CVE-2014-4431

Vulnerability

Dock in Apple OS X before 10.10 does not properly manage the screen-lock state, which allows physically proximate attackers to view windows on an unattended workstation. The issue is present in all versions prior to OS X Yosemite v10.10 [1].

Exploitation

An attacker with physical proximity to an unattended workstation can leverage the improper screen-lock management to view windows. No authentication or special privileges are required; the attacker simply accesses the unlocked session when the user is away [1].

Impact

Successful exploitation leads to unauthorized information disclosure, as the attacker can see the contents of windows displayed on the screen. This could include sensitive user data. The compromise is limited to visual observation and does not provide code execution or privilege escalation [1].

Mitigation

Apple addressed the issue in OS X Yosemite v10.10, released October 16, 2014. Users should update to OS X 10.10 or later. No workarounds were provided for unsupported versions [1].