CVE-2014-1380

Vulnerability

The vulnerability resides in the Security - Keychain component of Apple OS X Mavericks, specifically in the handling of keystroke observers. Affected versions are OS X Mavericks 10.9 through 10.9.3. The system fails to properly restrict keystroke observers when the screen is locked, allowing keyboard input to be sent to windows that are behind the lock screen [1].

Exploitation

An attacker must have physical proximity to the target system (i.e., access to the keyboard). No authentication or user interaction is required. While the screen is locked, the attacker can type on the keyboard, and the keystrokes are captured by an observer and directed to an arbitrary window beneath the lock window, effectively bypassing the screen-lock protection [1].

Impact

A successful attacker can enter characters into any window that is behind the lock screen, potentially performing actions as the logged-in user without unlocking the system. This could lead to unauthorized data access, system configuration changes, or other actions depending on the context of the targeted window [1].

Mitigation

Apple addressed this issue in OS X Mavericks 10.9.4, released on July 1, 2014. Users should update via Software Update or download the update from the Apple Support website. No workarounds are documented, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [1].