Apple iOS APPLE-SA-2015-01-27-2 Multiple Security Vulnerabilities

Bugtraq ID:	72333
Class:	Unknown
CVE:	CVE-2014-8840 CVE-2014-4493 CVE-2014-4494 CVE-2014-4467
Remote:	Yes
Local:	No
Published:	Jan 27 2015 12:00AM
Updated:	Feb 04 2015 12:01AM
Credit:	lokihardt@ASRT working with HP's Zero Day Initiative , Jordan Milne, Song Jin, Hui Xue, and Tao Wei of FireEye, Inc.
Vulnerable:	Apple iPod Touch 0 Apple iPhone 0 Apple iPad 0 Apple iOS 4.2.1 Apple iOS 4.0.2 Apple iOS 4.0.1 Apple iOS 3.2.2 Apple iOS 3.2.1 Apple iOS 5.1.1 Apple iOS 5.1 Apple iOS 5.0.1 Apple iOS 5 Apple iOS 4.3.5 Apple iOS 4.3.4 Apple iOS 4.3.3 Apple iOS 4.3.2 Apple iOS 4.3.1 Apple iOS 4.3 Apple iOS 4.2.9 Apple iOS 4.2.8 Apple iOS 4.2.7 Apple iOS 4.2.6 Apple iOS 4.2.5 Apple iOS 4.2.10 Apple iOS 4.2 Apple iOS 4.1 Apple iOS 4 Apple iOS 3.2 Apple iOS 3.1 Apple iOS 3.0
Not Vulnerable:

Apple iOS APPLE-SA-2015-01-27-2 Multiple Security Vulnerabilities

Apple iOS is prone to multiple security vulnerabilities.

The update addresses new vulnerabilities that affect iTunes Store, MobileInstallation, Springboard, and WebKit components.

Attackers can exploit these issues to gain unauthorized access, perform unauthorized actions, bypass security restrictions, and perform other attacks.

These issues affect iOS versions prior to 8.1.3.

Apple iOS APPLE-SA-2015-01-27-2 Multiple Security Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Some of these issues may be trivial to exploit and will not require specific exploit code.

Apple iOS APPLE-SA-2015-01-27-2 Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apple iOS APPLE-SA-2015-01-27-2 Multiple Security Vulnerabilities

References:

• Apple iOS Homepage (Apple)
  
• iPad Homepage (Apple)
  
• iPhone Homepage (Apple)
  
• iPod touch Product Page (Apple)