Apple iOS Lock Screen CVE-2014-4463 Security Bypass Vulnerability

Bugtraq ID:	71141
Class:	Design Error
CVE:	CVE-2014-4463
Remote:	No
Local:	Yes
Published:	Nov 17 2014 12:00AM
Updated:	Dec 10 2014 02:57PM
Credit:	Apple
Vulnerable:	Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0 Apple iOS 2.1 Apple iOS 2.0
Not Vulnerable:

Apple iOS Lock Screen CVE-2014-4463 Security Bypass Vulnerability

Apple iOS is prone to a local security-bypass vulnerability.

An attacker with physical access to a device can exploit this issue to access photos in the Photo Library. Successful exploits may lead to other attacks.

This issue is fixed in iOS 8.1.1

Apple iOS Lock Screen CVE-2014-4463 Security Bypass Vulnerability

An attacker requires physical access to exploit the issue.

Apple iOS Lock Screen CVE-2014-4463 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apple iOS Lock Screen CVE-2014-4463 Security Bypass Vulnerability

References:

• Apple iOS Homepage (Apple)
  
• iPad Homepage (Apple)
  
• iPhone Product Page (Apple)
  
• iPod touch Product Page (Apple)