CVE-2014-4479

Vulnerability

CVE-2014-4479 is a memory corruption vulnerability in WebKit, the rendering engine used by Apple's Safari browser and other applications. The issue exists in WebKit's handling of crafted web content, leading to memory corruption. Affected products include Apple iOS before 8.1.3, Apple Safari before 6.2.3, 7.x before 7.1.3, and 8.x before 8.0.3, and Apple TV before 7.0.3 [1][2][3]. The vulnerability is triggered when a user visits a maliciously crafted website.

Exploitation

An attacker can exploit this vulnerability by hosting a specially crafted website that, when visited by a user on an affected device, causes memory corruption in WebKit. No authentication or special network position is required; the attacker only needs to lure the victim to the malicious site, typically via social engineering or by embedding the content in a legitimate-looking page. The exploitation does not require user interaction beyond visiting the site.

Impact

Successful exploitation allows a remote attacker to execute arbitrary code on the target device or cause a denial of service (application crash). The code executes in the context of the affected application (Safari or the system WebKit component), potentially leading to full system compromise on iOS or OS X. The impact is rated as critical, with CVSS score not provided but implied high severity.

Mitigation

Apple has addressed this vulnerability in the following updates: iOS 8.1.3 [1], Apple TV 7.0.3 [2], and Safari 6.2.3, 7.1.3, and 8.0.3 [3]. Additionally, iTunes 12.2 for Windows also includes a fix for this CVE [4]. Users should update their devices to the latest available versions. No workarounds are documented; applying the security updates is the recommended mitigation.