The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.

The remote host is running a version of Mac OS X that is older than 10.9.2. The newer version contains numerous security-related fixes for the following components :

  - Apache

  - ATS

  - Certificate Trust Policy

  - CoreAnimation

  - CoreText

  - curl

  - Data Security

  - Date and Time

  - File Bookmark

  - Finder

  - ImageIO

  - NVIDIA Drivers

  - PHP

  - QuickLook

  - QuickTime

An attacker could leverage the most serious of these issues to execute arbitrary code.

According to its banner, the remote Apple iOS device is missing a security update.  Versions of Apple iOS 6.x prior to 6.1.6, or 7.x prior to 7.0.6 are missing an update that restores missing validation steps when conducting a SSL/TLS session. This error could allow an attacker to spoof a server and modify or view sensitive information between it and the iOS device.

The remote host is running a version of Mac OS X 10.9.x that is prior to 10.9.2. This update contains several security-related fixes for the following components :

  - Apache
  - ATS
  - Certificate Trust Policy
  - CoreAnimation
  - CoreText
  - curl
  - Data Security
  - Date and Time
  - File Bookmark
  - Finder
  - ImageIO
  - NVIDIA Drivers
  - PHP
  - QuickLook
  - QuickTime

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The mobile device is running a version of iOS that is 7.x prior to version 7.0.6. It is, therefore, prone to an SSL certificate validation weakness. This error could allow an attacker to spoof a server and obtain sensitive information or modify secure content.

The mobile device is running a version of iOS that is 6.x prior to version 6.1.6. It is, therefore, prone to an SSL certificate validation weakness. This error could allow an attacker to spoof a server and obtain sensitive information or modify secure content.

ID	Name	Product	Family	Severity
8138	Mac OS X < 10.9.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	critical
8135	Apple iOS 7.x < 7.0.6 / 6.x < 6.1.6 Information Disclosure	Nessus Network Monitor	Mobile Devices	medium
72687	Mac OS X 10.9.x < 10.9.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
72667	Apple iOS 7.x < 7.0.6 'SSLVerifySignedServerKeyExchange' Certificate Validation Weakness	Nessus	Mobile Devices	medium
72666	Apple iOS 6.x < 6.1.6 'SSLVerifySignedServerKeyExchange' Certificate Validation Weakness	Nessus	Mobile Devices	medium

Detections

Analytics

CVE-2014-1266

high

Tenable Plugins

critical

medium

critical

medium

medium