Sign-up

ID

VAR-201603-0225


CVE

CVE-2016-1765


TITLE

Apple Xcode of otool Vulnerability gained in

Trust: 0.8

sources: JVNDB: JVNDB-2016-001868

DESCRIPTION

otool in Apple Xcode before 7.3 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors. A remote attacker can leverage this issue to execute arbitrary code in the context of the user running the application. Failed exploit attempts may result in a denial-of-service condition. Apple Xcode is an integrated development environment provided by Apple (Apple) to developers. It is mainly used to develop applications for Mac OS X and iOS. otool is one of the decompilation tools for Mac OS X applications. A security vulnerability exists in otool in versions prior to Apple Xcode 7.3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-03-21-4 Xcode 7.3 Xcode 7.3 is now available and addresses the following: otool Available for: OS X El Capitan v10.11 and later Impact: A local attacker may be able to cause unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-ID CVE-2016-1765 : Proteas of Qihoo 360 Nirvan Team and Will Estes (@squiffy) subversion Available for: OS X El Capitan v10.11 and later Impact: A malicious server may be able to execute arbitrary code Description: Multiple vulnerabilities existed in subversion versions prior to 1.7.21, the most serious of which may have led to remote code execution. These were addressed by updating subversion to version 1.7.22. CVE-ID CVE-2015-3184 : C. Michael Pilato, CollabNet CVE-2015-3187 : C. Michael Pilato, CollabNet Xcode 7.0 may be obtained from: https://developer.apple.com/xcode/downloads/ To check that the Xcode has been updated: * Select Xcode in the menu bar * Select About Xcode * The version after applying this update will be "7.3". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJW8JQAAAoJEBcWfLTuOo7tO6gQAJAW+kXp0TuFMDT6xHo2YVIq OiRdtYYsaQ0vLXHhDFQP+8uXPSz6KnunxKYZhA3JsSIjXZcv+O0Vw9hP/5A3/nj8 vXYCFmVW9m7rse4k7m117PYdPuKuWtAvDU19b7B2/vPsrv1R6C5R+jZj7hi9Vp2T 4Vx4oLeXCAhzpuDNfvtnyI756b8j63si2eSMSIPp+smQl4RKWtEJEAX5yHkDpeyl cuCHiEbwx4+UomEp5jpOPGjcmohjpTrbBJE8hH/k6W85bBj+rhBPJoBAYafW7nHt 6uokIgZtU59ZEAwC8hme0vzApINfslV1fiJk1HN/rP6Cp+ptdIZGL8zydmzIh7yq gEnfcEEhD2TTkJYnt22l42ZtCDsGJkFBF/r77EHmYWUJfmR4a4Jismp4sGGPgZ12 OitRfBzojK1+Ah6tkYV2LKIfjstprBTRZdz0XKQtjgAwfgktAalrWiibZs2zBNF5 UfZKAsM3Qc9RBK5pNQpGMlrHQtnFdD74Df4TYRlSuKZRO5DLr0STDeHXQfn4Ti/9 8+ZifqggFuWBfh5es4EFdcpxRRqWI9OKOdgQ0Oc5tXwIyAlOshxNuP3qAgVQzwwd COicsW/1HsUoaopDuf+bzDcJPL/L9H3SRYfg4S/uv5JOjoaPr0pQC8mUfR25dZAw cU0NiqyyiqU1H29UaU50 =9aiD -----END PGP SIGNATURE-----

Trust: 2.16

sources: NVD: CVE-2016-1765 // JVNDB: JVNDB-2016-001868 // BID: 85053 // VULHUB: VHN-90584 // VULMON: CVE-2016-1765 // PACKETSTORM: 136345

AFFECTED PRODUCTS

vendor:applemodel:xcodescope:lteversion:7.2.1

Trust: 1.0

vendor:applemodel:xcodescope:ltversion:7.3 (os x el capitan v10.11 or later )

Trust: 0.8

vendor:applemodel:xcodescope:eqversion:7.2.1

Trust: 0.6

vendor:applemodel:xcodescope:eqversion:2.4.1

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:3.1

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:3.0

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:2.3

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:2.2

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:2.1

Trust: 0.3

vendor:applemodel:xcodescope:eqversion:2.0

Trust: 0.3

sources: BID: 85053 // JVNDB: JVNDB-2016-001868 // CNNVD: CNNVD-201603-372 // NVD: CVE-2016-1765

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-1765
value: HIGH

Trust: 1.0

NVD: CVE-2016-1765
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201603-372
value: MEDIUM

Trust: 0.6

VULHUB: VHN-90584
value: MEDIUM

Trust: 0.1

VULMON: CVE-2016-1765
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2016-1765
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-90584
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-1765
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 1.0

sources: VULHUB: VHN-90584 // VULMON: CVE-2016-1765 // JVNDB: JVNDB-2016-001868 // CNNVD: CNNVD-201603-372 // NVD: CVE-2016-1765

PROBLEMTYPE DATA

problemtype:CWE-119

Trust: 1.9

sources: VULHUB: VHN-90584 // JVNDB: JVNDB-2016-001868 // NVD: CVE-2016-1765

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201603-372

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201603-372

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-001868

PATCH
title:Apple security updatesurl:https://support.apple.com/en-us/HT201222
Trust: 0.8
title:APPLE-SA-2016-03-21-4 Xcode 7.3url:http://lists.apple.com/archives/security-announce/2016/Mar/msg00003.html
Trust: 0.8
title:HT206172url:https://support.apple.com/en-us/HT206172
Trust: 0.8
title:HT206172url:https://support.apple.com/ja-jp/HT206172
Trust: 0.8
title:Apple Xcode otool Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=60693
Trust: 0.6
title:Apple: Xcode 7.3url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=35b0e7845e4cc72a3aa1c1ab79f96727
Trust: 0.1
sources:
            
            
            VULMON: CVE-2016-1765 // 
            
            
            
            JVNDB: JVNDB-2016-001868 // 
            
            
            
            CNNVD: CNNVD-201603-372

EXTERNAL IDS
db:NVDid:CVE-2016-1765
Trust: 3.0
db:SECTRACKid:1035352
Trust: 1.2
db:JVNid:JVNVU97668313
Trust: 0.8
db:JVNDBid:JVNDB-2016-001868
Trust: 0.8
db:CNNVDid:CNNVD-201603-372
Trust: 0.6
db:BIDid:85053
Trust: 0.5
db:VULHUBid:VHN-90584
Trust: 0.1
db:VULMONid:CVE-2016-1765
Trust: 0.1
db:PACKETSTORMid:136345
Trust: 0.1
sources:
            
            
            VULHUB: VHN-90584 // 
            
            
            
            VULMON: CVE-2016-1765 // 
            
            
            
            BID: 85053 // 
            
            
            
            JVNDB: JVNDB-2016-001868 // 
            
            
            
            PACKETSTORM: 136345 // 
            
            
            
            CNNVD: CNNVD-201603-372 // 
            
            
            
            NVD: CVE-2016-1765

REFERENCES
url:http://lists.apple.com/archives/security-announce/2016/mar/msg00003.html
Trust: 1.8
url:https://support.apple.com/ht206172
Trust: 1.8
url:http://www.securitytracker.com/id/1035352
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-1765
Trust: 0.8
url:http://jvn.jp/vu/jvnvu97668313/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-1765
Trust: 0.8
url:http://www.apple.com/macosx/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/119.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.securityfocus.com/bid/85053
Trust: 0.1
url:https://support.apple.com/kb/ht206172
Trust: 0.1
url:https://support.apple.com/kb/ht201222
Trust: 0.1
url:https://www.apple.com/support/security/pgp/
Trust: 0.1
url:https://gpgtools.org
Trust: 0.1
url:https://developer.apple.com/xcode/downloads/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-1765
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-3184
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-3187
Trust: 0.1
sources:
            
            
            VULHUB: VHN-90584 // 
            
            
            
            VULMON: CVE-2016-1765 // 
            
            
            
            BID: 85053 // 
            
            
            
            JVNDB: JVNDB-2016-001868 // 
            
            
            
            PACKETSTORM: 136345 // 
            
            
            
            CNNVD: CNNVD-201603-372 // 
            
            
            
            NVD: CVE-2016-1765

CREDITS
Proteas of Qihoo 360 Nirvan Team and Will Estes
Trust: 0.3
sources:
            
            
            BID: 85053

SOURCES
db:VULHUBid:VHN-90584
db:VULMONid:CVE-2016-1765
db:BIDid:85053
db:JVNDBid:JVNDB-2016-001868
db:PACKETSTORMid:136345
db:CNNVDid:CNNVD-201603-372
db:NVDid:CVE-2016-1765

LAST UPDATE DATE
2024-08-14T12:16:11.540000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-90584date:2016-12-03T00:00:00
db:VULMONid:CVE-2016-1765date:2016-12-03T00:00:00
db:BIDid:85053date:2016-03-21T00:00:00
db:JVNDBid:JVNDB-2016-001868date:2016-03-28T00:00:00
db:CNNVDid:CNNVD-201603-372date:2016-03-24T00:00:00
db:NVDid:CVE-2016-1765date:2016-12-03T03:22:49.910

SOURCES RELEASE DATE
db:VULHUBid:VHN-90584date:2016-03-24T00:00:00
db:VULMONid:CVE-2016-1765date:2016-03-24T00:00:00
db:BIDid:85053date:2016-03-21T00:00:00
db:JVNDBid:JVNDB-2016-001868date:2016-03-28T00:00:00
db:PACKETSTORMid:136345date:2016-03-22T15:15:02
db:CNNVDid:CNNVD-201603-372date:2016-03-24T00:00:00
db:NVDid:CVE-2016-1765date:2016-03-24T01:59:33.657