Apple iOS Lock Screen CVE-2014-4451 Security Bypass Vulnerability

Bugtraq ID:	71138
Class:	Design Error
CVE:	CVE-2014-4451
Remote:	No
Local:	Yes
Published:	Nov 17 2014 12:00AM
Updated:	Dec 10 2014 02:57PM
Credit:	Stuart Ryan of University of Technology, Sydney
Vulnerable:	Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0
Not Vulnerable:

Apple iOS Lock Screen CVE-2014-4451 Security Bypass Vulnerability

Apple iOS is prone to a local security-bypass vulnerability.

An attacker with physical access to a device can exploit this issue to bypass screen lock. Successful exploits may lead to other attacks.

This issue is fixed in iOS 8.1.1

Apple iOS Lock Screen CVE-2014-4451 Security Bypass Vulnerability

An attacker requires physical access to exploit the issue.

Apple iOS Lock Screen CVE-2014-4451 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apple iOS Lock Screen CVE-2014-4451 Security Bypass Vulnerability

References:

• Apple iOS Homepage (Apple)
  
• iPad Homepage (Apple)
  
• iPhone Product Page (Apple)
  
• iPod touch Product Page (Apple)