CVE-2014-4443

Vulnerability

The vulnerability exists in Apple OS X versions prior to 10.10 (Yosemite). It involves a NULL pointer dereference when processing crafted ASN.1 data. This can be triggered remotely without authentication by sending specially crafted ASN.1 input. [1]

Exploitation

An attacker can exploit this vulnerability by sending crafted ASN.1 data to a vulnerable OS X system over the network. No authentication is required. The attacker simply needs to deliver the malicious ASN.1 payload to the system, which will cause a NULL pointer dereference. [1]

Impact

Successful exploitation leads to a denial of service condition, as the NULL pointer dereference likely causes the targeted application or the system to crash. The impact is solely on availability, with no disclosure or integrity compromise indicated.

Mitigation

Apple addressed this issue in OS X Yosemite 10.10. Users with OS X versions prior to 10.10 should upgrade to 10.10 or later. No workarounds are documented. [1]