Apple has released Apple TV 6.1.1 with security updates that address multiple vulnerabilities. This update is available for Apple TV 2nd generation and later, and addresses 19 security bugs.
The Apple TV 6.1.1 security updates address the following vulnerabilities:
CVE-2014-1296 : An attacker in a privileged network position can obtain web site credentials. Set-Cookie HTTP headers would be processed even if the connection closed before the header line was complete. An attacker could strip security settings from the cookie by forcing the connection to close before the security settings were sent, and then obtain the value of the unprotected cookie. This issue was addressed by ignoring incomplete HTTP header lines.
CVE-2014-1320 : A local user can read kernel pointers, which can be used to bypass kernel address space layout randomization. A set of kernel pointers stored in an IOKit object could be retrieved from userland. This issue was addressed through removing the pointers from the object.
CVE-2014-1295 : An attacker with a privileged network position may capture data or change the operations performed in sessions protected by SSL. In a ‘triple handshake’ attack, it was possible for an attacker to establish two connections that had the same encryption keys and handshake, insert the attacker’s data in one connection, and renegotiate so that the connections may be forwarded to each other. To prevent attacks based on this scenario, Secure Transport was changed so that, by default, a renegotiation must present the same server certificate as was presented in the original connection.
