Sign-up

ID

VAR-201504-0133


CVE

CVE-2015-1117


TITLE

plural Apple Product kernel setreuid and setregid system-call Implementation of code with unintended user or group privileges

Trust: 0.8

sources: JVNDB: JVNDB-2015-002201

DESCRIPTION

The (1) setreuid and (2) setregid system-call implementations in the kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 do not properly perform privilege drops, which makes it easier for attackers to execute code with unintended user or group privileges via a crafted app. Apple TV/Mac OS X/iOS are prone to multiple security vulnerabilities. Attackers can exploit these issues to bypass security restrictions, obtain sensitive information, execute arbitrary code, gain elevated privileges, conduct phishing attacks and perform other attacks. Failed attacks may cause denial-of-service conditions. Apple iOS, Apple OS X and Apple TV are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices; Apple OS X is a dedicated operating system developed for Mac computers; Apple TV is a high-definition television set-top box product. The vulnerability is caused by the program not properly lowering the privileges. The following products and versions are affected: Apple iOS versions prior to 8.3, Apple OS X versions prior to 10.10.3, and Apple TV versions prior to 7.2. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2015-05-19-1 Watch OS 1.0.1 Watch OS 1.0.1 is now available and addresses the following: Certificate Trust Policy Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: Update to the certificate trust policy Description: The certificate trust policy was updated. The complete list of certificates may be viewed at https://support.apple.com/kb/204873 FontParser Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A memory corruption issue existed in the processing of font files. This issue was addressed through improved bounds checking. CVE-ID CVE-2015-1093 : Marc Schoenefeld Foundation Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: An application using NSXMLParser may be misused to disclose information Description: An XML External Entity issue existed in NSXMLParser's handling of XML. This issue was addressed by not loading external entities across origins. CVE-ID CVE-2015-1092 : Ikuya Fukumoto IOHIDFamily Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: A malicious application may be able to determine kernel memory layout Description: An issue existed in IOHIDFamily that led to the disclosure of kernel memory content. This issue was addressed through improved bounds checking. CVE-ID CVE-2015-1096 : Ilja van Sprundel of IOActive IOAcceleratorFamily Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: A malicious application may be able to determine kernel memory layout Description: An issue existed in IOAcceleratorFamily that led to the disclosure of kernel memory content. This issue was addressed by removing unneeded code. CVE-ID CVE-2015-1094 : Cererdlong of Alibaba Mobile Security Team Kernel Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: A malicious application may be able to cause a system denial of service Description: A race condition existed in the kernel's setreuid system call. This issue was addressed through improved state management. CVE-ID CVE-2015-1099 : Mark Mentovai of Google Inc. Kernel Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: An attacker with a privileged network position may be able to redirect user traffic to arbitrary hosts Description: ICMP redirects were enabled by default. This issue was addressed by disabling ICMP redirects. CVE-ID CVE-2015-1103 : Zimperium Mobile Security Labs Kernel Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: A remote attacker may be able to cause a denial of service Description: A state inconsistency issue existed in the handling of TCP out of band data. This issue was addressed through improved state management. CVE-ID CVE-2015-1105 : Kenton Varda of Sandstorm.io Kernel Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: A malicious application may escalate privileges using a compromised service intended to run with reduced privileges Description: setreuid and setregid system calls failed to drop privileges permanently. This issue was addressed by correctly dropping privileges. CVE-ID CVE-2015-1117 : Mark Mentovai of Google Inc. Kernel Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: A remote attacker may be able to bypass network filters Description: The system would treat some IPv6 packets from remote network interfaces as local packets. The issue was addressed by rejecting these packets. CVE-ID CVE-2015-1104 : Stephen Roettger of the Google Security Team Kernel Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: An attacker with a privileged network position may be able to cause a denial of service Description: A state inconsistency existed in the processing of TCP headers. This issue was addressed through improved state handling. CVE-ID CVE-2015-1102 : Andrey Khudyakov and Maxim Zhuravlev of Kaspersky Lab Kernel Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: A malicious application may be able to cause unexpected system termination or read kernel memory Description: An out of bounds memory access issue existed in the kernel. This issue was addressed through improved memory handling. CVE-ID CVE-2015-1100 : Maxime Villard of m00nbsd Kernel Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A memory corruption issue existed in the kernel. This issue was addressed through improved memory handling. CVE-ID CVE-2015-1101 : lokihardt@ASRT working with HP's Zero Day Initiative Secure Transport Available for: Apple Watch Sport, Apple Watch, and Apple Watch Edition Impact: An attacker with a privileged network position may intercept SSL/TLS connections Description: Secure Transport accepted short ephemeral RSA keys, usually used only in export-strength RSA cipher suites, on connections using full-strength RSA cipher suites. This issue, also known as FREAK, only affected connections to servers which support export-strength RSA cipher suites, and was addressed by removing support for ephemeral RSA keys. CVE-ID CVE-2015-1067 : Benjamin Beurdouche, Karthikeyan Bhargavan, Antoine Delignat-Lavaud, Alfredo Pironti, and Jean Karim Zinzindohoue of Prosecco at Inria Paris Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/en-us/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.22 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBAgAGBQJVW38oAAoJEBcWfLTuOo7tXpIP/3v/tqCIVXg28xQpAK2vRVtw S3clbM17RBsJ1b239DmGUdRNNCVimQCHk1dQ4M3szrXx73VjWroh1hSq2+hObL65 FGa4jYbns7OGbTr9YZW/fScJ9mnAuG1nDHcNLL8W2DyFuxNEJsCB668QPdTTMOoO Xpx8jZUZyXIyX2V3Ch1qasXsSV0IwSA5GPg5IFFFuaNXGC62AXx49UmFTtjBCs4w bvTRPKKBowuP80zmIaxlWpGXhTIe8TwjCDGSejk5kdddcqjXe1yzA1UPM+uBTHZK 7xOX55CctqT2LkO4ND6EWaaPUozDJtEoUf+pFjnJmZxNd6BHPx86KbkUw3lcBXso xZplhgaFlaA4UTxMLFJONId0DYtyXH7CLOYW9BKjyzMMo0YZHdt/2CQ1HQKfzQ9m bT+MT/wdFcgCjr90GLG9OFLCwf5h8bAHRtpvhWrV78ek6V92GuwjZUA8x18avNQO 1th8l49j+JN+OcVv0bvmxVSQpFurTfVRAxZ9lTq4VDdqZanwbvP6INOB8wxhKNbK 8phc4Amh8TwFf2esdmMWawWWAqxXL1+2D+MWxR+C8Hm4CWyxYvKhvHacM20IDTfF 6exVyn4D9FhnT16ggkF6qH9vOOrQk3msHmxdC3fdE4dRhR8W7xRbuNEMXn3CyP6f ssKTqTcaARrUZzOjyx2Z =HMct -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2015-1117 // JVNDB: JVNDB-2015-002201 // BID: 73981 // VULHUB: VHN-79077 // PACKETSTORM: 131932

AFFECTED PRODUCTS

vendor:applemodel:iphone osscope:lteversion:8.2

Trust: 1.0

vendor:applemodel:mac os xscope:lteversion:10.10.2

Trust: 1.0

vendor:applemodel:tvosscope:lteversion:7.1

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.10 to 10.10.2

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:10.8.5

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:10.9.5

Trust: 0.8

vendor:applemodel:tvscope:ltversion:7.2 (apple tv first 3 after generation )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:8.3 (ipad 2 or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:8.3 (iphone 4s or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:8.3 (ipod touch first 5 after generation )

Trust: 0.8

vendor:applemodel:watchosscope:ltversion:1.0.1 (apple watch edition)

Trust: 0.8

vendor:applemodel:watchosscope:ltversion:1.0.1 (apple watch sport)

Trust: 0.8

vendor:applemodel:watchosscope:ltversion:1.0.1 (apple watch)

Trust: 0.8

vendor:applemodel:iphone osscope:eqversion:8.2

Trust: 0.6

vendor:applemodel:tvscope:eqversion:7.1

Trust: 0.6

vendor:applemodel:mac os xscope:eqversion:10.10.2

Trust: 0.6

vendor:applemodel:iosscope:eqversion:4.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.10

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.0

Trust: 0.3

vendor:applemodel:tvscope:eqversion:5.0

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.4

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:tvscope:eqversion:4.0

Trust: 0.3

vendor:applemodel:tvscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:tvscope:eqversion:1.0

Trust: 0.3

sources: BID: 73981 // JVNDB: JVNDB-2015-002201 // CNNVD: CNNVD-201504-142 // NVD: CVE-2015-1117

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-1117
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-1117
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201504-142
value: MEDIUM

Trust: 0.6

VULHUB: VHN-79077
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-1117
severity: MEDIUM
baseScore: 6.9
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-79077
severity: MEDIUM
baseScore: 6.9
vectorString: AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-79077 // JVNDB: JVNDB-2015-002201 // CNNVD: CNNVD-201504-142 // NVD: CVE-2015-1117

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

sources: VULHUB: VHN-79077 // JVNDB: JVNDB-2015-002201 // NVD: CVE-2015-1117

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201504-142

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201504-142

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-002201

PATCH
title:APPLE-SA-2015-04-08-2 OS X 10.10.3 and Security Update 2015-004url:http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
Trust: 0.8
title:APPLE-SA-2015-04-08-4 Apple TV 7.2url:http://lists.apple.com/archives/security-announce/2015/Apr/msg00003.html
Trust: 0.8
title:APPLE-SA-2015-04-08-3 iOS 8.3url:http://lists.apple.com/archives/security-announce/2015/Apr/msg00002.html
Trust: 0.8
title:APPLE-SA-2015-05-19-1 Watch OS 1.0.1url:http://lists.apple.com/archives/security-announce/2015/May/msg00001.html
Trust: 0.8
title:HT204662url:http://support.apple.com/en-us/HT204662
Trust: 0.8
title:HT204661url:http://support.apple.com/en-us/HT204661
Trust: 0.8
title:HT204870url:http://support.apple.com/en-us/HT204870
Trust: 0.8
title:HT204659url:http://support.apple.com/en-us/HT204659
Trust: 0.8
title:HT204870url:http://support.apple.com/ja-jp/HT204870
Trust: 0.8
title:HT204662url:http://support.apple.com/ja-jp/HT204662
Trust: 0.8
title:HT204661url:http://support.apple.com/ja-jp/HT204661
Trust: 0.8
title:HT204659url:http://support.apple.com/ja-jp/HT204659
Trust: 0.8
title:OSXUpd10.10.3url:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=54848
Trust: 0.6
title:AppleTV3,2_7.2_12F69_Restoreurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=54849
Trust: 0.6
title:iPhone7,1_8.3_12F70_Restoreurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=54847
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2015-002201 // 
            
            
            
            CNNVD: CNNVD-201504-142

EXTERNAL IDS
db:NVDid:CVE-2015-1117
Trust: 2.9
db:SECTRACKid:1032048
Trust: 1.7
db:JVNid:JVNVU93832567
Trust: 0.8
db:JVNid:JVNVU91828320
Trust: 0.8
db:JVNDBid:JVNDB-2015-002201
Trust: 0.8
db:CNNVDid:CNNVD-201504-142
Trust: 0.7
db:BIDid:73981
Trust: 0.3
db:VULHUBid:VHN-79077
Trust: 0.1
db:PACKETSTORMid:131932
Trust: 0.1
sources:
            
            
            VULHUB: VHN-79077 // 
            
            
            
            BID: 73981 // 
            
            
            
            JVNDB: JVNDB-2015-002201 // 
            
            
            
            PACKETSTORM: 131932 // 
            
            
            
            CNNVD: CNNVD-201504-142 // 
            
            
            
            NVD: CVE-2015-1117

REFERENCES
url:http://lists.apple.com/archives/security-announce/2015/apr/msg00001.html
Trust: 1.7
url:http://lists.apple.com/archives/security-announce/2015/apr/msg00002.html
Trust: 1.7
url:http://lists.apple.com/archives/security-announce/2015/apr/msg00003.html
Trust: 1.7
url:https://support.apple.com/ht204659
Trust: 1.7
url:https://support.apple.com/ht204661
Trust: 1.7
url:https://support.apple.com/ht204662
Trust: 1.7
url:https://support.apple.com/kb/ht204870
Trust: 1.7
url:http://www.securitytracker.com/id/1032048
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-1117
Trust: 0.8
url:http://jvn.jp/vu/jvnvu91828320/index.html
Trust: 0.8
url:http://jvn.jp/vu/jvnvu93832567/
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-1117
Trust: 0.8
url:http://www.apple.com/ios/
Trust: 0.3
url:http://www.apple.com/appletv/features.html
Trust: 0.3
url:http://www.apple.com/macosx/
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2015-1104
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1093
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1099
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1101
Trust: 0.1
url:https://support.apple.com/kb/ht201222
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1096
Trust: 0.1
url:https://support.apple.com/kb/204873
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1102
Trust: 0.1
url:https://www.apple.com/support/security/pgp/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1105
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1103
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1067
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1092
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1100
Trust: 0.1
url:https://support.apple.com/en-us/ht204641
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1117
Trust: 0.1
url:http://gpgtools.org
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-1094
Trust: 0.1
sources:
            
            
            VULHUB: VHN-79077 // 
            
            
            
            BID: 73981 // 
            
            
            
            JVNDB: JVNDB-2015-002201 // 
            
            
            
            PACKETSTORM: 131932 // 
            
            
            
            CNNVD: CNNVD-201504-142 // 
            
            
            
            NVD: CVE-2015-1117

CREDITS
lokihardt@ASRT working with HP's Zero Day Initiative, Luca Todesco, Ilja van Sprundel of IOActive, Mark Mentovai of Google Inc, Zimperium Mobile Security Labs, Andrey Khudyakov and Maxim Zhuravlev of Kaspersky Lab, Maxime Villard of m00nbsd, lokihardt@ASRT
Trust: 0.3
sources:
            
            
            BID: 73981

SOURCES
db:VULHUBid:VHN-79077
db:BIDid:73981
db:JVNDBid:JVNDB-2015-002201
db:PACKETSTORMid:131932
db:CNNVDid:CNNVD-201504-142
db:NVDid:CVE-2015-1117

LAST UPDATE DATE
2024-11-23T20:38:42.080000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-79077date:2019-03-08T00:00:00
db:BIDid:73981date:2015-07-15T00:04:00
db:JVNDBid:JVNDB-2015-002201date:2015-05-25T00:00:00
db:CNNVDid:CNNVD-201504-142date:2019-03-13T00:00:00
db:NVDid:CVE-2015-1117date:2024-11-21T02:24:42.473

SOURCES RELEASE DATE
db:VULHUBid:VHN-79077date:2015-04-10T00:00:00
db:BIDid:73981date:2015-04-08T00:00:00
db:JVNDBid:JVNDB-2015-002201date:2015-04-15T00:00:00
db:PACKETSTORMid:131932date:2015-05-20T22:44:42
db:CNNVDid:CNNVD-201504-142date:2015-04-14T00:00:00
db:NVDid:CVE-2015-1117date:2015-04-10T14:59:31.747