Sign-up

ID

VAR-201504-0113


CVE

CVE-2015-1097


TITLE

Apple iOS and Apple TV of IOMobileFramebuffer Vulnerability in which important information is obtained

Trust: 0.8

sources: JVNDB: JVNDB-2015-002172

DESCRIPTION

IOMobileFramebuffer in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app. Apple iOS and TV are prone to multiple information-disclosure vulnerabilities. An attacker can exploit these issues to obtain sensitive information that may lead to further attacks. These issues are fixed in: Apple iOS 8.3 Apple TV 7.2. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2015-04-08-4 Apple TV 7.2 Apple TV 7.2 is now available and addresses the following: Apple TV Available for: Apple TV 3rd generation and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A validation issue existed in IOKit objects used by an audio driver. This issue was addressed through improved validation of metadata. CVE-ID CVE-2015-1086 Apple TV Available for: Apple TV 3rd generation and later Impact: An application using NSXMLParser may be misused to disclose information Description: An XML External Entity issue existed in NSXMLParser's handling of XML. This issue was addressed by not loading external entities across origins. This issue was addressed by removing unneeded code. CVE-ID CVE-2015-1094 : Cererdlong of Alibaba Mobile Security Team Apple TV Available for: Apple TV 3rd generation and later Impact: A malicious HID device may be able to cause arbitrary code execution Description: A memory corruption issue existed in an IOHIDFamily API. This issue was addressed through improved memory handling. This issue was addressed through improved bounds checking. This issue was addressed through improved bounds checking. CVE-ID CVE-2015-1097 : Barak Gabai of the IBM X-Force Application Security Research Team Apple TV Available for: Apple TV 3rd generation and later Impact: A malicious application may be able to cause a system denial of service Description: A race condition existed in the kernel's setreuid system call. This issue was addressed through improved state management. CVE-ID CVE-2015-1099 : Mark Mentovai of Google Inc. Apple TV Available for: Apple TV 3rd generation and later Impact: A malicious application may escalate privileges using a compromised service intended to run with reduced privileges Description: setreuid and setregid system calls failed to drop privileges permanently. This issue was addressed by correctly dropping privileges. CVE-ID CVE-2015-1117 : Mark Mentovai of Google Inc. This issue was addressed through improved memory handling. CVE-ID CVE-2015-1100 : Maxime Villard of m00nbsd Apple TV Available for: Apple TV 3rd generation and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A memory corruption issue existed in the kernel. This issue was addressed through improved memory handling. CVE-ID CVE-2015-1101 : lokihardt@ASRT working with HP's Zero Day Initiative Apple TV Available for: Apple TV 3rd generation and later Impact: An attacker with a privileged network position may be able to cause a denial of service Description: A state inconsistency existed in the processing of TCP headers. This issue was addressed through improved state handling. CVE-ID CVE-2015-1102 : Andrey Khudyakov and Maxim Zhuravlev of Kaspersky Lab Apple TV Available for: Apple TV 3rd generation and later Impact: An attacker with a privileged network position may be able to redirect user traffic to arbitrary hosts Description: ICMP redirects were enabled by default on iOS. This issue was addressed by disabling ICMP redirects. CVE-ID CVE-2015-1103 : Zimperium Mobile Security Labs Apple TV Available for: Apple TV 3rd generation and later Impact: A remote attacker may be able to bypass network filters Description: The system would treat some IPv6 packets from remote network interfaces as local packets. The issue was addressed by rejecting these packets. CVE-ID CVE-2015-1104 : Stephen Roettger of the Google Security Team Apple TV Available for: Apple TV 3rd generation and later Impact: A remote attacker may be able to cause a denial of service Description: A state inconsistency issue existed in the handling of TCP out of band data. This issue was addressed through improved state management. CVE-ID CVE-2015-1105 : Kenton Varda of Sandstorm.io Apple TV Available for: Apple TV 3rd generation and later Impact: Processing a maliciously crafted configuration profile may lead to unexpected application termination Description: A memory corruption issue existed in the handling of configuration profiles. This issue was addressed through improved bounds checking. CVE-ID CVE-2015-1118 : Zhaofeng Chen, Hui Xue, Yulong Zhang, and Tao Wei of FireEye, Inc. Apple TV Available for: Apple TV 3rd generation and later Impact: Unnecessary information may be sent to external servers when downloading podcast assets Description: When downloading assets for podcast a user was subscribed to, unique identifiers were sent to external servers. This issue was resolved by removing these identifiers. CVE-ID CVE-2015-1110 : Alex Selivanov Apple TV Available for: Apple TV 3rd generation and later Impact: Hardware identifiers may be accessible by third-party apps Description: An information disclosure issue existed in the third- party app sandbox. This issue was addressed by improving the sandbox profile. CVE-ID CVE-2015-1114 Apple TV Available for: Apple TV 3rd generation and later Impact: Visiting a maliciously crafted website may lead to arbitrary code execution Description: Multiple memory corruption issues existed in WebKit. These issues were addressed through improved memory handling. CVE-ID CVE-2015-1068 : Apple CVE-2015-1069 : lokihardt@ASRT working with HP's Zero Day Initiative CVE-2015-1070 : Apple CVE-2015-1071 : Apple CVE-2015-1072 CVE-2015-1073 : Apple CVE-2015-1074 : Apple CVE-2015-1076 CVE-2015-1077 : Apple CVE-2015-1078 : Apple CVE-2015-1079 : Apple CVE-2015-1080 : Apple CVE-2015-1081 : Apple CVE-2015-1082 : Apple CVE-2015-1083 : Apple CVE-2015-1119 : Renata Hodovan of University of Szeged / Samsung Electronics CVE-2015-1120 : Apple CVE-2015-1121 : Apple CVE-2015-1122 : Apple CVE-2015-1123 : Randy Luecke and Anoop Menon of Google Inc. Alternatively, you may manually check for software updates by selecting "Settings -> General -> Update Software". To check the current version of software, select "Settings -> General -> About". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT1222 -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJVJHMgAAoJEBcWfLTuOo7tjVUP/3e7Bo8L4f4+EFs7jkhKVzP5 6LxAuhAtXu+476K1iDKOwa0gyLu8ftp95Af0rgUHjqmNGgsrAYZPgG8Q3HzS/RpK 1JyShFHNIF87sqVGYfVpRthO10yRAQxNmJ/6zGTRU/Djwb/FBZyrMcbG0SMZ47KX CerNerPwiI7dzKWWNHgvmj9ydJU9bSyI5bgweQ565BLKs0Lar8aqj6A/iV1Ekltn A33LSrgMTgK+pjUl1CwQLZ05x9YPpCGXsA55u3MApfL2ZdoOk0VBpi/e56JrSq1J BioCyTJn+DwDY+FjGg5vCjeGJGq4zQ/2SsLQwKLiK6Fje68LutNtrqPtNApWabh3 j876IiLpih2ZMV4KgqvCrkkMI2fkXlVOMLKUhI+UHJ4aWJTNprRwLbaJ7boQ9TCy MJ9B39iPJtyZWtorXBUc0RC2N1HLj5ONZut6FtRkIoiMTaGe6ejbvM39BWC+1sgW PsAYkvrEKzTcSdC6yY1RI2bufBD9SgtMD8f6y/q912uHf55poPSR9SV1iV5Tzftz UPvxGTLlmcXzU52nlSZNYEp4U9Nh02ltUYhs6MptoVvHf4MZW9TaIj9YpBNdVMvb vjB3UoPyAAb4GUqqVK6l5c6wlCyoCRg6Z86a99bW7PKBUP5C0LEzqwbZIMCkrX3i iPMObURhCq+xIYRUTKXE =ktgN -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2015-1097 // JVNDB: JVNDB-2015-002172 // BID: 73983 // VULHUB: VHN-79057 // PACKETSTORM: 131361

AFFECTED PRODUCTS

vendor:applemodel:iphone osscope:lteversion:8.2

Trust: 1.0

vendor:applemodel:tvosscope:lteversion:7.1

Trust: 1.0

vendor:applemodel:tvscope:ltversion:7.2 (apple tv first 3 after generation )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:8.3 (ipad 2 or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:8.3 (iphone 4s or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:8.3 (ipod touch first 5 after generation )

Trust: 0.8

vendor:applemodel:iphone osscope:eqversion:8.2

Trust: 0.6

vendor:applemodel:tvscope:eqversion:7.1

Trust: 0.6

vendor:applemodel:ipod touchscope:eqversion:0

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:0

Trust: 0.3

vendor:applemodel:ipadscope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.10

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.0

Trust: 0.3

vendor:applemodel:tvscope:eqversion:5.0

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.4

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.0

Trust: 0.3

vendor:applemodel:tvscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:tvscope:eqversion:1.0

Trust: 0.3

sources: BID: 73983 // JVNDB: JVNDB-2015-002172 // CNNVD: CNNVD-201504-123 // NVD: CVE-2015-1097

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-1097
value: LOW

Trust: 1.0

NVD: CVE-2015-1097
value: LOW

Trust: 0.8

CNNVD: CNNVD-201504-123
value: LOW

Trust: 0.6

VULHUB: VHN-79057
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2015-1097
severity: LOW
baseScore: 1.9
vectorString: AV:L/AC:M/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.4
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-79057
severity: LOW
baseScore: 1.9
vectorString: AV:L/AC:M/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.4
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-79057 // JVNDB: JVNDB-2015-002172 // CNNVD: CNNVD-201504-123 // NVD: CVE-2015-1097

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

sources: VULHUB: VHN-79057 // JVNDB: JVNDB-2015-002172 // NVD: CVE-2015-1097

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201504-123

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201504-123

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-002172

PATCH
title:APPLE-SA-2015-04-08-3 iOS 8.3url:http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html
Trust: 0.8
title:APPLE-SA-2015-04-08-4 Apple TV 7.2url:http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html
Trust: 0.8
title:HT204661url:http://support.apple.com/en-us/HT204661
Trust: 0.8
title:HT204662url:http://support.apple.com/en-us/HT204662
Trust: 0.8
title:HT204661url:http://support.apple.com/ja-jp/HT204661
Trust: 0.8
title:HT204662url:http://support.apple.com/ja-jp/HT204662
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2015-002172

EXTERNAL IDS
db:NVDid:CVE-2015-1097
Trust: 2.9
db:BIDid:73983
Trust: 2.0
db:SECTRACKid:1032050
Trust: 1.7
db:JVNid:JVNVU91828320
Trust: 0.8
db:JVNDBid:JVNDB-2015-002172
Trust: 0.8
db:CNNVDid:CNNVD-201504-123
Trust: 0.7
db:VULHUBid:VHN-79057
Trust: 0.1
db:PACKETSTORMid:131361
Trust: 0.1
sources:
            
            
            VULHUB: VHN-79057 // 
            
            
            
            BID: 73983 // 
            
            
            
            JVNDB: JVNDB-2015-002172 // 
            
            
            
            PACKETSTORM: 131361 // 
            
            
            
            CNNVD: CNNVD-201504-123 // 
            
            
            
            NVD: CVE-2015-1097

REFERENCES
url:http://lists.apple.com/archives/security-announce/2015/apr/msg00002.html
Trust: 1.7
url:http://lists.apple.com/archives/security-announce/2015/apr/msg00003.html
Trust: 1.7
url:http://www.securityfocus.com/bid/73983
Trust: 1.7
url:https://support.apple.com/ht204661
Trust: 1.7
url:https://support.apple.com/ht204662
Trust: 1.7
url:http://www.securitytracker.com/id/1032050
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-1097
Trust: 0.8
url:http://jvn.jp/vu/jvnvu91828320/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-1097
Trust: 0.8
url:http://www.apple.com/ios/
Trust: 0.3
url:http://www.apple.com/ipad/
Trust: 0.3
url:http://www.apple.com/iphone/
Trust: 0.3
url:http://www.apple.com/ipodtouch/
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2015-1099
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1101
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1073
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1102
Trust: 0.1
url:https://gpgtools.org
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1083
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1105
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1069
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1092
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1079
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1076
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1086
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1104
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1095
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1077
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1103
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1097
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1070
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1094
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1071
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1096
Trust: 0.1
url:https://support.apple.com/kb/ht1222
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1100
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1072
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1082
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1081
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1080
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1068
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1078
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1074
Trust: 0.1
sources:
            
            
            VULHUB: VHN-79057 // 
            
            
            
            BID: 73983 // 
            
            
            
            JVNDB: JVNDB-2015-002172 // 
            
            
            
            PACKETSTORM: 131361 // 
            
            
            
            CNNVD: CNNVD-201504-123 // 
            
            
            
            NVD: CVE-2015-1097

CREDITS
Alex Selivanov, Barak Gabai of the IBM X-Force Application Security Research Team, Cererdlong of Alibaba Mobile Security Team,  Ikuya Fukumoto and Apple
Trust: 0.3
sources:
            
            
            BID: 73983

SOURCES
db:VULHUBid:VHN-79057
db:BIDid:73983
db:JVNDBid:JVNDB-2015-002172
db:PACKETSTORMid:131361
db:CNNVDid:CNNVD-201504-123
db:NVDid:CVE-2015-1097

LAST UPDATE DATE
2024-11-23T21:22:26.097000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-79057date:2019-03-08T00:00:00
db:BIDid:73983date:2015-07-15T00:04:00
db:JVNDBid:JVNDB-2015-002172date:2015-04-14T00:00:00
db:CNNVDid:CNNVD-201504-123date:2019-03-13T00:00:00
db:NVDid:CVE-2015-1097date:2024-11-21T02:24:39.783

SOURCES RELEASE DATE
db:VULHUBid:VHN-79057date:2015-04-10T00:00:00
db:BIDid:73983date:2015-04-08T00:00:00
db:JVNDBid:JVNDB-2015-002172date:2015-04-14T00:00:00
db:PACKETSTORMid:131361date:2015-04-09T16:39:51
db:CNNVDid:CNNVD-201504-123date:2015-04-13T00:00:00
db:NVDid:CVE-2015-1097date:2015-04-10T14:59:13.577