CVE-2014-1347

Published: May 18, 2014Modified: May 6, 2026

4.4

Vector

AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 3.4 / Impact: 6.4

Source: NVD

Description

Apple iTunes before 11.2.1 on OS X sets world-writable permissions for /Users and /Users/Shared during reboots, which allows local users to modify files, and consequently obtain access to arbitrary user accounts, via standard filesystem operations.

Affected (13)

Products: Apple: Itunes

Apple

1 product

Itunes

Configuration A

13 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Apple Itunes	version ≤ 11.2
Apple Itunes	Version 11.0.1
Apple Itunes	Version 11.0.2
Apple Itunes	Version 11.0.3
Apple Itunes	Version 11.0.4
Apple Itunes	Version 11.0.5
Apple Itunes	Version 11.0
Apple Itunes	Version 11.1.1
Apple Itunes	Version 11.1.2
Apple Itunes	Version 11.1.3
Apple Itunes	Version 11.1.4
Apple Itunes	Version 11.1.5
Apple Itunes	Version 11.1

Running on/with	Platform Versions
Apple Mac Os X	All versions

Related CWEs

CWE-264

References (2)

http://support.apple.com/kb/HT6251

Source: product-security@apple.com

Vendor Advisory

http://support.apple.com/kb/HT6251

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.