ID

VAR-201702-0225

CVE

CVE-2016-7626

TITLE

plural Apple Vulnerability to execute arbitrary code in product profile component

DESCRIPTION

An issue was discovered in certain Apple products. iOS before 10.2 is affected. tvOS before 10.1 is affected. watchOS before 3.1.1 is affected. The issue involves the "Profiles" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted certificate profile. Apple iOS, WatchOS and tvOS are prone to a memory corruption vulnerability. Failed exploit attempts may result in a denial-of-service condition. The following versions are affected: Versions prior to Apple iOS 10.2 Versions prior to Apple watchOS 3.1.1 Versions prior to Apple tvOS 10.1. in the United States. Apple iOS is an operating system developed for mobile devices; watchOS is a smart watch operating system; tvOS is a smart TV operating system. CVE-2017-2363: lokihardt of Google Project Zero Installation note: Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641 To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About". Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-12-13-6 Additional information for APPLE-SA-2016-12-12-3 tvOS 10.1 tvOS 10.1 addresses the following: Audio Available for: Apple TV (4th generation) Impact: Processing a maliciously crafted file may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved input validation. CVE-2016-7658: Haohao Kong of Keen Lab (@keen_lab) of Tencent CVE-2016-7659: Haohao Kong of Keen Lab (@keen_lab) of Tencent Entry added December 13, 2016 CoreFoundation Available for: Apple TV (4th generation) Impact: Processing malicious strings may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue existed in the processing of strings. This issue was addressed through improved bounds checking. CVE-2016-7663: an anonymous researcher Entry added December 13, 2016 CoreGraphics Available for: Apple TV (4th generation) Impact: Processing a maliciously crafted font file may lead to unexpected application termination Description: A null pointer dereference was addressed through improved input validation. CVE-2016-7627: TRAPMINE Inc. & Meysam Firouzi @R00tkitSMM Entry added December 13, 2016 CoreMedia External Displays Available for: Apple TV (4th generation) Impact: A local application may be able to execute arbitrary code in the context of the mediaserver daemon Description: A type confusion issue was addressed through improved memory handling. CVE-2016-7655: Keen Lab working with Trend Micro's Zero Day Initiative Entry added December 13, 2016 CoreMedia Playback Available for: Apple TV (4th generation) Impact: Processing a maliciously crafted .mp4 file may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-7588: dragonltx of Huawei 2012 Laboratories Entry added December 13, 2016 CoreText Available for: Apple TV (4th generation) Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: Multiple memory corruption issues existed in the handling of font files. These issues were addressed through improved bounds checking. CVE-2016-7595: riusksk(ae3aY=) of Tencent Security Platform Department Entry added December 13, 2016 Disk Images Available for: Apple TV (4th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed through improved input validation. CVE-2016-7616: daybreaker@Minionz working with Trend Micro's Zero Day Initiative Entry added December 13, 2016 FontParser Available for: Apple TV (4th generation) Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: Multiple memory corruption issues existed in the handling of font files. These issues were addressed through improved bounds checking. CVE-2016-4691: riusksk(ae3aY=) of Tencent Security Platform Department Entry added December 13, 2016 FontParser Available for: Apple TV (4th generation) Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A buffer overflow existed in the handling of font files. This issue was addressed through improved bounds checking. CVE-2016-4688: Simon Huang of Alipay company, thelongestusernameofall@gmail.com Entry added December 13, 2016 ICU Available for: Apple TV (4th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-7594: AndrA(c) Bargull Entry added December 13, 2016 ImageIO Available for: Apple TV (4th generation) Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed through improved bounds checking. CVE-2016-7643: Yangkang (@dnpushme) of Qihoo360 Qex Team Entry added December 13, 2016 IOHIDFamily Available for: Apple TV (4th generation) Impact: A local application with system privileges may be able to execute arbitrary code with kernel privileges Description: A use after free issue was addressed through improved memory management. CVE-2016-7591: daybreaker of Minionz Entry added December 13, 2016 IOKit Available for: Apple TV (4th generation) Impact: An application may be able to read kernel memory Description: A memory corruption issue was addressed through improved input validation. CVE-2016-7657: Keen Lab working with Trend Micro's Zero Day Initiative Entry added December 13, 2016 Kernel Available for: Apple TV (4th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues were addressed through improved input validation. CVE-2016-7606: @cocoahuke, Chen Qin of Topsec Alpha Team (topsec.com) CVE-2016-7612: Ian Beer of Google Project Zero Entry added December 13, 2016 Kernel Available for: Apple TV (4th generation) Impact: An application may be able to read kernel memory Description: An insufficient initialization issue was addressed by properly initializing memory returned to user space. CVE-2016-7607: Brandon Azad Entry added December 13, 2016 Kernel Available for: Apple TV (4th generation) Impact: A local user may be able to cause a system denial of service Description: A denial of service issue was addressed through improved memory handling. CVE-2016-7615: The UK's National Cyber Security Centre (NCSC) Entry added December 13, 2016 Kernel Available for: Apple TV (4th generation) Impact: A local user may be able to cause an unexpected system termination or arbitrary code execution in the kernel Description: A use after free issue was addressed through improved memory management. CVE-2016-7621: Ian Beer of Google Project Zero Entry added December 13, 2016 Kernel Available for: Apple TV (4th generation) Impact: A local user may be able to gain root privileges Description: A memory corruption issue was addressed through improved input validation. CVE-2016-7637: Ian Beer of Google Project Zero Entry added December 13, 2016 libarchive Available for: Apple TV (4th generation) Impact: A local attacker may be able to overwrite existing files Description: A validation issue existed in the handling of symlinks. This issue was addressed through improved validation of symlinks. CVE-2016-7619: an anonymous researcher Entry added December 13, 2016 Power Management Available for: Apple TV (4th generation) Impact: A local user may be able to gain root privileges Description: An issue in mach port name references was addressed through improved validation. CVE-2016-7661: Ian Beer of Google Project Zero Entry added December 13, 2016 Profiles Available for: Apple TV (4th generation) Impact: Opening a maliciously crafted certificate may lead to arbitrary code execution Description: A memory corruption issue existed in the handling of certificate profiles. This issue was addressed through improved input validation. CVE-2016-7626: Maksymilian Arciemowicz (cxsecurity.com) Security Available for: Apple TV (4th generation) Impact: An attacker may be able to exploit weaknesses in the 3DES cryptographic algorithm Description: 3DES was removed as a default cipher. CVE-2016-4693: GaA<<tan Leurent and Karthikeyan Bhargavan from INRIA Paris Entry added December 13, 2016 Security Available for: Apple TV (4th generation) Impact: An attacker in a privileged network position may be able to cause a denial of service Description: A validation issue existed in the handling of OCSP responder URLs. This issue was addressed by verifying OCSP revocation status after CA validation and limiting the number of OCSP requests per certificate. CVE-2016-7636: Maksymilian Arciemowicz (cxsecurity.com) Entry added December 13, 2016 Security Available for: Apple TV (4th generation) Impact: Certificates may be unexpectedly evaluated as trusted Description: A certificate evaluation issue existed in certificate validation. This issue was addressed through additional validation of certificates. CVE-2016-7662: Apple Entry added December 13, 2016 syslog Available for: Apple TV (4th generation) Impact: A local user may be able to gain root privileges Description: An issue in mach port name references was addressed through improved validation. CVE-2016-7660: Ian Beer of Google Project Zero Entry added December 13, 2016 WebKit Available for: Apple TV (4th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-2016-4692: Apple CVE-2016-7635: Apple CVE-2016-7652: Apple Entry added December 13, 2016 WebKit Available for: Apple TV (4th generation) Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: A memory corruption issue was addressed through improved input validation. CVE-2016-4743: Alan Cutter Entry added December 13, 2016 WebKit Available for: Apple TV (4th generation) Impact: Processing maliciously crafted web content may result in the disclosure of user information Description: A validation issue was addressed through improved state management. CVE-2016-7586: Boris Zbarsky Entry added December 13, 2016 WebKit Available for: Apple TV (4th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved state management. CVE-2016-7587: Adam Klein CVE-2016-7610: Zheng Huang of the Baidu Security Lab working with Trend Micro's Zero Day Initiative CVE-2016-7611: an anonymous researcher working with Trend Micro's Zero Day Initiative CVE-2016-7639: Tongbo Luo of Palo Alto Networks CVE-2016-7640: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2016-7641: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2016-7642: Tongbo Luo of Palo Alto Networks CVE-2016-7645: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2016-7646: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2016-7648: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2016-7649: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2016-7654: Keen Lab working with Trend Micro's Zero Day Initiative Entry added December 13, 2016 WebKit Available for: Apple TV (4th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved state management. CVE-2016-7589: Apple CVE-2016-7656: Keen Lab working with Trend Micro's Zero Day Initiative Entry added December 13, 2016 WebKit Available for: Apple TV (4th generation) Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: An uninitialized memory access issue was addressed through improved memory initialization. CVE-2016-7598: Samuel GroA Entry added December 13, 2016 WebKit Available for: Apple TV (4th generation) Impact: Processing maliciously crafted web content may result in the disclosure of user information Description: An issue existed in the handling of HTTP redirects. This issue was addressed through improved cross origin validation. CVE-2016-7599: Muneaki Nishimura (nishimunea) of Recruit Technologies Co., Ltd. Entry added December 13, 2016 WebKit Available for: Apple TV (4th generation) Impact: Processing maliciously crafted web content may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed through improved state management. CVE-2016-7632: Jeonghoon Shin Entry added December 13, 2016 Installation note: Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> System -> Software Update -> Update Software." To check the current version of software, select "Settings -> General -> About." Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJYT7LKAAoJEIOj74w0bLRGRpYP/RiSCpisB2QI8kO5eyhqQQw8 Cc8c+l7wlpWoeUuNznXtGBRrMlL21Xzg6HZXkRepwh7SvwKmr2Xq6tw9VRrmT554 qTVcSe/8MZEb/NcsRvwS5vw70738WLDp8l1+3jsXm46LOpn9Xyolcl7uUS8Z+mxU yDe4lMWIrNIHqQmDfXWILCL/2szx/Dn324b7klcRUy4p6JLyHwQgegQm6O582miJ SFeknLzjqhuukGnaywhwoR8GDcsFtPT4ZFgum2kBB1Ke7Q6KmeenrSN0FVH5Z+zs 5/kXWBl0xHNZigrgHhO21hzGXX0SUq/SbLEBtuBzUJG3the5Zp24T8nOeNem5I5F GJZd+S7PBnXpH+y+kURk6dVuKGDHv8tnp909v6QXjw35+oMvjEfuD64oSYf8FJNt VTVU8R+hWYqexVQSkLjOPo6TxgrlHtHZ3Kw2tOwisuB3afSSVTS6p0y+EPxUNHXw kzF5nOiEBnuTsqTiuuvTC0+p/XvFcGhVYZwygzOWeh0jKUDWXrnqY4XcqmtCPSl4 QXCNSSH8tAaPh/VIZpBYFVTRSrFqhqz17cwxEnsw7QkhFV8L8haWNfRL062swkHV 65Uq1oNytpw5bT5tL3NmBumknb+Y6/KNGT1+PQVc9cccQJtDjcjItqwfnTl0NdkB wTrD0dsr90pjud+QyhXr =YVOV -----END PGP SIGNATURE----- . CVE-2016-7634: Davut Hari Accessibility Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: A person with physical access to an iOS device may be able to access photos and contacts from the lock screen Description: A lock screen issue allowed access to photos and contacts on a locked device. CVE-2016-4690: Andy Davis of NCC Group Local Authentication Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: The device may not lock the screen after the idle timeout Description: A logic issue existed in the handling of the idle timer when the Touch ID prompt is shown. This issue was addressed by notifying a user if an email was signed with a revoked certificate. CVE-2016-7597: an anonymous researcher Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "10.2"

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

buffer error

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Maksymilian Arciemowicz (cxsecurity.com)

SOURCES

LAST UPDATE DATE

2024-11-23T21:06:43.699000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE