CFNetwork in Apple iOS before 7.1.1, Apple OS X through 10.9.2, and Apple TV before 6.1.1 does not ensure that a Set-Cookie HTTP header is complete before interpreting the headers value, which allows remote attackers to bypass intended access restrictions by triggering the closing of a TCP connection during transmission of a header, as demonstrated by an HTTPOnly restriction.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Iphone_os | Apple | 7.0 | 7.0 |
| Iphone_os | Apple | 7.0.1 | 7.0.1 |
| Iphone_os | Apple | 7.0.2 | 7.0.2 |
| Iphone_os | Apple | 7.0.3 | 7.0.3 |
| Iphone_os | Apple | 7.0.4 | 7.0.4 |
| Iphone_os | Apple | 7.0.5 | 7.0.5 |
| Iphone_os | Apple | 7.0.6 | 7.0.6 |
| Iphone_os | Apple | * | 7.1 |