CVE-2014-4441

Vulnerability

The NetFS Client Framework in Apple OS X before 10.10 (Yosemite) contains a logic flaw that can prevent the disabling of File Sharing. Under certain conditions, the system may enter a state where File Sharing remains permanently enabled even after an administrator attempts to turn it off. This affects all versions of OS X prior to 10.10, as the issue is resolved in that release.

Exploitation

An attacker with network access to an affected machine can exploit this persistent state. No special authentication or user interaction is required if the target system is already in the vulnerable state where File Sharing is enabled and cannot be disabled. The attacker can mount shared volumes over the network as they would any legitimate File Sharing connection.

Impact

Successful exploitation allows the remote attacker to read and write files stored on the affected system's shared directories. The attacker gains the same level of access as the File Sharing configuration permits, which could include write access to sensitive data. This compromises the confidentiality and integrity of the shared files.

Mitigation

Apple addressed this issue in OS X Yosemite v10.10 [1]. Users should upgrade to OS X 10.10 or later. There is no documented workaround for affected systems other than upgrading. This CVE is not listed on CISA's Known Exploited Vulnerabilities catalog.