CVE-2014-1257

Vulnerability

CFNetwork in Apple OS X through 10.8.5 does not remove session cookies when a user performs a Safari reset action. This allows previously stored session cookies to persist after the reset, leaving them accessible to subsequent users of the same workstation. The issue is addressed in OS X Mavericks v10.9.2 and Security Update 2014-001 [1].

Exploitation

An attacker with physical access to an unattended workstation can exploit this vulnerability by simply using the browser after the legitimate user has performed a Safari reset. No authentication or special privileges are required; the attacker only needs to navigate to websites that the previous user had logged into, as the session cookies remain valid.

Impact

Successful exploitation allows the attacker to bypass intended access restrictions and impersonate the previous user on web services that rely on session cookies. This can lead to unauthorized access to sensitive information, such as email, social media, or corporate applications, depending on the user's active sessions.

Mitigation

Apple addressed this issue in OS X Mavericks v10.9.2 and Security Update 2014-001, released on February 25, 2014 [1]. Users should update their systems via Software Update or the Apple Support website. No workaround is documented for unpatched systems.