High severity7.4NVD Advisory· Published Feb 22, 2014· Updated Apr 29, 2026
CVE-2014-1266
CVE-2014-1266
Description
The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6, Apple TV 6.x before 6.0.2, and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message, which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.
Affected products
3Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
9- news.ycombinator.com/itemnvdExploitIssue Tracking
- www.cs.columbia.edu/~smb/blog/2014-02/2014-02-23.htmlnvdExploit
- www.cs.columbia.edu/~smb/blog/2014-02/2014-02-24.htmlnvdExploit
- www.imperialviolet.org/2014/02/22/applebug.htmlnvdExploit
- support.apple.com/kb/HT6146nvdVendor Advisory
- support.apple.com/kb/HT6147nvdVendor Advisory
- support.apple.com/kb/HT6148nvdVendor Advisory
- support.apple.com/kb/HT6150nvdVendor Advisory
- it.slashdot.org/comments.plnvdIssue Tracking
News mentions
0No linked articles in our index yet.