Sign-up

ID

VAR-201608-0187


CVE

CVE-2016-4656


TITLE

Apple iOS  Vulnerability in kernel that could allow arbitrary code execution within a privileged context

Trust: 0.8

sources: JVNDB: JVNDB-2016-004456

DESCRIPTION

The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. ( Memory corruption ) It may be in a state. Apple iOS is prone to a memory-corruption vulnerability. Failed exploit attempts may result in a denial-of-service condition. Versions prior to Apple iOS 9.3.5 are vulnerable. Kernel is one of the kernel components. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-08-25-1 iOS 9.3.5 iOS 9.3.5 is now available and addresses the following: Kernel Available for: iPhone 4s and later, iPad 2 and later, iPod touch (5th generation) and later Impact: An application may be able to disclose kernel memory Description: A validation issue was addressed through improved input sanitization. CVE-2016-4655: Citizen Lab and Lookout Kernel Available for: iPhone 4s and later, iPad 2 and later, iPod touch (5th generation) and later Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-4656: Citizen Lab and Lookout WebKit Available for: iPhone 4s and later, iPad 2 and later, iPod touch (5th generation) and later Impact: Visiting a maliciously crafted website may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-4657: Citizen Lab and Lookout Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "9.3.5". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJXvzhMAAoJEIOj74w0bLRGBAMP/RvcCKskvhLhBTixjPNBWWqE VFuQCMGif3Q9/2vLv9tQxeesXdG30Rn7LkCSStR0ZhSPrNFlSDlhHj/KOLFd5en+ lgctmToXnLQl+FzTnN0Tn872R3VENBl78OiP6K1urDJHMs1OwGgORyyKQgcaGcDZ GCBK7PUaK/yKVXfm1SJsMcyNL3lRGd05OnCPaXJruMZlbTWidK7R649oodPIIX+H cokqXBjM94M/Y6BUbPAeEh4lSk6ukygYHeb+JuTTj0AQ+82qIkWctkZLIVHZDLak aaTxLFpH9T9BAOTKSnpwFZa0Nj912OSkFbIbCMNyCcX/l7z2Pd+EVg/7rEEZBW+I yyo67JsXWQtCP9/P5El3V1lepNfuGOpRM5S+B/X2X+774QV/Xx8blVXTeDdDAk++ bHblfQKx2Xlkrznl+SFLnDfY5d8TlRmLEcQu1N7DiN22I1Qi9eXdzicBrCHyY3s0 sFTj577aBQ2gyH6EWTg4VfZHKKXtzPTNuSpAwobK8HKacezUhCXQ0BScmS47UMHu uk/sdirJX1GAfD0P7bcOsnTdMHG+vkXIFTuV+JsGcpg136kdg7rejVIsj/AKRChz f+e/7YsJIpMQriDr4w07huosClXKqSw64ygPyP0KYHTjO1picPocw1SF7eqyeng0 C6oESP46AbWYUbdihpm7 =PDst -----END PGP SIGNATURE-----

Trust: 2.16

sources: NVD: CVE-2016-4656 // JVNDB: JVNDB-2016-004456 // BID: 92652 // VULHUB: VHN-93475 // VULMON: CVE-2016-4656 // PACKETSTORM: 138513

AFFECTED PRODUCTS

vendor:applemodel:iphone osscope:ltversion:9.3.5

Trust: 1.0

vendor:アップルmodel:iosscope:ltversion:(ipod touch no. 5 generation onwards )

Trust: 0.8

vendor:アップルmodel:iosscope:ltversion:(iphone 4s from )

Trust: 0.8

vendor:アップルmodel:iosscope:eqversion:9.3.5

Trust: 0.8

vendor:アップルmodel:iosscope:eqversion: -

Trust: 0.8

vendor:アップルmodel:iosscope:ltversion:(ipad 2 from )

Trust: 0.8

vendor:applemodel:iphone osscope:eqversion:9.3.4

Trust: 0.6

vendor:applemodel:iosscope:eqversion:30

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.8

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.10

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.1

Trust: 0.3

vendor:applemodel:ipod touchscope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:40

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.11.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1

Trust: 0.3

vendor:applemodel:iosscope:neversion:9.3.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.4.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:50

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.9

Trust: 0.3

vendor:applemodel:mac os security updatescope:neversion:x2016

Trust: 0.3

vendor:applemodel:iosscope:eqversion:2.0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.1.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1

Trust: 0.3

vendor:applemodel:iphonescope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.7

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.2

Trust: 0.3

vendor:applemodel:ipadscope:eqversion:0

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.1.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:5.0.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.1.6

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.4

Trust: 0.3

vendor:applemodel:iosscope:eqversion:6.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:9.3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.3.1

Trust: 0.3

vendor:applemodel:iosscope:eqversion:8.3

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:3.2

Trust: 0.3

vendor:applemodel:iosscope:eqversion:4.2.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.10.5

Trust: 0.3

vendor:applemodel:iosscope:eqversion:7.0.1

Trust: 0.3

sources: BID: 92652 // JVNDB: JVNDB-2016-004456 // CNNVD: CNNVD-201608-461 // NVD: CVE-2016-4656

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-4656
value: HIGH

Trust: 1.0

NVD: CVE-2016-4656
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201608-461
value: CRITICAL

Trust: 0.6

VULHUB: VHN-93475
value: HIGH

Trust: 0.1

VULMON: CVE-2016-4656
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-4656
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-93475
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-4656
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2016-4656
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-93475 // VULMON: CVE-2016-4656 // JVNDB: JVNDB-2016-004456 // CNNVD: CNNVD-201608-461 // NVD: CVE-2016-4656

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

problemtype:Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

problemtype:CWE-264

Trust: 0.1

sources: VULHUB: VHN-93475 // JVNDB: JVNDB-2016-004456 // NVD: CVE-2016-4656

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201608-461

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201608-461

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-93475 // 
            
            
            
            VULMON: CVE-2016-4656

PATCH
title:HT207130url:https://support.apple.com/en-us/HT201222
Trust: 0.8
title:Apple iOS kernel Repair measures for memory corruption vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=63784
Trust: 0.6
title:Apple: Security Update 2016-001 El Capitan and Security Update 2016-005 Yosemiteurl:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=1cd4f8dc2dba2c6d86a698113e0588fc
Trust: 0.1
title:Apple: iOS 9.3.5url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=804bc13f15b1f31921cd544e2c4873d7
Trust: 0.1
title:br0keurl:https://github.com/tomitokics/br0ke 
Trust: 0.1
title:Tridenturl:https://github.com/EGYbkgo9449/Trident 
Trust: 0.1
title:iOS-9.3.2-Trident-5Curl:https://github.com/AhmedZKool/iOS-9.3.2-Trident-5C 
Trust: 0.1
title:PegasusXurl:https://github.com/jndok/PegasusX 
Trust: 0.1
title:skybreakurl:https://github.com/Cryptiiiic/skybreak 
Trust: 0.1
title:daibutsuurl:https://github.com/dora2-iOS/daibutsu 
Trust: 0.1
title:Trident-masterurl:https://github.com/mehulrao/Trident-master 
Trust: 0.1
title:jdong-learning-resourcesurl:https://github.com/joydo/jdong-learning-resources 
Trust: 0.1
title:Tridenturl:https://github.com/0nc1s/Trident 
Trust: 0.1
title:Tridenturl:https://github.com/benjamin-42/Trident 
Trust: 0.1
title:Trident-Add-Supporturl:https://github.com/mehulrao/Trident-Add-Support 
Trust: 0.1
title:OSG-TranslationTeamurl:https://github.com/r0ysue/OSG-TranslationTeam 
Trust: 0.1
title:reverse-engineering-toolkiturl:https://github.com/geeksniper/reverse-engineering-toolkit 
Trust: 0.1
title:Threatposturl:https://threatpost.com/emergency-ios-update-patches-zero-days-used-by-government-spyware/120158/
Trust: 0.1
sources:
            
            
            VULMON: CVE-2016-4656 // 
            
            
            
            JVNDB: JVNDB-2016-004456 // 
            
            
            
            CNNVD: CNNVD-201608-461

EXTERNAL IDS
db:NVDid:CVE-2016-4656
Trust: 3.8
db:BIDid:92652
Trust: 1.5
db:EXPLOIT-DBid:44836
Trust: 1.2
db:SECTRACKid:1036694
Trust: 1.2
db:JVNid:JVNVU92267426
Trust: 0.8
db:JVNid:JVNVU99497792
Trust: 0.8
db:JVNDBid:JVNDB-2016-004456
Trust: 0.8
db:CNNVDid:CNNVD-201608-461
Trust: 0.7
db:VULHUBid:VHN-93475
Trust: 0.1
db:VULMONid:CVE-2016-4656
Trust: 0.1
db:PACKETSTORMid:138513
Trust: 0.1
sources:
            
            
            VULHUB: VHN-93475 // 
            
            
            
            VULMON: CVE-2016-4656 // 
            
            
            
            BID: 92652 // 
            
            
            
            JVNDB: JVNDB-2016-004456 // 
            
            
            
            PACKETSTORM: 138513 // 
            
            
            
            CNNVD: CNNVD-201608-461 // 
            
            
            
            NVD: CVE-2016-4656

REFERENCES
url:http://lists.apple.com/archives/security-announce/2016/aug/msg00000.html
Trust: 1.8
url:https://support.apple.com/ht207107
Trust: 1.8
url:http://www.securityfocus.com/bid/92652
Trust: 1.3
url:https://www.exploit-db.com/exploits/44836/
Trust: 1.3
url:https://blog.lookout.com/blog/2016/08/25/trident-pegasus/
Trust: 1.2
url:http://www.securitytracker.com/id/1036694
Trust: 1.2
url:http://jvn.jp/vu/jvnvu99497792/index.html
Trust: 0.8
url:http://jvn.jp/vu/jvnvu92267426/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-4656
Trust: 0.8
url:https://www.ipa.go.jp/security/ciadr/vul/20160829-ios.html
Trust: 0.8
url:https://cisa.gov/known-exploited-vulnerabilities-catalog
Trust: 0.8
url:http://www.apple.com/ios/
Trust: 0.3
url:http://www.apple.com/ipad/
Trust: 0.3
url:http://www.apple.com/iphone/
Trust: 0.3
url:http://www.apple.com/ipodtouch/
Trust: 0.3
url:http://www.symantec.com/connect/blogs/trident-trio-ios-zero-days-being-exploited-wild
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/264.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://github.com/tomitokics/br0ke
Trust: 0.1
url:http://tools.cisco.com/security/center/viewalert.x?alertid=48711
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4656
Trust: 0.1
url:https://www.apple.com/itunes/
Trust: 0.1
url:https://support.apple.com/kb/ht201222
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4655
Trust: 0.1
url:https://gpgtools.org
Trust: 0.1
url:https://www.apple.com/support/security/pgp/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2016-4657
Trust: 0.1
sources:
            
            
            VULHUB: VHN-93475 // 
            
            
            
            VULMON: CVE-2016-4656 // 
            
            
            
            BID: 92652 // 
            
            
            
            JVNDB: JVNDB-2016-004456 // 
            
            
            
            PACKETSTORM: 138513 // 
            
            
            
            CNNVD: CNNVD-201608-461 // 
            
            
            
            NVD: CVE-2016-4656

CREDITS
Citizen Lab and Lookout.
Trust: 0.3
sources:
            
            
            BID: 92652

SOURCES
db:VULHUBid:VHN-93475
db:VULMONid:CVE-2016-4656
db:BIDid:92652
db:JVNDBid:JVNDB-2016-004456
db:PACKETSTORMid:138513
db:CNNVDid:CNNVD-201608-461
db:NVDid:CVE-2016-4656

LAST UPDATE DATE
2024-08-14T12:40:09.440000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-93475date:2018-06-08T00:00:00
db:VULMONid:CVE-2016-4656date:2018-06-08T00:00:00
db:BIDid:92652date:2016-09-02T06:00:00
db:JVNDBid:JVNDB-2016-004456date:2024-07-08T06:06:00
db:CNNVDid:CNNVD-201608-461date:2016-10-27T00:00:00
db:NVDid:CVE-2016-4656date:2024-07-02T12:22:15.633

SOURCES RELEASE DATE
db:VULHUBid:VHN-93475date:2016-08-25T00:00:00
db:VULMONid:CVE-2016-4656date:2016-08-25T00:00:00
db:BIDid:92652date:2016-08-25T00:00:00
db:JVNDBid:JVNDB-2016-004456date:2016-08-29T00:00:00
db:PACKETSTORMid:138513date:2016-08-25T22:22:22
db:CNNVDid:CNNVD-201608-461date:2016-08-26T00:00:00
db:NVDid:CVE-2016-4656date:2016-08-25T21:59:01.087