« Volver al listado

CVE-2014-4457

Estado: ModificadaAlta (7.5)—

El subsistema Sandbox Profiles en Apple iOS anterior a 8.1.1 no implementa debidamente el sandbox debugserver, lo cual permite a atacantes evadir las restricciones destinadas a la ejecución de binarios a través de una aplicación manipulada que es ejecutada durante un período de tiempo cuando la depuración no está habilitada.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apple — Iphone OS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-4457",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "product-security@apple.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-11-18T11:59:04.903",
  "references": [
    {
      "url": "http://lists.apple.com/archives/security-announce/2014/Nov/msg00000.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/71143",
      "source": "product-security@apple.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1031232",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98777",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/HT204418",
      "source": "product-security@apple.com"
    },
    {
      "url": "https://support.apple.com/en-us/HT6590",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "product-security@apple.com"
    },
    {
      "url": "http://lists.apple.com/archives/security-announce/2014/Nov/msg00000.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/71143",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1031232",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/98777",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.apple.com/en-us/HT204418",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://support.apple.com/en-us/HT6590",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Sandbox Profiles subsystem in Apple iOS before 8.1.1 does not properly implement the debugserver sandbox, which allows attackers to bypass intended binary-execution restrictions via a crafted application that is run during a time period when debugging is not enabled."
    },
    {
      "lang": "es",
      "value": "El subsistema Sandbox Profiles en Apple iOS anterior a 8.1.1 no implementa debidamente el sandbox debugserver, lo cual permite a atacantes evadir las restricciones destinadas a la ejecución de binarios a través de una aplicación manipulada que es ejecutada durante un período de tiempo cuando la depuración no está habilitada."
    }
  ],
  "lastModified": "2026-06-17T00:10:03.197",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1DFACE2F-616F-4F5E-A973-4C41440539FA",
              "versionEndIncluding": "8.1"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C7350A49-6D6B-4E03-933E-52453FE33E00"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:8.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C067D7E6-41CD-4859-A214-80F4C8E88567"
            },
            {
              "criteria": "cpe:2.3:o:apple:iphone_os:8.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "245A0B42-AA79-4B33-AAEE-E414B6B1EAC7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "product-security@apple.com"
}