link : CVE-2014-1345

Mitre link : CVE-2014-1345

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

apple

safari
iphone_os

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html", "name": "APPLE-SA-2014-06-30-3", "tags": [], "refsource": "APPLE"}, {"url": "http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html", "name": "APPLE-SA-2014-06-30-1", "tags": [], "refsource": "APPLE"}, {"url": "http://www.securitytracker.com/id/1030495", "name": "1030495", "tags": [], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/59481", "name": "59481", "tags": [], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/68276", "name": "68276", "tags": [], "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "WebKit in Apple iOS before 7.1.2 and Apple Safari before 6.1.5 and 7.x before 7.0.5 does not properly encode domain names in URLs, which allows remote attackers to spoof the address bar via a crafted web site."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-1345", "ASSIGNER": "product-security@apple.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2014-07-01T10:17Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:apple:safari:6.1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apple:safari:6.1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apple:safari:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "6.1.4"}, {"cpe23Uri": "cpe:2.3:a:apple:safari:6.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apple:safari:6.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apple:safari:6.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apple:safari:6.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apple:safari:6.1.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apple:safari:6.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apple:safari:6.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:apple:safari:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apple:safari:7.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apple:safari:7.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apple:safari:7.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:apple:safari:7.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "7.1.1"}, {"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:apple:iphone_os:7.0.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-01-07T02:59Z"}