CVE-2014-4498

The CPU Software in Apple OS X before 10.10.2 allows physically proximate attackers to modify firmware during the EFI update process by inserting a Thunderbolt device with crafted code in an Option ROM, aka the "Thunderstrike" issue.

CVSS v2.0 4.7 MEDIUM

4.7^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:N/I:C/A:N

Exploitability : 3.4 / Impact : 6.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact COMPLETE

Availability Impact NONE

References

Link	Resource
http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html	Vendor Advisory
http://support.apple.com/HT204244	Vendor Advisory
http://www.securitytracker.com/id/1031650
https://trmm.net/Thunderstrike
http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html	Vendor Advisory
http://support.apple.com/HT204244	Vendor Advisory
http://www.securitytracker.com/id/1031650
https://trmm.net/Thunderstrike

Configurations

Configuration 1 (hide)

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2015-01-30 11:59

Updated : 2025-04-12 10:46

NVD link : CVE-2014-4498

Mitre link : CVE-2014-4498

CVE.ORG link : CVE-2014-4498

JSON object : View

Products Affected

apple

mac_os_x

CWE

CWE-17

DEPRECATED: Code

{"id": "CVE-2014-4498", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.7, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:C/A:N", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-01-30T11:59:27.187", "references": [{"url": "http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "http://support.apple.com/HT204244", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "http://www.securitytracker.com/id/1031650", "source": "product-security@apple.com"}, {"url": "https://trmm.net/Thunderstrike", "source": "product-security@apple.com"}, {"url": "http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://support.apple.com/HT204244", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1031650", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://trmm.net/Thunderstrike", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-17"}]}], "descriptions": [{"lang": "en", "value": "The CPU Software in Apple OS X before 10.10.2 allows physically proximate attackers to modify firmware during the EFI update process by inserting a Thunderbolt device with crafted code in an Option ROM, aka the \"Thunderstrike\" issue."}, {"lang": "es", "value": "El Software de la CPU en Apple OS X anterior a 10.10.2 permite a atacantes f\u00edsicamente pr\u00f3ximos modificar firmware durante el proceso de actualizaci\u00f3n EFI mediante la inserci\u00f3n de un dispositivo Thunderbolt con c\u00f3digo manipulado en un ROM Option, tambi\u00e9n conocido como el problema 'Thunderstrike'."}], "lastModified": "2025-04-12T10:46:40.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24C6A01A-6308-4C69-B4D5-5BC10277E2E5", "versionEndIncluding": "10.10.1"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}