CVE-2014-8838

Vulnerability

The Security component in Apple OS X before 10.10.2 does not properly process cached information about app certificates. This flaw allows attackers to bypass the Gatekeeper protection mechanism by leveraging access to a revoked Developer ID certificate to sign a crafted app. The vulnerability affects OS X Yosemite versions prior to 10.10.2.

Exploitation

An attacker must have access to a revoked Developer ID certificate, which could be obtained from a previous developer or through other means. The attacker then signs a malicious app with that revoked certificate. Because the system caches certificate information and fails to correctly validate the revocation status, Gatekeeper will permit the app to run. No additional user interaction beyond launching the app is required.

Impact

Successful exploitation enables the attacker to bypass Gatekeeper, which is designed to only allow execution of apps signed with valid Developer ID certificates. This allows arbitrary code execution on the target system with the privileges of the user running the app, potentially leading to full system compromise.

Mitigation

Apple addressed this issue in OS X Yosemite v10.10.2 and Security Update 2015-001 [1]. Users should update to the latest version. No workarounds are documented. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog.