CVE-2014-4383

Vulnerability

The Assets subsystem in Apple iOS before version 8 and Apple TV before version 7 contains a vulnerability where a man-in-the-middle attacker can spoof a device's update status [1][2]. The attacker achieves this by sending a crafted Last-Modified HTTP response header during the update-check process. Affected versions include iOS prior to 8 and Apple TV prior to 7.

Exploitation

An attacker must be in a position to intercept and modify HTTP traffic between the device and Apple's update servers (i.e., man-in-the-middle). No authentication or user interaction is required beyond the device performing a normal update check. By crafting the Last-Modified header in the HTTP response, the attacker can deceive the device about the availability or freshness of updates.

Impact

Successful exploitation allows the attacker to spoof the device's update status. The attacker can make the device believe an update is either unavailable or already current, potentially preventing the installation of security patches. This compromises the integrity of the update process and can leave the device in an outdated, vulnerable state.

Mitigation

Apple fixed this issue in iOS 8 and Apple TV 7. Users should upgrade their devices to these versions or later. No workarounds are documented in the available references [1][2].