Apple Safari HSTS mechanism Bypass Vulnerability (CVE-2015-7094)

Apple Safari HSTS mechanism Bypass Vulnerability (CVE-2015-7094)
Apple Safari HSTS mechanism Bypass Vulnerability (CVE-2015-7094)

Release date:
Updated on:

Affected Systems:

Apple iOS <9.2

Description:

CVE (CAN) ID: CVE-2015-7094

IOS is an operating system developed by Apple for mobile devices. It supports iPhone, iPod touch, iPad, and Apple TV.

In versions earlier than Apple iOS 9.2 and earlier than OS X 10.11.2, The CFNetwork HTTPProtocol has a security vulnerability. Attackers can bypass the HSTS protection mechanism by constructing URLs.

<* Source: Apple
*>

Suggestion:

Vendor patch:

Apple
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Https://support.apple.com/HT205641

Https://support.apple.com/HT205635

This article permanently updates the link address: