CVE-2014-2019: The iCloud subsystem in Apple iOS before 7.1 allows physically proximate attackers to bypass an intended password requirement, and turn off the Find My iPhone…

PriorityP421medium4.6CVSS 3.1

AVPACLPRNUINSUCNIHAN

EPSS

0.46%

37.8th percentile

The iCloud subsystem in Apple iOS before 7.1 allows physically proximate attackers to bypass an intended password requirement, and turn off the Find My iPhone service or complete a Delete Account action and then associate this service with a different Apple ID account, by entering an arbitrary iCloud Account Password value and a blank iCloud Account Description value.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apple	iphone_os	< 7.1	7.1
spoon	library	>= 0 < 1.4.1	1.4.1

CVSS provenance

nvdv3.14.6MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:C/A:N

vendor_redhat7.5HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

Suricata

ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound

suricata·2019-05-08·CVSS 9.8

CVE-2014-8361 [CRITICAL] ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound Rule: alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Realtek SDK Miniigd UPnP SOAP Command Execution CVE-2014-8361 - Outbound"; flow:established,to_server; http.method; content:"POST"; http.request_header; header_lowercase; content:"soapaction|3a 20|urn|3a|schemas-upnp-org|3a|service|3a|WANIPConnection|3a|"; fast_pattern; startswith; http.request_body; content:"|3c|u|3a|AddPortMapping"; content:"|3c|NewRemoteHost|3e|"; distance:0; content:"|3c|NewInternalClient"; distance:0; content:"|3c 2f|NewInternalClient|3e|"; distance:0; content:"NewEnabled|3e|1"; distance:0; classtype:trojan-activity; sid:2027339; rev:4; metadata:attack_target IoT, created_at 2019_05_08, cve CVE_2014_8361, deployment

Suricata

ET WEB_SERVER Possible CVE-2014-6271 Attempt

suricata·2015-11-04·CVSS 9.8

CVE-2014-6271 [CRITICAL] ET WEB_SERVER Possible CVE-2014-6271 Attempt ET WEB_SERVER Possible CVE-2014-6271 Attempt Rule: alert tcp any any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt"; flow:established,to_server; content:" HTTP/1."; pcre:"/^[^\r\n]*?HTTP\/1(?:(?!\r?\n\r?\n)[\x20-\x7e\s]){1,500}\n[\x20-\x7e]{1,100}\x3a[\x20-\x7e]{0,500}\x28\x29\x20\x7b/s"; content:"|28 29 20 7b|"; fast_pattern; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2022028; rev:2; metadata:created_at 2015_11_04, cve CVE_2014_6271, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2019_10_08;)

Suricata

ET EXPLOIT Possible CVE-2014-6271 exploit attempt via malicious DNS

suricata·2014-10-15·CVSS 9.8

CVE-2014-6271 [CRITICAL] ET EXPLOIT Possible CVE-2014-6271 exploit attempt via malicious DNS ET EXPLOIT Possible CVE-2014-6271 exploit attempt via malicious DNS Rule: alert tcp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"ET EXPLOIT Possible CVE-2014-6271 exploit attempt via malicious DNS"; byte_test:1,&,128,4; content:"|28 29 20 7b|"; fast_pattern; reference:cve,2014-6271; reference:url,packetstormsecurity.com/files/128650; classtype:attempted-admin; sid:2019403; rev:2; metadata:created_at 2014_10_15, cve CVE_2014_6271, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_10_08;)

Suricata

ET EXPLOIT Possible CVE-2014-6271 malicious DNS response

suricata·2014-10-15·CVSS 9.8

CVE-2014-6271 [CRITICAL] ET EXPLOIT Possible CVE-2014-6271 malicious DNS response ET EXPLOIT Possible CVE-2014-6271 malicious DNS response Rule: alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"ET EXPLOIT Possible CVE-2014-6271 malicious DNS response"; byte_test:1,&,128,2; content:"|28 29 20 7b|"; fast_pattern; reference:cve,2014-6271; reference:url,packetstormsecurity.com/files/128650; classtype:attempted-admin; sid:2019402; rev:2; metadata:created_at 2014_10_15, cve CVE_2014_6271, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_10_08;)

Suricata

ET MALWARE Linux/ShellshockCampaign.DDOSBot Execute Shell Command CnC Server Message

suricata·2014-09-29

CVE-2014-6271 ET MALWARE Linux/ShellshockCampaign.DDOSBot Execute Shell Command CnC Server Message ET MALWARE Linux/ShellshockCampaign.DDOSBot Execute Shell Command CnC Server Message Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/ShellshockCampaign.DDOSBot Execute Shell Command CnC Server Message"; flow:established,to_client; content:"! SH"; depth:4; pcre:"/^[^\r\n]+?\n$/R"; reference:url,research.zscaler.com/2014/09/shellshock-attacks-spotted-in-wild.html; reference:cve,2014-6271; classtype:command-and-control; sid:2019298; rev:2; metadata:created_at 2014_09_29, cve CVE_2014_6271, signature_severity Major, updated_at 2019_07_26;)

Suricata

ET MALWARE Linux/ShellshockCampaign.DDOSBot UDP Flood CnC Server Message

suricata·2014-09-29

CVE-2014-6271 ET MALWARE Linux/ShellshockCampaign.DDOSBot UDP Flood CnC Server Message ET MALWARE Linux/ShellshockCampaign.DDOSBot UDP Flood CnC Server Message Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/ShellshockCampaign.DDOSBot UDP Flood CnC Server Message"; flow:established,to_client; content:"! UDP "; depth:6; pcre:"/\x21\x20UDP\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}/"; reference:url,research.zscaler.com/2014/09/shellshock-attacks-spotted-in-wild.html; reference:cve,2014-6271; classtype:command-and-control; sid:2019300; rev:2; metadata:created_at 2014_09_29, cve CVE_2014_6271, signature_severity Major, updated_at 2019_07_26;)