Sign-up

ID

VAR-201410-1079


CVE

CVE-2014-4444


TITLE

Apple OS X of SecurityAgent Vulnerability gained in

Trust: 0.8

sources: JVNDB: JVNDB-2014-004884

DESCRIPTION

SecurityAgent in Apple OS X before 10.10 does not ensure that a Kerberos ticket is in the cache for the correct user, which allows local users to gain privileges in opportunistic circumstances by leveraging a Fast User Switching login. Apple Mac OS X is prone to a local security-bypass vulnerability. Attackers can exploit this issue to bypass certain security restrictions and perform unauthorized actions. The vulnerability stems from the program not ensuring that Kerberos tickets are cached for the correct user

Trust: 1.98

sources: NVD: CVE-2014-4444 // JVNDB: JVNDB-2014-004884 // BID: 70640 // VULHUB: VHN-72384

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:lteversion:10.9.5

Trust: 1.0

vendor:applemodel:mac os xscope:ltversion:10.10

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:10.9.5

Trust: 0.6

vendor:cosmicperlmodel:directory proscope:eqversion:10.0.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.9.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.9.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.8.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.8.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.8.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.8.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.8

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.8

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.7

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.11

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.10

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.9

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.8

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.7

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.9

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.8

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.7

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.8

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.7

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.9.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.9.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.9.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.9

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.8.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.8

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.7

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.10

Trust: 0.3

sources: BID: 70640 // JVNDB: JVNDB-2014-004884 // CNNVD: CNNVD-201410-622 // NVD: CVE-2014-4444

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-4444
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-4444
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201410-622
value: MEDIUM

Trust: 0.6

VULHUB: VHN-72384
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-4444
severity: MEDIUM
baseScore: 4.4
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.4
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-72384
severity: MEDIUM
baseScore: 4.4
vectorString: AV:L/AC:M/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.4
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-72384 // JVNDB: JVNDB-2014-004884 // CNNVD: CNNVD-201410-622 // NVD: CVE-2014-4444

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.9

sources: VULHUB: VHN-72384 // JVNDB: JVNDB-2014-004884 // NVD: CVE-2014-4444

THREAT TYPE

local

Trust: 0.9

sources: BID: 70640 // CNNVD: CNNVD-201410-622

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201410-622

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-004884

PATCH
title:HT6535url:http://support.apple.com/kb/HT6535
Trust: 0.8
title:HT6535url:http://support.apple.com/kb/HT6535?viewlocale=ja_JP
Trust: 0.8
title:OS X Yosemite 10.10 MAS 14A389( Official version of the full firmware )url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=52113
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2014-004884 // 
            
            
            
            CNNVD: CNNVD-201410-622

EXTERNAL IDS
db:NVDid:CVE-2014-4444
Trust: 2.8
db:SECTRACKid:1031063
Trust: 1.1
db:JVNid:JVNVU97537282
Trust: 0.8
db:JVNDBid:JVNDB-2014-004884
Trust: 0.8
db:CNNVDid:CNNVD-201410-622
Trust: 0.7
db:BIDid:70640
Trust: 0.4
db:VULHUBid:VHN-72384
Trust: 0.1
sources:
            
            
            VULHUB: VHN-72384 // 
            
            
            
            BID: 70640 // 
            
            
            
            JVNDB: JVNDB-2014-004884 // 
            
            
            
            CNNVD: CNNVD-201410-622 // 
            
            
            
            NVD: CVE-2014-4444

REFERENCES
url:http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
Trust: 2.5
url:https://support.apple.com/kb/ht6535
Trust: 2.0
url:http://www.securitytracker.com/id/1031063
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/97623
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4444
Trust: 0.8
url:http://jvn.jp/vu/jvnvu97537282/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4444
Trust: 0.8
url:http://www.apple.com/macosx/
Trust: 0.3
sources:
            
            
            VULHUB: VHN-72384 // 
            
            
            
            BID: 70640 // 
            
            
            
            JVNDB: JVNDB-2014-004884 // 
            
            
            
            CNNVD: CNNVD-201410-622 // 
            
            
            
            NVD: CVE-2014-4444

CREDITS
Gary Simon of Sandia National Laboratories, Ragnar Sundblad of KTH Royal Institute of Technology and Eugene Homyakov of Kaspersky Lab
Trust: 0.3
sources:
            
            
            BID: 70640

SOURCES
db:VULHUBid:VHN-72384
db:BIDid:70640
db:JVNDBid:JVNDB-2014-004884
db:CNNVDid:CNNVD-201410-622
db:NVDid:CVE-2014-4444

LAST UPDATE DATE
2024-11-23T20:16:37.540000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-72384date:2017-08-29T00:00:00
db:BIDid:70640date:2014-10-16T00:00:00
db:JVNDBid:JVNDB-2014-004884date:2014-10-22T00:00:00
db:CNNVDid:CNNVD-201410-622date:2014-10-22T00:00:00
db:NVDid:CVE-2014-4444date:2024-11-21T02:10:12.100

SOURCES RELEASE DATE
db:VULHUBid:VHN-72384date:2014-10-18T00:00:00
db:BIDid:70640date:2014-10-16T00:00:00
db:JVNDBid:JVNDB-2014-004884date:2014-10-22T00:00:00
db:CNNVDid:CNNVD-201410-622date:2014-10-22T00:00:00
db:NVDid:CVE-2014-4444date:2014-10-18T01:55:13.917